diff --git a/.ci/Dockerfile b/.ci/Dockerfile
index 065b7f2aafd61..d6eee046611bb 100644
--- a/.ci/Dockerfile
+++ b/.ci/Dockerfile
@@ -1,7 +1,7 @@
 # NOTE: This Dockerfile is ONLY used to run certain tasks in CI. It is not used to run Kibana or as a distributable.
 # If you're looking for the Kibana Docker image distributable, please see: src/dev/build/tasks/os_packages/docker_generator/templates/dockerfile.template.ts
 
-ARG NODE_VERSION=10.22.0
+ARG NODE_VERSION=10.22.1
 
 FROM node:${NODE_VERSION} AS base
 
diff --git a/.ci/Jenkinsfile_baseline_capture b/.ci/Jenkinsfile_baseline_capture
index 9a49c19b94df2..33ecfcd84fd3e 100644
--- a/.ci/Jenkinsfile_baseline_capture
+++ b/.ci/Jenkinsfile_baseline_capture
@@ -11,14 +11,14 @@ kibanaPipeline(timeoutMinutes: 120) {
           'CI_PARALLEL_PROCESS_NUMBER=1'
         ]) {
           parallel([
-            'oss-visualRegression': {
-              workers.ci(name: 'oss-visualRegression', size: 's-highmem', ramDisk: true) {
-                kibanaPipeline.functionalTestProcess('oss-visualRegression', './test/scripts/jenkins_visual_regression.sh')()
+            'oss-baseline': {
+              workers.ci(name: 'oss-baseline', size: 's-highmem', ramDisk: true, runErrorReporter: false) {
+                kibanaPipeline.functionalTestProcess('oss-baseline', './test/scripts/jenkins_baseline.sh')()
               }
             },
-            'xpack-visualRegression': {
-              workers.ci(name: 'xpack-visualRegression', size: 's-highmem', ramDisk: true) {
-                kibanaPipeline.functionalTestProcess('xpack-visualRegression', './test/scripts/jenkins_xpack_visual_regression.sh')()
+            'xpack-baseline': {
+              workers.ci(name: 'xpack-baseline', size: 's-highmem', ramDisk: true, runErrorReporter: false) {
+                kibanaPipeline.functionalTestProcess('xpack-baseline', './test/scripts/jenkins_xpack_baseline.sh')()
               }
             },
           ])
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index d81f6af4cec28..7daa42af7024d 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -59,7 +59,6 @@
 # APM
 /x-pack/plugins/apm/  @elastic/apm-ui
 /x-pack/test/functional/apps/apm/  @elastic/apm-ui
-/src/legacy/core_plugins/apm_oss/  @elastic/apm-ui
 /src/plugins/apm_oss/  @elastic/apm-ui
 /src/apm.js @watson @vigneshshanmugam
 
@@ -83,9 +82,6 @@
 /src/plugins/home/public @elastic/kibana-core-ui
 /src/plugins/home/server/*.ts @elastic/kibana-core-ui
 /src/plugins/home/server/services/ @elastic/kibana-core-ui
-# Exclude tutorial resources folder for now because they are not owned by Kibana app and most will move out soon
-/src/legacy/core_plugins/kibana/public/home/*.ts @elastic/kibana-core-ui
-/src/legacy/core_plugins/kibana/public/home/np_ready/ @elastic/kibana-core-ui
 /x-pack/plugins/global_search_bar/ @elastic/kibana-core-ui
 
 # Observability UIs
@@ -167,7 +163,6 @@
 
 # Security
 /src/core/server/csp/  @elastic/kibana-security @elastic/kibana-platform
-/x-pack/legacy/plugins/security/  @elastic/kibana-security
 /x-pack/legacy/plugins/spaces/  @elastic/kibana-security
 /x-pack/plugins/spaces/  @elastic/kibana-security
 /x-pack/plugins/encrypted_saved_objects/  @elastic/kibana-security
@@ -286,8 +281,6 @@ x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json @elastic/kib
 # Core design
 /src/plugins/dashboard/**/*.scss @elastic/kibana-core-ui-designers
 /x-pack/plugins/canvas/**/*.scss @elastic/kibana-core-ui-designers
-/src/legacy/core_plugins/kibana/public/home/**/*.scss @elastic/kibana-core-ui-designers
-/x-pack/legacy/plugins/security/**/*.scss @elastic/kibana-core-ui-designers
 /x-pack/legacy/plugins/spaces/**/*.scss @elastic/kibana-core-ui-designers
 /x-pack/plugins/spaces/**/*.scss @elastic/kibana-core-ui-designers
 /x-pack/plugins/security/**/*.scss @elastic/kibana-core-ui-designers
@@ -297,7 +290,7 @@ x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json @elastic/kib
 /x-pack/plugins/infra/**/*.scss @elastic/observability-design
 /x-pack/plugins/ingest_manager/**/*.scss @elastic/observability-design
 /x-pack/plugins/observability/**/*.scss @elastic/observability-design
-/x-pack/plugins/monitoring/**/*.scss @elastic/observability-design 
+/x-pack/plugins/monitoring/**/*.scss @elastic/observability-design
 
 # Ent. Search design
 /x-pack/plugins/enterprise_search/**/*.scss @elastic/ent-search-design
diff --git a/.i18nrc.json b/.i18nrc.json
index e8431fdb3f0e1..153a5a6cafece 100644
--- a/.i18nrc.json
+++ b/.i18nrc.json
@@ -57,7 +57,8 @@
     "visTypeXy": "src/plugins/vis_type_xy",
     "visualizations": "src/plugins/visualizations",
     "visualize": "src/plugins/visualize",
-    "apmOss": "src/plugins/apm_oss"
+    "apmOss": "src/plugins/apm_oss",
+    "usageCollection": "src/plugins/usage_collection"
   },
   "exclude": [
     "src/legacy/ui/ui_render/ui_render_mixin.js"
diff --git a/.node-version b/.node-version
index b7604b0c8aea6..c2f6421352c48 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-10.22.0
+10.22.1
diff --git a/.nvmrc b/.nvmrc
index b7604b0c8aea6..c2f6421352c48 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-10.22.0
+10.22.1
diff --git a/docs/api/dashboard/import-dashboard.asciidoc b/docs/api/dashboard/import-dashboard.asciidoc
index 020ec8018b85b..56bd4abbc8023 100644
--- a/docs/api/dashboard/import-dashboard.asciidoc
+++ b/docs/api/dashboard/import-dashboard.asciidoc
@@ -23,7 +23,7 @@ experimental[] Import dashboards and corresponding saved objects.
 [[dashboard-api-import-request-body]]
 ==== Request body
 
-Use the complete response body from the <<dashboard-api-export, Export dashboard API>> as the request body. Do not manually construct a payload to the endpoint.
+Use the complete response body from the <<dashboard-api-export, Export dashboard API>> as the request body. Do not manually construct a payload to the endpoint. The max payload size is determined by the `savedObjects.maxImportPayloadBytes` configuration key.
 
 [[dashboard-api-import-response-body]]
 ==== Response body
diff --git a/docs/apm/troubleshooting.asciidoc b/docs/apm/troubleshooting.asciidoc
index e00a67f6c78a4..b4c9c6a4ec39e 100644
--- a/docs/apm/troubleshooting.asciidoc
+++ b/docs/apm/troubleshooting.asciidoc
@@ -49,7 +49,7 @@ GET /_template/apm-{version}
 *Using Logstash, Kafka, etc.*
 If you're not outputting data directly from APM Server to Elasticsearch (perhaps you're using Logstash or Kafka),
 then the index template will not be set up automatically. Instead, you'll need to
-{apm-server-ref}/configuration-template.html[load the template manually].
+{apm-server-ref}/apm-server-template.html[load the template manually].
 
 *Using a custom index names*
 This problem can also occur if you've customized the index name that you write APM data to.
diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc
index 7727cd322181f..501a3698d07d9 100644
--- a/docs/developer/plugin-list.asciidoc
+++ b/docs/developer/plugin-list.asciidoc
@@ -494,6 +494,10 @@ in their infrastructure.
 |This plugins adopts some conventions in addition to or in place of conventions in Kibana (at the time of the plugin's creation):
 
 
+|{kib-repo}blob/{branch}/x-pack/plugins/xpack_legacy/README.md[xpackLegacy]
+|Contains HTTP endpoints and UiSettings that are slated for removal.
+
+
 |===
 
 include::{kibana-root}/src/plugins/dashboard/README.asciidoc[leveloffset=+1]
diff --git a/docs/development/core/server/kibana-plugin-core-server.coresetup.md b/docs/development/core/server/kibana-plugin-core-server.coresetup.md
index ccc73d4fb858e..75da8df2ae15a 100644
--- a/docs/development/core/server/kibana-plugin-core-server.coresetup.md
+++ b/docs/development/core/server/kibana-plugin-core-server.coresetup.md
@@ -23,6 +23,7 @@ export interface CoreSetup<TPluginsStart extends object = object, TStart = unkno
 |  [getStartServices](./kibana-plugin-core-server.coresetup.getstartservices.md) | <code>StartServicesAccessor&lt;TPluginsStart, TStart&gt;</code> | [StartServicesAccessor](./kibana-plugin-core-server.startservicesaccessor.md) |
 |  [http](./kibana-plugin-core-server.coresetup.http.md) | <code>HttpServiceSetup &amp; {</code><br/><code>        resources: HttpResources;</code><br/><code>    }</code> | [HttpServiceSetup](./kibana-plugin-core-server.httpservicesetup.md) |
 |  [logging](./kibana-plugin-core-server.coresetup.logging.md) | <code>LoggingServiceSetup</code> | [LoggingServiceSetup](./kibana-plugin-core-server.loggingservicesetup.md) |
+|  [metrics](./kibana-plugin-core-server.coresetup.metrics.md) | <code>MetricsServiceSetup</code> | [MetricsServiceSetup](./kibana-plugin-core-server.metricsservicesetup.md) |
 |  [savedObjects](./kibana-plugin-core-server.coresetup.savedobjects.md) | <code>SavedObjectsServiceSetup</code> | [SavedObjectsServiceSetup](./kibana-plugin-core-server.savedobjectsservicesetup.md) |
 |  [status](./kibana-plugin-core-server.coresetup.status.md) | <code>StatusServiceSetup</code> | [StatusServiceSetup](./kibana-plugin-core-server.statusservicesetup.md) |
 |  [uiSettings](./kibana-plugin-core-server.coresetup.uisettings.md) | <code>UiSettingsServiceSetup</code> | [UiSettingsServiceSetup](./kibana-plugin-core-server.uisettingsservicesetup.md) |
diff --git a/docs/development/core/server/kibana-plugin-core-server.coresetup.metrics.md b/docs/development/core/server/kibana-plugin-core-server.coresetup.metrics.md
new file mode 100644
index 0000000000000..77c9e867ef8ea
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.coresetup.metrics.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [CoreSetup](./kibana-plugin-core-server.coresetup.md) &gt; [metrics](./kibana-plugin-core-server.coresetup.metrics.md)
+
+## CoreSetup.metrics property
+
+[MetricsServiceSetup](./kibana-plugin-core-server.metricsservicesetup.md)
+
+<b>Signature:</b>
+
+```typescript
+metrics: MetricsServiceSetup;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.corestart.md b/docs/development/core/server/kibana-plugin-core-server.corestart.md
index 610c85c71e362..0d5474fae5e16 100644
--- a/docs/development/core/server/kibana-plugin-core-server.corestart.md
+++ b/docs/development/core/server/kibana-plugin-core-server.corestart.md
@@ -20,7 +20,7 @@ export interface CoreStart
 |  [capabilities](./kibana-plugin-core-server.corestart.capabilities.md) | <code>CapabilitiesStart</code> | [CapabilitiesStart](./kibana-plugin-core-server.capabilitiesstart.md) |
 |  [elasticsearch](./kibana-plugin-core-server.corestart.elasticsearch.md) | <code>ElasticsearchServiceStart</code> | [ElasticsearchServiceStart](./kibana-plugin-core-server.elasticsearchservicestart.md) |
 |  [http](./kibana-plugin-core-server.corestart.http.md) | <code>HttpServiceStart</code> | [HttpServiceStart](./kibana-plugin-core-server.httpservicestart.md) |
-|  [metrics](./kibana-plugin-core-server.corestart.metrics.md) | <code>MetricsServiceStart</code> |  |
+|  [metrics](./kibana-plugin-core-server.corestart.metrics.md) | <code>MetricsServiceStart</code> | [MetricsServiceStart](./kibana-plugin-core-server.metricsservicestart.md) |
 |  [savedObjects](./kibana-plugin-core-server.corestart.savedobjects.md) | <code>SavedObjectsServiceStart</code> | [SavedObjectsServiceStart](./kibana-plugin-core-server.savedobjectsservicestart.md) |
 |  [uiSettings](./kibana-plugin-core-server.corestart.uisettings.md) | <code>UiSettingsServiceStart</code> | [UiSettingsServiceStart](./kibana-plugin-core-server.uisettingsservicestart.md) |
 
diff --git a/docs/development/core/server/kibana-plugin-core-server.corestart.metrics.md b/docs/development/core/server/kibana-plugin-core-server.corestart.metrics.md
index a51c2f842c346..2c32f730c4c9b 100644
--- a/docs/development/core/server/kibana-plugin-core-server.corestart.metrics.md
+++ b/docs/development/core/server/kibana-plugin-core-server.corestart.metrics.md
@@ -4,6 +4,7 @@
 
 ## CoreStart.metrics property
 
+[MetricsServiceStart](./kibana-plugin-core-server.metricsservicestart.md)
 
 <b>Signature:</b>
 
diff --git a/docs/development/core/server/kibana-plugin-core-server.md b/docs/development/core/server/kibana-plugin-core-server.md
index 69f2cf0338a01..b83c091846f04 100644
--- a/docs/development/core/server/kibana-plugin-core-server.md
+++ b/docs/development/core/server/kibana-plugin-core-server.md
@@ -253,6 +253,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [LegacyElasticsearchClientConfig](./kibana-plugin-core-server.legacyelasticsearchclientconfig.md) |  |
 |  [LifecycleResponseFactory](./kibana-plugin-core-server.lifecycleresponsefactory.md) | Creates an object containing redirection or error response with error details, HTTP headers, and other data transmitted to the client. |
 |  [LoggerConfigType](./kibana-plugin-core-server.loggerconfigtype.md) |  |
+|  [MetricsServiceStart](./kibana-plugin-core-server.metricsservicestart.md) | APIs to retrieves metrics gathered and exposed by the core platform. |
 |  [MIGRATION\_ASSISTANCE\_INDEX\_ACTION](./kibana-plugin-core-server.migration_assistance_index_action.md) |  |
 |  [MIGRATION\_DEPRECATION\_LEVEL](./kibana-plugin-core-server.migration_deprecation_level.md) |  |
 |  [MutatingOperationRefreshSetting](./kibana-plugin-core-server.mutatingoperationrefreshsetting.md) | Elasticsearch Refresh setting for mutating operation |
diff --git a/docs/development/core/server/kibana-plugin-core-server.metricsservicestart.md b/docs/development/core/server/kibana-plugin-core-server.metricsservicestart.md
new file mode 100644
index 0000000000000..8b3280d528c18
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.metricsservicestart.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [MetricsServiceStart](./kibana-plugin-core-server.metricsservicestart.md)
+
+## MetricsServiceStart type
+
+APIs to retrieves metrics gathered and exposed by the core platform.
+
+<b>Signature:</b>
+
+```typescript
+export declare type MetricsServiceStart = MetricsServiceSetup;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.servicestatuslevels.md b/docs/development/core/server/kibana-plugin-core-server.servicestatuslevels.md
index a66cec78c736b..e57dc192cd572 100644
--- a/docs/development/core/server/kibana-plugin-core-server.servicestatuslevels.md
+++ b/docs/development/core/server/kibana-plugin-core-server.servicestatuslevels.md
@@ -13,18 +13,22 @@ ServiceStatusLevels: Readonly<{
     available: Readonly<{
         toString: () => "available";
         valueOf: () => 0;
+        toJSON: () => "available";
     }>;
     degraded: Readonly<{
         toString: () => "degraded";
         valueOf: () => 1;
+        toJSON: () => "degraded";
     }>;
     unavailable: Readonly<{
         toString: () => "unavailable";
         valueOf: () => 2;
+        toJSON: () => "unavailable";
     }>;
     critical: Readonly<{
         toString: () => "critical";
         valueOf: () => 3;
+        toJSON: () => "critical";
     }>;
 }>
 ```
diff --git a/docs/development/core/server/kibana-plugin-core-server.sharedglobalconfig.md b/docs/development/core/server/kibana-plugin-core-server.sharedglobalconfig.md
index 7f306919101ef..ec2e1b227a2d7 100644
--- a/docs/development/core/server/kibana-plugin-core-server.sharedglobalconfig.md
+++ b/docs/development/core/server/kibana-plugin-core-server.sharedglobalconfig.md
@@ -12,5 +12,6 @@ export declare type SharedGlobalConfig = RecursiveReadonly<{
     kibana: Pick<KibanaConfigType, typeof SharedGlobalConfigKeys.kibana[number]>;
     elasticsearch: Pick<ElasticsearchConfigType, typeof SharedGlobalConfigKeys.elasticsearch[number]>;
     path: Pick<PathConfigType, typeof SharedGlobalConfigKeys.path[number]>;
+    savedObjects: Pick<SavedObjectsConfigType, typeof SharedGlobalConfigKeys.savedObjects[number]>;
 }>;
 ```
diff --git a/docs/development/core/server/kibana-plugin-core-server.statusservicesetup.isstatuspageanonymous.md b/docs/development/core/server/kibana-plugin-core-server.statusservicesetup.isstatuspageanonymous.md
new file mode 100644
index 0000000000000..c417aaa2cef48
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.statusservicesetup.isstatuspageanonymous.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [StatusServiceSetup](./kibana-plugin-core-server.statusservicesetup.md) &gt; [isStatusPageAnonymous](./kibana-plugin-core-server.statusservicesetup.isstatuspageanonymous.md)
+
+## StatusServiceSetup.isStatusPageAnonymous property
+
+Whether or not the status HTTP APIs are available to unauthenticated users when an authentication provider is present.
+
+<b>Signature:</b>
+
+```typescript
+isStatusPageAnonymous: () => boolean;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.statusservicesetup.md b/docs/development/core/server/kibana-plugin-core-server.statusservicesetup.md
index ba0645be4d26c..f522d11a7ffef 100644
--- a/docs/development/core/server/kibana-plugin-core-server.statusservicesetup.md
+++ b/docs/development/core/server/kibana-plugin-core-server.statusservicesetup.md
@@ -74,6 +74,7 @@ core.status.set(
 |  [core$](./kibana-plugin-core-server.statusservicesetup.core_.md) | <code>Observable&lt;CoreStatus&gt;</code> | Current status for all Core services. |
 |  [dependencies$](./kibana-plugin-core-server.statusservicesetup.dependencies_.md) | <code>Observable&lt;Record&lt;string, ServiceStatus&gt;&gt;</code> | Current status for all plugins this plugin depends on. Each key of the <code>Record</code> is a plugin id. |
 |  [derivedStatus$](./kibana-plugin-core-server.statusservicesetup.derivedstatus_.md) | <code>Observable&lt;ServiceStatus&gt;</code> | The status of this plugin as derived from its dependencies. |
+|  [isStatusPageAnonymous](./kibana-plugin-core-server.statusservicesetup.isstatuspageanonymous.md) | <code>() =&gt; boolean</code> | Whether or not the status HTTP APIs are available to unauthenticated users when an authentication provider is present. |
 |  [overall$](./kibana-plugin-core-server.statusservicesetup.overall_.md) | <code>Observable&lt;ServiceStatus&gt;</code> | Overall system status for all of Kibana. |
 
 ## Methods
diff --git a/docs/settings/reporting-settings.asciidoc b/docs/settings/reporting-settings.asciidoc
index 9c8d753a2d668..3489dcd018293 100644
--- a/docs/settings/reporting-settings.asciidoc
+++ b/docs/settings/reporting-settings.asciidoc
@@ -104,15 +104,14 @@ security is enabled, `xpack.security.encryptionKey`.
 [cols="2*<"]
 |===
 | `xpack.reporting.queue.pollInterval`
-  | Specifies the number of milliseconds that the reporting poller waits between polling the
-  index for any pending Reporting jobs. Defaults to `3000` (3 seconds).
+  | Specify the {ref}/common-options.html#time-units[time] that the reporting poller waits between polling the index for any
+  pending Reporting jobs. Can be specified as number of milliseconds. Defaults to `3s`.
 
 | [[xpack-reporting-q-timeout]] `xpack.reporting.queue.timeout` {ess-icon}
-  | How long each worker has to produce a report. If your machine is slow or under
-  heavy load, you might need to increase this timeout. Specified in milliseconds.
-  If a Reporting job execution time goes over this time limit, the job will be
-  marked as a failure and there will not be a download available.
-  Defaults to `120000` (two minutes).
+  | {ref}/common-options.html#time-units[How long] each worker has to produce a report. If your machine is slow or under heavy
+  load, you might need to increase this timeout. If a Reporting job execution goes over this time limit, the job is marked as a
+  failure and no download will be available. Can be specified as number of milliseconds.
+  Defaults to `2m`.
 
 |===
 
@@ -127,24 +126,24 @@ control the capturing process.
 |===
 a| `xpack.reporting.capture.timeouts`
 `.openUrl` {ess-icon}
-  | Specify how long to allow the Reporting browser to wait for the "Loading..." screen
-  to dismiss and find the initial data for the Kibana page.  If the time is
-  exceeded, a page screenshot is captured showing the current state, and the download link shows a warning message.
-  Defaults to `60000` (1 minute).
+  | Specify the {ref}/common-options.html#time-units[time] to allow the Reporting browser to wait for the "Loading..." screen
+  to dismiss and find the initial data for the page. If the time is exceeded, a screenshot is captured showing the current
+  page, and the download link shows a warning message. Can be specified as number of milliseconds.
+  Defaults to `1m`.
 
 a| `xpack.reporting.capture.timeouts`
 `.waitForElements` {ess-icon}
-  | Specify how long to allow the Reporting browser to wait for all visualization
-  panels to load on the Kibana page. If the time is exceeded, a page screenshot
-  is captured showing the current state, and the download link shows a warning message. Defaults to `30000` (30
-  seconds).
+  | Specify the {ref}/common-options.html#time-units[time] to allow the Reporting browser to wait for all visualization panels
+  to load on the page. If the time is exceeded, a screenshot is captured showing the current page, and the download link shows
+  a warning message. Can be specified as number of milliseconds.
+  Defaults to `30s`.
 
 a| `xpack.reporting.capture.timeouts`
 `.renderComplete` {ess-icon}
-  | Specify how long to allow the Reporting browser to wait for all visualizations to
-  fetch and render the data. If the time is exceeded, a
-  page screenshot is captured showing the current state, and the download link shows a warning message. Defaults to
-  `30000` (30 seconds).
+  | Specify the {ref}/common-options.html#time-units[time] to allow the Reporting browser to wait for all visualizations to
+  fetch and render the data. If the time is exceeded, a screenshot is captured showing the current page, and the download link shows a
+  warning message. Can be specified as number of milliseconds.
+  Defaults to `30s`.
 
 |===
 
@@ -163,11 +162,10 @@ available, but there will likely be errors in the visualizations in the report.
   job, as many times as this setting. Defaults to `3`.
 
 | `xpack.reporting.capture.loadDelay`
-  | When visualizations are not evented, this is the amount of time before
-  taking a screenshot. All visualizations that ship with {kib} are evented, so this
-  setting should not have much effect. If you are seeing empty images instead of
-  visualizations, try increasing this value.
-  Defaults to `3000` (3 seconds).
+  | Specify the {ref}/common-options.html#time-units[amount of time] before taking a screenshot when visualizations are not evented.
+  All visualizations that ship with {kib} are evented, so this setting should not have much effect. If you are seeing empty images
+  instead of visualizations, try increasing this value.
+  Defaults to `3s`.
 
 | [[xpack-reporting-browser]] `xpack.reporting.capture.browser.type` {ess-icon}
   | Specifies the browser to use to capture screenshots. This setting exists for
@@ -213,9 +211,9 @@ a| `xpack.reporting.capture.browser`
 [cols="2*<"]
 |===
 | [[xpack-reporting-csv]] `xpack.reporting.csv.maxSizeBytes` {ess-icon}
-  | The maximum size of a CSV file before being truncated. This setting exists to prevent
-  large exports from causing performance and storage issues.
-  Defaults to `10485760` (10mB).
+  | The maximum {ref}/common-options.html#byte-units[byte size] of a CSV file before being truncated. This setting exists to
+  prevent large exports from causing performance and storage issues. Can be specified as number of bytes.
+  Defaults to `10mb`.
 
 | `xpack.reporting.csv.scroll.size`
   | Number of documents retrieved from {es} for each scroll iteration during a CSV
@@ -223,7 +221,7 @@ a| `xpack.reporting.capture.browser`
   Defaults to `500`.
 
 | `xpack.reporting.csv.scroll.duration`
-  | Amount of time allowed before {kib} cleans the scroll context during a CSV export.
+  |  Amount of {ref}/common-options.html#time-units[time] allowed before {kib} cleans the scroll context during a CSV export.
   Defaults to `30s`.
 
 | `xpack.reporting.csv.checkForFormulas`
diff --git a/docs/user/alerting/action-types/server-log.asciidoc b/docs/user/alerting/action-types/server-log.asciidoc
index eadca229bc19c..7022320328c85 100644
--- a/docs/user/alerting/action-types/server-log.asciidoc
+++ b/docs/user/alerting/action-types/server-log.asciidoc
@@ -2,7 +2,7 @@
 [[server-log-action-type]]
 === Server log action
 
-This action type writes and entry to the {kib} server log.
+This action type writes an entry to the {kib} server log.
 
 [float]
 [[server-log-connector-configuration]]
diff --git a/docs/user/dashboard/drilldowns.asciidoc b/docs/user/dashboard/drilldowns.asciidoc
index 85230f1b6f70d..e3d0e16630c5c 100644
--- a/docs/user/dashboard/drilldowns.asciidoc
+++ b/docs/user/dashboard/drilldowns.asciidoc
@@ -1,3 +1,4 @@
+[role="xpack"]
 [[drilldowns]]
 == Use drilldowns for dashboard actions
 
diff --git a/docs/user/dashboard/url-drilldown.asciidoc b/docs/user/dashboard/url-drilldown.asciidoc
index 16f82477756b7..e6daf89d72718 100644
--- a/docs/user/dashboard/url-drilldown.asciidoc
+++ b/docs/user/dashboard/url-drilldown.asciidoc
@@ -1,6 +1,8 @@
 [[url-drilldown]]
 === URL drilldown
 
+beta[]
+
 The URL drilldown allows you to navigate from a dashboard to an internal or external URL.
 The destination URL can be dynamic, depending on the dashboard context or user’s interaction with a visualization.
 
@@ -197,6 +199,7 @@ context.panel.timeRange.indexPatternIds
 | ID of saved object behind a panel.
 
 | *Single click*
+
 | event.value
 | Value behind clicked data point.
 
@@ -208,6 +211,22 @@ context.panel.timeRange.indexPatternIds
 | event.negate
 | Boolean, indicating whether clicked data point resulted in negative filter.
 
+|
+| event.points
+| Some visualizations have clickable points that emit more than one data point. Use list of data points in case a single value is insufficient. +
+
+Example:
+
+`{{json event.points}}` +
+`{{event.points.[0].key}}` +
+`{{event.points.[0].value}}`
+`{{#each event.points}}key=value&{{/each}}`
+
+Note:
+
+`{{event.value}}` is a shorthand for `{{event.points.[0].value}}` + 
+`{{event.key}}` is a shorthand for `{{event.points.[0].key}}`
+
 | *Range selection*
 | event.from +
 event.to
diff --git a/docs/user/ml/index.asciidoc b/docs/user/ml/index.asciidoc
index 214dae2b96e04..8255585aae411 100644
--- a/docs/user/ml/index.asciidoc
+++ b/docs/user/ml/index.asciidoc
@@ -20,15 +20,11 @@ image::user/ml/images/ml-data-visualizer-sample.jpg[{data-viz} for sample flight
 experimental[] You can also upload a CSV, NDJSON, or log file. The *{data-viz}*
 identifies the file format and field mappings. You can then optionally import
 that data into an {es} index. To change the default file size limit, see
-<<kibana-ml-settings>>.
+<<kibana-ml-settings,Machine learning advanced settings>>.
 
-You need the following permissions to use the {data-viz} with file upload:
-
-* cluster privileges: `monitor`, `manage_ingest_pipelines`
-* index privileges: `read`, `manage`, `index`
-
-For more information, see {ref}/security-privileges.html[Security privileges] 
-and {ml-docs}/setup.html[Set up {ml-features}].
+If {stack-security-features} are enabled, users must have the necessary
+privileges to use {ml-features}. Refer to 
+{ml-docs}/setup.html#setup-privileges[Set up {ml-features}].
 
 --
 
diff --git a/docs/user/security/authorization/index.asciidoc b/docs/user/security/authorization/index.asciidoc
index 93d6d4249119f..44ca96e4aece5 100644
--- a/docs/user/security/authorization/index.asciidoc
+++ b/docs/user/security/authorization/index.asciidoc
@@ -28,7 +28,9 @@ Use the **Privilege** menu to grant access to features. The default is **Custom*
 
 When using the **Customize by feature** option, you can choose either **All**, **Read** or **None** for access to each feature. As new features are added to Kibana, roles that use the custom option do not automatically get access to the new features. You must manually update the roles.
 
-NOTE: Machine Learning and Stack Monitoring rely on built-in roles to grant access. When a user is assigned the appropriate roles, the Machine Learning and Stack Monitoring application are available; otherwise, these applications are not visible.
+NOTE: *{stack-monitor-app}* relies on built-in roles to grant access. When a
+user is assigned the appropriate roles, the *{stack-monitor-app}* application is
+available; otherwise, it is not visible.
 
 To apply your changes, click **Create space privilege**. The space privilege shows up under the Kibana privileges section of the role.
 
diff --git a/kibana.d.ts b/kibana.d.ts
index 517bda374af9d..b707405ffbeaf 100644
--- a/kibana.d.ts
+++ b/kibana.d.ts
@@ -28,7 +28,6 @@ export { Public, Server };
 /**
  * All exports from TS ambient definitions (where types are added for JS source in a .d.ts file).
  */
-import * as LegacyElasticsearch from './src/legacy/core_plugins/elasticsearch';
 import * as LegacyKibanaPluginSpec from './src/legacy/plugin_discovery/plugin_spec/plugin_spec_options';
 import * as LegacyKibanaServer from './src/legacy/server/kbn_server';
 
@@ -44,13 +43,4 @@ export namespace Legacy {
   export type InitPluginFunction = LegacyKibanaPluginSpec.InitPluginFunction;
   export type UiExports = LegacyKibanaPluginSpec.UiExports;
   export type PluginSpecOptions = LegacyKibanaPluginSpec.PluginSpecOptions;
-
-  export namespace Plugins {
-    export namespace elasticsearch {
-      export type Plugin = LegacyElasticsearch.ElasticsearchPlugin;
-      export type Cluster = LegacyElasticsearch.Cluster;
-      export type ClusterConfig = LegacyElasticsearch.ClusterConfig;
-      export type CallClusterOptions = LegacyElasticsearch.CallClusterOptions;
-    }
-  }
 }
diff --git a/package.json b/package.json
index 5008bc0bcebc5..c88fbc0e5fd07 100644
--- a/package.json
+++ b/package.json
@@ -78,27 +78,18 @@
   },
   "resolutions": {
     "**/@types/node": ">=10.17.17 <10.20.0",
-    "**/@types/react": "^16.9.36",
-    "**/@types/hapi": "^17.0.18",
-    "**/@types/angular": "^1.6.56",
-    "**/@types/hoist-non-react-statics": "^3.3.1",
-    "**/@types/chai": "^4.2.11",
-    "**/cypress/@types/lodash": "^4.14.159",
-    "**/cypress/lodash": "^4.17.20",
-    "**/typescript": "4.0.2",
+    "**/cross-fetch/node-fetch": "^2.6.1",
+    "**/deepmerge": "^4.2.2",
+    "**/fast-deep-equal": "^3.1.1",
     "**/graphql-toolkit/lodash": "^4.17.15",
     "**/hoist-non-react-statics": "^3.3.2",
-    "**/isomorphic-git/**/base64-js": "^1.2.1",
+    "**/isomorphic-fetch/node-fetch": "^2.6.1",
     "**/istanbul-instrumenter-loader/schema-utils": "1.0.0",
-    "**/image-diff/gm/debug": "^2.6.9",
     "**/load-grunt-config/lodash": "^4.17.20",
+    "**/minimist": "^1.2.5",
     "**/node-jose/node-forge": "^0.10.0",
-    "**/react-dom": "^16.12.0",
-    "**/react": "^16.12.0",
-    "**/react-test-renderer": "^16.12.0",
     "**/request": "^2.88.2",
-    "**/deepmerge": "^4.2.2",
-    "**/fast-deep-equal": "^3.1.1"
+    "**/typescript": "4.0.2"
   },
   "workspaces": {
     "packages": [
@@ -128,7 +119,7 @@
     "@babel/register": "^7.10.5",
     "@elastic/datemath": "5.0.3",
     "@elastic/elasticsearch": "7.9.0-rc.2",
-    "@elastic/eui": "28.2.0",
+    "@elastic/eui": "28.4.0",
     "@elastic/good": "8.1.1-kibana2",
     "@elastic/numeral": "^2.5.0",
     "@elastic/request-crypto": "1.1.4",
@@ -194,7 +185,7 @@
     "moment": "^2.24.0",
     "moment-timezone": "^0.5.27",
     "mustache": "2.3.2",
-    "node-fetch": "1.7.3",
+    "node-fetch": "2.6.1",
     "node-forge": "^0.10.0",
     "opn": "^5.5.0",
     "oppsy": "^2.0.0",
@@ -489,7 +480,7 @@
     "zlib": "^1.0.5"
   },
   "engines": {
-    "node": "10.22.0",
+    "node": "10.22.1",
     "yarn": "^1.21.1"
   }
 }
diff --git a/packages/kbn-es/package.json b/packages/kbn-es/package.json
index dabf11fdd0b66..52ef3fe05e751 100644
--- a/packages/kbn-es/package.json
+++ b/packages/kbn-es/package.json
@@ -14,7 +14,7 @@
     "execa": "^4.0.2",
     "getopts": "^2.2.4",
     "glob": "^7.1.2",
-    "node-fetch": "^2.6.0",
+    "node-fetch": "^2.6.1",
     "simple-git": "^1.91.0",
     "tar-fs": "^2.1.0",
     "tree-kill": "^1.2.2",
diff --git a/packages/kbn-ui-shared-deps/package.json b/packages/kbn-ui-shared-deps/package.json
index bbe7b1bc2e8da..8095e05e8b855 100644
--- a/packages/kbn-ui-shared-deps/package.json
+++ b/packages/kbn-ui-shared-deps/package.json
@@ -10,7 +10,7 @@
   },
   "dependencies": {
     "@elastic/charts": "21.1.2",
-    "@elastic/eui": "28.2.0",
+    "@elastic/eui": "28.4.0",
     "@elastic/numeral": "^2.5.0",
     "@kbn/i18n": "1.0.0",
     "@kbn/monaco": "1.0.0",
diff --git a/src/cli/cluster/cluster_manager.ts b/src/cli/cluster/cluster_manager.ts
index b1d1335eb1888..78472bb3f517d 100644
--- a/src/cli/cluster/cluster_manager.ts
+++ b/src/cli/cluster/cluster_manager.ts
@@ -224,7 +224,6 @@ export class ClusterManager {
       new Set(
         [
           fromRoot('src/core'),
-          fromRoot('src/legacy/core_plugins'),
           fromRoot('src/legacy/server'),
           fromRoot('src/legacy/ui'),
           fromRoot('src/legacy/utils'),
diff --git a/src/cli/serve/serve.js b/src/cli/serve/serve.js
index eeb5564667ec4..d8bd39b9dcdf4 100644
--- a/src/cli/serve/serve.js
+++ b/src/cli/serve/serve.js
@@ -178,7 +178,7 @@ export default function (program) {
       'A path to scan for plugins, this can be specified multiple ' +
         'times to specify multiple directories',
       pluginDirCollector,
-      [fromRoot('plugins'), fromRoot('src/legacy/core_plugins')]
+      [fromRoot('plugins')]
     )
     .option(
       '--plugin-path <path>',
diff --git a/src/core/public/chrome/ui/header/__snapshots__/collapsible_nav.test.tsx.snap b/src/core/public/chrome/ui/header/__snapshots__/collapsible_nav.test.tsx.snap
index 1bff6cd9301ed..699fe2c4c4d4d 100644
--- a/src/core/public/chrome/ui/header/__snapshots__/collapsible_nav.test.tsx.snap
+++ b/src/core/public/chrome/ui/header/__snapshots__/collapsible_nav.test.tsx.snap
@@ -658,6 +658,7 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
                     aria-controls="mockId"
                     aria-expanded={true}
                     className="euiAccordion__button euiAccordion__buttonReverse euiCollapsibleNavGroup__heading"
+                    id="mockId"
                     onClick={[Function]}
                     type="button"
                   >
@@ -911,6 +912,7 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
                         aria-controls="mockId"
                         aria-expanded={true}
                         className="euiAccordion__button euiAccordion__buttonReverse euiCollapsibleNavGroup__heading"
+                        id="mockId"
                         onClick={[Function]}
                         type="button"
                       >
@@ -1200,6 +1202,7 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
                         aria-controls="mockId"
                         aria-expanded={true}
                         className="euiAccordion__button euiAccordion__buttonReverse euiCollapsibleNavGroup__heading"
+                        id="mockId"
                         onClick={[Function]}
                         type="button"
                       >
@@ -1450,6 +1453,7 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
                         aria-controls="mockId"
                         aria-expanded={true}
                         className="euiAccordion__button euiAccordion__buttonReverse euiCollapsibleNavGroup__heading"
+                        id="mockId"
                         onClick={[Function]}
                         type="button"
                       >
@@ -1652,6 +1656,7 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
                         aria-controls="mockId"
                         aria-expanded={true}
                         className="euiAccordion__button euiAccordion__buttonReverse euiCollapsibleNavGroup__heading"
+                        id="mockId"
                         onClick={[Function]}
                         type="button"
                       >
@@ -2875,6 +2880,7 @@ exports[`CollapsibleNav renders the default nav 3`] = `
                     aria-controls="mockId"
                     aria-expanded={true}
                     className="euiAccordion__button euiAccordion__buttonReverse euiCollapsibleNavGroup__heading"
+                    id="mockId"
                     onClick={[Function]}
                     type="button"
                   >
diff --git a/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap b/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
index d90d0824a1237..b5c1f3ca843e4 100644
--- a/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
+++ b/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
@@ -5734,6 +5734,7 @@ exports[`Header renders 1`] = `
                         aria-controls="mockId"
                         aria-expanded={true}
                         className="euiAccordion__button euiAccordion__buttonReverse euiCollapsibleNavGroup__heading"
+                        id="mockId"
                         onClick={[Function]}
                         type="button"
                       >
diff --git a/src/core/server/context/context_service.mock.ts b/src/core/server/context/context_service.mock.ts
index a8d895acad624..24e0d52100bb1 100644
--- a/src/core/server/context/context_service.mock.ts
+++ b/src/core/server/context/context_service.mock.ts
@@ -21,9 +21,9 @@ import type { PublicMethodsOf } from '@kbn/utility-types';
 import { ContextService, ContextSetup } from './context_service';
 import { contextMock } from '../../utils/context.mock';
 
-const createSetupContractMock = () => {
+const createSetupContractMock = (mockContext = {}) => {
   const setupContract: jest.Mocked<ContextSetup> = {
-    createContextContainer: jest.fn().mockImplementation(() => contextMock.create()),
+    createContextContainer: jest.fn().mockImplementation(() => contextMock.create(mockContext)),
   };
   return setupContract;
 };
diff --git a/src/core/server/elasticsearch/version_check/ensure_es_version.ts b/src/core/server/elasticsearch/version_check/ensure_es_version.ts
index 5f926215d167f..70ff8857117de 100644
--- a/src/core/server/elasticsearch/version_check/ensure_es_version.ts
+++ b/src/core/server/elasticsearch/version_check/ensure_es_version.ts
@@ -72,7 +72,7 @@ export function mapNodesVersionCompatibility(
   kibanaVersion: string,
   ignoreVersionMismatch: boolean
 ): NodesVersionCompatibility {
-  if (Object.keys(nodesInfo.nodes).length === 0) {
+  if (Object.keys(nodesInfo.nodes ?? {}).length === 0) {
     return {
       isCompatible: false,
       message: 'Unable to retrieve version information from Elasticsearch nodes.',
diff --git a/src/core/server/index.ts b/src/core/server/index.ts
index 01797d073ae2e..24d1fc9d369f2 100644
--- a/src/core/server/index.ts
+++ b/src/core/server/index.ts
@@ -60,7 +60,7 @@ import {
   SavedObjectsServiceStart,
 } from './saved_objects';
 import { CapabilitiesSetup, CapabilitiesStart } from './capabilities';
-import { MetricsServiceStart } from './metrics';
+import { MetricsServiceSetup, MetricsServiceStart } from './metrics';
 import { StatusServiceSetup } from './status';
 import { Auditor, AuditTrailSetup, AuditTrailStart } from './audit_trail';
 import { AppenderConfigType, appendersSchema, LoggingServiceSetup } from './logging';
@@ -320,6 +320,7 @@ export {
   OpsServerMetrics,
   OpsProcessMetrics,
   MetricsServiceSetup,
+  MetricsServiceStart,
 } from './metrics';
 
 export { DEFAULT_APP_CATEGORIES } from '../utils';
@@ -414,6 +415,8 @@ export interface CoreSetup<TPluginsStart extends object = object, TStart = unkno
   };
   /** {@link LoggingServiceSetup} */
   logging: LoggingServiceSetup;
+  /** {@link MetricsServiceSetup} */
+  metrics: MetricsServiceSetup;
   /** {@link SavedObjectsServiceSetup} */
   savedObjects: SavedObjectsServiceSetup;
   /** {@link StatusServiceSetup} */
diff --git a/src/core/server/internal_types.ts b/src/core/server/internal_types.ts
index 6780ca6b59f4d..f5a5edffb0a74 100644
--- a/src/core/server/internal_types.ts
+++ b/src/core/server/internal_types.ts
@@ -33,7 +33,7 @@ import {
 } from './saved_objects';
 import { InternalUiSettingsServiceSetup, InternalUiSettingsServiceStart } from './ui_settings';
 import { InternalEnvironmentServiceSetup } from './environment';
-import { InternalMetricsServiceStart } from './metrics';
+import { InternalMetricsServiceSetup, InternalMetricsServiceStart } from './metrics';
 import { InternalRenderingServiceSetup } from './rendering';
 import { InternalHttpResourcesSetup } from './http_resources';
 import { InternalStatusServiceSetup } from './status';
@@ -54,6 +54,7 @@ export interface InternalCoreSetup {
   httpResources: InternalHttpResourcesSetup;
   auditTrail: AuditTrailSetup;
   logging: InternalLoggingServiceSetup;
+  metrics: InternalMetricsServiceSetup;
 }
 
 /**
diff --git a/src/core/server/legacy/legacy_service.test.ts b/src/core/server/legacy/legacy_service.test.ts
index 549252723be3f..a6fe95deb3979 100644
--- a/src/core/server/legacy/legacy_service.test.ts
+++ b/src/core/server/legacy/legacy_service.test.ts
@@ -51,6 +51,7 @@ import { coreMock } from '../mocks';
 import { statusServiceMock } from '../status/status_service.mock';
 import { auditTrailServiceMock } from '../audit_trail/audit_trail_service.mock';
 import { loggingServiceMock } from '../logging/logging_service.mock';
+import { metricsServiceMock } from '../metrics/metrics_service.mock';
 
 const MockKbnServer: jest.Mock<KbnServer> = KbnServer as any;
 
@@ -99,6 +100,7 @@ beforeEach(() => {
       status: statusServiceMock.createInternalSetupContract(),
       auditTrail: auditTrailServiceMock.createSetupContract(),
       logging: loggingServiceMock.createInternalSetupContract(),
+      metrics: metricsServiceMock.createInternalSetupContract(),
     },
     plugins: { 'plugin-id': 'plugin-value' },
     uiPlugins: {
diff --git a/src/core/server/legacy/legacy_service.ts b/src/core/server/legacy/legacy_service.ts
index fd3e3a694e6ae..4dc22be2a9971 100644
--- a/src/core/server/legacy/legacy_service.ts
+++ b/src/core/server/legacy/legacy_service.ts
@@ -302,6 +302,10 @@ export class LegacyService implements CoreService {
       logging: {
         configure: (config$) => setupDeps.core.logging.configure([], config$),
       },
+      metrics: {
+        collectionInterval: setupDeps.core.metrics.collectionInterval,
+        getOpsMetrics$: setupDeps.core.metrics.getOpsMetrics$,
+      },
       savedObjects: {
         setClientFactoryProvider: setupDeps.core.savedObjects.setClientFactoryProvider,
         addClientWrapper: setupDeps.core.savedObjects.addClientWrapper,
@@ -309,6 +313,7 @@ export class LegacyService implements CoreService {
         getImportExportObjectLimit: setupDeps.core.savedObjects.getImportExportObjectLimit,
       },
       status: {
+        isStatusPageAnonymous: setupDeps.core.status.isStatusPageAnonymous,
         core$: setupDeps.core.status.core$,
         overall$: setupDeps.core.status.overall$,
         set: () => {
diff --git a/src/core/server/metrics/metrics_service.mock.ts b/src/core/server/metrics/metrics_service.mock.ts
index caa7acc001db3..0d9e9af39317c 100644
--- a/src/core/server/metrics/metrics_service.mock.ts
+++ b/src/core/server/metrics/metrics_service.mock.ts
@@ -78,8 +78,8 @@ type MetricsServiceContract = PublicMethodsOf<MetricsService>;
 
 const createMock = () => {
   const mocked: jest.Mocked<MetricsServiceContract> = {
-    setup: jest.fn().mockReturnValue(createInternalSetupContractMock()),
-    start: jest.fn().mockReturnValue(createInternalStartContractMock()),
+    setup: jest.fn().mockReturnValue(createSetupContractMock()),
+    start: jest.fn().mockReturnValue(createStartContractMock()),
     stop: jest.fn(),
   };
   return mocked;
diff --git a/src/core/server/metrics/metrics_service.test.ts b/src/core/server/metrics/metrics_service.test.ts
index 269931d0e33ad..384a56c8dba94 100644
--- a/src/core/server/metrics/metrics_service.test.ts
+++ b/src/core/server/metrics/metrics_service.test.ts
@@ -106,6 +106,25 @@ describe('MetricsService', () => {
         `"#setup() needs to be run first"`
       );
     });
+
+    it('emits the last value on each getOpsMetrics$ call', async () => {
+      const firstMetrics = { metric: 'first' };
+      const secondMetrics = { metric: 'second' };
+      mockOpsCollector.collect
+        .mockResolvedValueOnce(firstMetrics)
+        .mockResolvedValueOnce(secondMetrics);
+
+      await metricsService.setup({ http: httpMock });
+      const { getOpsMetrics$ } = await metricsService.start();
+
+      const firstEmission = getOpsMetrics$().pipe(take(1)).toPromise();
+      jest.advanceTimersByTime(testInterval);
+      expect(await firstEmission).toEqual({ metric: 'first' });
+
+      const secondEmission = getOpsMetrics$().pipe(take(1)).toPromise();
+      jest.advanceTimersByTime(testInterval);
+      expect(await secondEmission).toEqual({ metric: 'second' });
+    });
   });
 
   describe('#stop', () => {
diff --git a/src/core/server/metrics/metrics_service.ts b/src/core/server/metrics/metrics_service.ts
index d4696b3aa9aaf..ab58a75d49a98 100644
--- a/src/core/server/metrics/metrics_service.ts
+++ b/src/core/server/metrics/metrics_service.ts
@@ -37,7 +37,7 @@ export class MetricsService
   private readonly logger: Logger;
   private metricsCollector?: OpsMetricsCollector;
   private collectInterval?: NodeJS.Timeout;
-  private metrics$ = new ReplaySubject<OpsMetrics>();
+  private metrics$ = new ReplaySubject<OpsMetrics>(1);
   private service?: InternalMetricsServiceSetup;
 
   constructor(private readonly coreContext: CoreContext) {
diff --git a/src/core/server/mocks.ts b/src/core/server/mocks.ts
index 5d6bf41fec3f3..7e001ffe28100 100644
--- a/src/core/server/mocks.ts
+++ b/src/core/server/mocks.ts
@@ -18,6 +18,7 @@
  */
 import { of } from 'rxjs';
 import { duration } from 'moment';
+import { ByteSizeValue } from '@kbn/config-schema';
 import { PluginInitializerContext, CoreSetup, CoreStart, StartServicesAccessor } from '.';
 import { loggingSystemMock } from './logging/logging_system.mock';
 import { loggingServiceMock } from './logging/logging_service.mock';
@@ -51,6 +52,8 @@ export { typeRegistryMock as savedObjectsTypeRegistryMock } from './saved_object
 export { uiSettingsServiceMock } from './ui_settings/ui_settings_service.mock';
 export { metricsServiceMock } from './metrics/metrics_service.mock';
 export { renderingMock } from './rendering/rendering_service.mock';
+export { statusServiceMock } from './status/status_service.mock';
+export { contextServiceMock } from './context/context_service.mock';
 
 export function pluginInitializerContextConfigMock<T>(config: T) {
   const globalConfig: SharedGlobalConfig = {
@@ -66,6 +69,9 @@ export function pluginInitializerContextConfigMock<T>(config: T) {
       startupTimeout: duration('30s'),
     },
     path: { data: '/tmp' },
+    savedObjects: {
+      maxImportPayloadBytes: new ByteSizeValue(10485760),
+    },
   };
 
   const mock: jest.Mocked<PluginInitializerContext<T>['config']> = {
@@ -133,6 +139,7 @@ function createCoreSetupMock({
     uiSettings: uiSettingsMock,
     auditTrail: auditTrailServiceMock.createSetupContract(),
     logging: loggingServiceMock.createSetupContract(),
+    metrics: metricsServiceMock.createSetupContract(),
     getStartServices: jest
       .fn<Promise<[ReturnType<typeof createCoreStartMock>, object, any]>, []>()
       .mockResolvedValue([createCoreStartMock(), pluginStartDeps, pluginStartContract]),
@@ -169,6 +176,7 @@ function createInternalCoreSetupMock() {
     uiSettings: uiSettingsServiceMock.createSetupContract(),
     auditTrail: auditTrailServiceMock.createSetupContract(),
     logging: loggingServiceMock.createInternalSetupContract(),
+    metrics: metricsServiceMock.createInternalSetupContract(),
   };
   return setupDeps;
 }
@@ -178,7 +186,7 @@ function createInternalCoreStartMock() {
     capabilities: capabilitiesServiceMock.createStartContract(),
     elasticsearch: elasticsearchServiceMock.createInternalStart(),
     http: httpServiceMock.createInternalStartContract(),
-    metrics: metricsServiceMock.createStartContract(),
+    metrics: metricsServiceMock.createInternalStartContract(),
     savedObjects: savedObjectsServiceMock.createInternalStartContract(),
     uiSettings: uiSettingsServiceMock.createStartContract(),
     auditTrail: auditTrailServiceMock.createStartContract(),
diff --git a/src/core/server/plugins/plugin_context.test.ts b/src/core/server/plugins/plugin_context.test.ts
index 5ce91c9a623dc..cb4e8f20be982 100644
--- a/src/core/server/plugins/plugin_context.test.ts
+++ b/src/core/server/plugins/plugin_context.test.ts
@@ -28,6 +28,7 @@ import { rawConfigServiceMock, getEnvOptions } from '../config/mocks';
 import { PluginManifest } from './types';
 import { Server } from '../server';
 import { fromRoot } from '../utils';
+import { ByteSizeValue } from '@kbn/config-schema';
 
 const logger = loggingSystemMock.create();
 
@@ -93,6 +94,7 @@ describe('createPluginInitializerContext', () => {
         startupTimeout: duration(5, 's'),
       },
       path: { data: fromRoot('data') },
+      savedObjects: { maxImportPayloadBytes: new ByteSizeValue(10485760) },
     });
   });
 
diff --git a/src/core/server/plugins/plugin_context.ts b/src/core/server/plugins/plugin_context.ts
index 8d17300965680..ab3f471fd7942 100644
--- a/src/core/server/plugins/plugin_context.ts
+++ b/src/core/server/plugins/plugin_context.ts
@@ -35,6 +35,7 @@ import {
   ElasticsearchConfigType,
   config as elasticsearchConfig,
 } from '../elasticsearch/elasticsearch_config';
+import { SavedObjectsConfigType, savedObjectsConfig } from '../saved_objects/saved_objects_config';
 import { CoreSetup, CoreStart } from '..';
 
 export interface InstanceInfo {
@@ -91,16 +92,18 @@ export function createPluginInitializerContext(
          * Note: naming not final here, it will be renamed in a near future (https://github.com/elastic/kibana/issues/46240)
          * @deprecated
          */
-        globalConfig$: combineLatest(
+        globalConfig$: combineLatest([
           coreContext.configService.atPath<KibanaConfigType>(kibanaConfig.path),
           coreContext.configService.atPath<ElasticsearchConfigType>(elasticsearchConfig.path),
-          coreContext.configService.atPath<PathConfigType>(pathConfig.path)
-        ).pipe(
-          map(([kibana, elasticsearch, path]) =>
+          coreContext.configService.atPath<PathConfigType>(pathConfig.path),
+          coreContext.configService.atPath<SavedObjectsConfigType>(savedObjectsConfig.path),
+        ]).pipe(
+          map(([kibana, elasticsearch, path, savedObjects]) =>
             deepFreeze({
               kibana: pick(kibana, SharedGlobalConfigKeys.kibana),
               elasticsearch: pick(elasticsearch, SharedGlobalConfigKeys.elasticsearch),
               path: pick(path, SharedGlobalConfigKeys.path),
+              savedObjects: pick(savedObjects, SharedGlobalConfigKeys.savedObjects),
             })
           )
         ),
@@ -176,6 +179,10 @@ export function createPluginSetupContext<TPlugin, TPluginDependencies>(
     logging: {
       configure: (config$) => deps.logging.configure(['plugins', plugin.name], config$),
     },
+    metrics: {
+      collectionInterval: deps.metrics.collectionInterval,
+      getOpsMetrics$: deps.metrics.getOpsMetrics$,
+    },
     savedObjects: {
       setClientFactoryProvider: deps.savedObjects.setClientFactoryProvider,
       addClientWrapper: deps.savedObjects.addClientWrapper,
@@ -188,6 +195,7 @@ export function createPluginSetupContext<TPlugin, TPluginDependencies>(
       set: deps.status.plugins.set.bind(null, plugin.name),
       dependencies$: deps.status.plugins.getDependenciesStatus$(plugin.name),
       derivedStatus$: deps.status.plugins.getDerivedStatus$(plugin.name),
+      isStatusPageAnonymous: deps.status.isStatusPageAnonymous,
     },
     uiSettings: {
       register: deps.uiSettings.register,
diff --git a/src/core/server/plugins/types.ts b/src/core/server/plugins/types.ts
index 34d5e044222eb..9de181124a349 100644
--- a/src/core/server/plugins/types.ts
+++ b/src/core/server/plugins/types.ts
@@ -26,6 +26,7 @@ import { ConfigPath, EnvironmentMode, PackageInfo, ConfigDeprecationProvider } f
 import { LoggerFactory } from '../logging';
 import { KibanaConfigType } from '../kibana_config';
 import { ElasticsearchConfigType } from '../elasticsearch/elasticsearch_config';
+import { SavedObjectsConfigType } from '../saved_objects/saved_objects_config';
 import { CoreSetup, CoreStart } from '..';
 
 /**
@@ -263,6 +264,7 @@ export const SharedGlobalConfigKeys = {
   kibana: ['index', 'autocompleteTerminateAfter', 'autocompleteTimeout'] as const,
   elasticsearch: ['shardTimeout', 'requestTimeout', 'pingTimeout', 'startupTimeout'] as const,
   path: ['data'] as const,
+  savedObjects: ['maxImportPayloadBytes'] as const,
 };
 
 /**
@@ -272,6 +274,7 @@ export type SharedGlobalConfig = RecursiveReadonly<{
   kibana: Pick<KibanaConfigType, typeof SharedGlobalConfigKeys.kibana[number]>;
   elasticsearch: Pick<ElasticsearchConfigType, typeof SharedGlobalConfigKeys.elasticsearch[number]>;
   path: Pick<PathConfigType, typeof SharedGlobalConfigKeys.path[number]>;
+  savedObjects: Pick<SavedObjectsConfigType, typeof SharedGlobalConfigKeys.savedObjects[number]>;
 }>;
 
 /**
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index ab26f29dce3af..1dcf8a22e9cfd 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -416,6 +416,8 @@ export interface CoreSetup<TPluginsStart extends object = object, TStart = unkno
     // (undocumented)
     logging: LoggingServiceSetup;
     // (undocumented)
+    metrics: MetricsServiceSetup;
+    // (undocumented)
     savedObjects: SavedObjectsServiceSetup;
     // (undocumented)
     status: StatusServiceSetup;
@@ -433,9 +435,6 @@ export interface CoreStart {
     elasticsearch: ElasticsearchServiceStart;
     // (undocumented)
     http: HttpServiceStart;
-    // Warning: (ae-forgotten-export) The symbol "MetricsServiceStart" needs to be exported by the entry point index.d.ts
-    // Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "MetricsServiceStart"
-    //
     // (undocumented)
     metrics: MetricsServiceStart;
     // (undocumented)
@@ -1431,6 +1430,9 @@ export interface MetricsServiceSetup {
     getOpsMetrics$: () => Observable<OpsMetrics>;
 }
 
+// @public
+export type MetricsServiceStart = MetricsServiceSetup;
+
 // @public @deprecated (undocumented)
 export type MIGRATION_ASSISTANCE_INDEX_ACTION = 'upgrade' | 'reindex';
 
@@ -2589,18 +2591,22 @@ export const ServiceStatusLevels: Readonly<{
     available: Readonly<{
         toString: () => "available";
         valueOf: () => 0;
+        toJSON: () => "available";
     }>;
     degraded: Readonly<{
         toString: () => "degraded";
         valueOf: () => 1;
+        toJSON: () => "degraded";
     }>;
     unavailable: Readonly<{
         toString: () => "unavailable";
         valueOf: () => 2;
+        toJSON: () => "unavailable";
     }>;
     critical: Readonly<{
         toString: () => "critical";
         valueOf: () => 3;
+        toJSON: () => "critical";
     }>;
 }>;
 
@@ -2661,6 +2667,7 @@ export type SharedGlobalConfig = RecursiveReadonly<{
     kibana: Pick<KibanaConfigType_2, typeof SharedGlobalConfigKeys.kibana[number]>;
     elasticsearch: Pick<ElasticsearchConfigType, typeof SharedGlobalConfigKeys.elasticsearch[number]>;
     path: Pick<PathConfigType, typeof SharedGlobalConfigKeys.path[number]>;
+    savedObjects: Pick<SavedObjectsConfigType, typeof SharedGlobalConfigKeys.savedObjects[number]>;
 }>;
 
 // @public
@@ -2675,6 +2682,7 @@ export interface StatusServiceSetup {
     dependencies$: Observable<Record<string, ServiceStatus>>;
     // Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "StatusSetup"
     derivedStatus$: Observable<ServiceStatus>;
+    isStatusPageAnonymous: () => boolean;
     overall$: Observable<ServiceStatus>;
     set(status$: Observable<ServiceStatus>): void;
 }
@@ -2745,7 +2753,8 @@ export const validBodyOutput: readonly ["data", "stream"];
 //
 // src/core/server/http/router/response.ts:316:3 - (ae-forgotten-export) The symbol "KibanaResponse" needs to be exported by the entry point index.d.ts
 // src/core/server/legacy/types.ts:135:16 - (ae-forgotten-export) The symbol "LegacyPluginSpec" needs to be exported by the entry point index.d.ts
-// src/core/server/plugins/types.ts:272:3 - (ae-forgotten-export) The symbol "KibanaConfigType" needs to be exported by the entry point index.d.ts
-// src/core/server/plugins/types.ts:272:3 - (ae-forgotten-export) The symbol "SharedGlobalConfigKeys" needs to be exported by the entry point index.d.ts
+// src/core/server/plugins/types.ts:274:3 - (ae-forgotten-export) The symbol "KibanaConfigType" needs to be exported by the entry point index.d.ts
+// src/core/server/plugins/types.ts:274:3 - (ae-forgotten-export) The symbol "SharedGlobalConfigKeys" needs to be exported by the entry point index.d.ts
+// src/core/server/plugins/types.ts:277:3 - (ae-forgotten-export) The symbol "SavedObjectsConfigType" needs to be exported by the entry point index.d.ts
 
 ```
diff --git a/src/core/server/server.ts b/src/core/server/server.ts
index c689e2cb70cc9..8502f563cb0c2 100644
--- a/src/core/server/server.ts
+++ b/src/core/server/server.ts
@@ -152,12 +152,15 @@ export class Server {
       savedObjects: savedObjectsSetup,
     });
 
-    await this.metrics.setup({ http: httpSetup });
+    const metricsSetup = await this.metrics.setup({ http: httpSetup });
 
     const statusSetup = await this.status.setup({
       elasticsearch: elasticsearchServiceSetup,
       pluginDependencies: pluginTree.asNames,
       savedObjects: savedObjectsSetup,
+      environment: environmentSetup,
+      http: httpSetup,
+      metrics: metricsSetup,
     });
 
     const renderingSetup = await this.rendering.setup({
@@ -189,6 +192,7 @@ export class Server {
       httpResources: httpResourcesSetup,
       auditTrail: auditTrailSetup,
       logging: loggingSetup,
+      metrics: metricsSetup,
     };
 
     const pluginsSetup = await this.plugins.setup(coreSetup);
diff --git a/src/core/server/status/legacy_status.test.ts b/src/core/server/status/legacy_status.test.ts
new file mode 100644
index 0000000000000..e3e55442cabd2
--- /dev/null
+++ b/src/core/server/status/legacy_status.test.ts
@@ -0,0 +1,114 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ServiceStatus, ServiceStatusLevels } from './types';
+import { calculateLegacyStatus } from './legacy_status';
+
+const available: ServiceStatus = { level: ServiceStatusLevels.available, summary: 'Available' };
+const degraded: ServiceStatus = {
+  level: ServiceStatusLevels.degraded,
+  summary: 'This is degraded!',
+};
+const unavailable: ServiceStatus = {
+  level: ServiceStatusLevels.unavailable,
+  summary: 'This is unavailable!',
+};
+const critical: ServiceStatus = {
+  level: ServiceStatusLevels.critical,
+  summary: 'This is critical!',
+};
+
+describe('calculateLegacyStatus', () => {
+  it('translates the overall status to the legacy format', () => {
+    const legacyStatus = calculateLegacyStatus({
+      overall: available,
+      core: {} as any,
+      plugins: {},
+      versionWithoutSnapshot: '1.1.1',
+    });
+
+    expect(legacyStatus.overall).toEqual({
+      state: 'green',
+      title: 'Green',
+      nickname: 'Looking good',
+      icon: 'success',
+      uiColor: 'secondary',
+      since: expect.any(String),
+    });
+  });
+
+  it('combines core and plugins statuses into statuses array in legacy format', () => {
+    const legacyStatus = calculateLegacyStatus({
+      overall: available,
+      core: {
+        elasticsearch: degraded,
+        savedObjects: critical,
+      },
+      plugins: {
+        a: available,
+        b: unavailable,
+        c: degraded,
+      },
+      versionWithoutSnapshot: '1.1.1',
+    });
+
+    expect(legacyStatus.statuses).toEqual([
+      {
+        icon: 'warning',
+        id: 'core:elasticsearch@1.1.1',
+        message: 'This is degraded!',
+        since: expect.any(String),
+        state: 'yellow',
+        uiColor: 'warning',
+      },
+      {
+        icon: 'danger',
+        id: 'core:savedObjects@1.1.1',
+        message: 'This is critical!',
+        since: expect.any(String),
+        state: 'red',
+        uiColor: 'danger',
+      },
+      {
+        icon: 'success',
+        id: 'plugin:a@1.1.1',
+        message: 'Available',
+        since: expect.any(String),
+        state: 'green',
+        uiColor: 'secondary',
+      },
+      {
+        icon: 'danger',
+        id: 'plugin:b@1.1.1',
+        message: 'This is unavailable!',
+        since: expect.any(String),
+        state: 'red',
+        uiColor: 'danger',
+      },
+      {
+        icon: 'warning',
+        id: 'plugin:c@1.1.1',
+        message: 'This is degraded!',
+        since: expect.any(String),
+        state: 'yellow',
+        uiColor: 'warning',
+      },
+    ]);
+  });
+});
diff --git a/src/core/server/status/legacy_status.ts b/src/core/server/status/legacy_status.ts
new file mode 100644
index 0000000000000..41777ae97c3da
--- /dev/null
+++ b/src/core/server/status/legacy_status.ts
@@ -0,0 +1,158 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { pick } from 'lodash';
+import { i18n } from '@kbn/i18n';
+import { deepFreeze } from '@kbn/std';
+
+import { ServiceStatusLevels, ServiceStatus, CoreStatus } from './types';
+import { PluginName } from '../plugins';
+
+interface Deps {
+  overall: ServiceStatus;
+  core: CoreStatus;
+  plugins: Record<PluginName, ServiceStatus>;
+  versionWithoutSnapshot: string;
+}
+
+export interface LegacyStatusInfo {
+  overall: LegacyStatusOverall;
+  statuses: StatusComponentHttp[];
+}
+
+interface LegacyStatusOverall {
+  state: LegacyStatusState;
+  title: string;
+  nickname: string;
+  uiColor: LegacyStatusUiColor;
+  /** ISO-8601 date string w/o timezone */
+  since: string;
+  icon?: string;
+}
+
+type LegacyStatusState = 'green' | 'yellow' | 'red';
+type LegacyStatusIcon = 'danger' | 'warning' | 'success';
+type LegacyStatusUiColor = 'secondary' | 'warning' | 'danger';
+
+interface LegacyStateAttr {
+  id: LegacyStatusState;
+  state: LegacyStatusState;
+  title: string;
+  icon: LegacyStatusIcon;
+  uiColor: LegacyStatusUiColor;
+  nickname: string;
+}
+
+export const calculateLegacyStatus = ({
+  core,
+  overall,
+  plugins,
+  versionWithoutSnapshot,
+}: Deps): LegacyStatusInfo => {
+  const since = new Date().toISOString();
+  const overallLegacy: LegacyStatusOverall = {
+    since,
+    ...pick(STATUS_LEVEL_LEGACY_ATTRS[overall.level.toString()], [
+      'state',
+      'title',
+      'nickname',
+      'icon',
+      'uiColor',
+    ]),
+  };
+  const coreStatuses = Object.entries(core).map(([serviceName, s]) =>
+    serviceStatusToHttpComponent(`core:${serviceName}@${versionWithoutSnapshot}`, s, since)
+  );
+  const pluginStatuses = Object.entries(plugins).map(([pluginName, s]) =>
+    serviceStatusToHttpComponent(`plugin:${pluginName}@${versionWithoutSnapshot}`, s, since)
+  );
+
+  const componentStatuses: StatusComponentHttp[] = [...coreStatuses, ...pluginStatuses];
+
+  return {
+    overall: overallLegacy,
+    statuses: componentStatuses,
+  };
+};
+
+interface StatusComponentHttp {
+  id: string;
+  state: LegacyStatusState;
+  message: string;
+  uiColor: LegacyStatusUiColor;
+  icon: string;
+  since: string;
+}
+
+const serviceStatusToHttpComponent = (
+  serviceName: string,
+  status: ServiceStatus,
+  since: string
+): StatusComponentHttp => ({
+  id: serviceName,
+  message: status.summary,
+  since,
+  ...serviceStatusAttrs(status),
+});
+
+const serviceStatusAttrs = (status: ServiceStatus) =>
+  pick(STATUS_LEVEL_LEGACY_ATTRS[status.level.toString()], ['state', 'icon', 'uiColor']);
+
+const STATUS_LEVEL_LEGACY_ATTRS = deepFreeze<Record<string, LegacyStateAttr>>({
+  [ServiceStatusLevels.critical.toString()]: {
+    id: 'red',
+    state: 'red',
+    title: i18n.translate('core.status.redTitle', {
+      defaultMessage: 'Red',
+    }),
+    icon: 'danger',
+    uiColor: 'danger',
+    nickname: 'Danger Will Robinson! Danger!',
+  },
+  [ServiceStatusLevels.unavailable.toString()]: {
+    id: 'red',
+    state: 'red',
+    title: i18n.translate('core.status.redTitle', {
+      defaultMessage: 'Red',
+    }),
+    icon: 'danger',
+    uiColor: 'danger',
+    nickname: 'Danger Will Robinson! Danger!',
+  },
+  [ServiceStatusLevels.degraded.toString()]: {
+    id: 'yellow',
+    state: 'yellow',
+    title: i18n.translate('core.status.yellowTitle', {
+      defaultMessage: 'Yellow',
+    }),
+    icon: 'warning',
+    uiColor: 'warning',
+    nickname: "I'll be back",
+  },
+  [ServiceStatusLevels.available.toString()]: {
+    id: 'green',
+    state: 'green',
+    title: i18n.translate('core.status.greenTitle', {
+      defaultMessage: 'Green',
+    }),
+    icon: 'success',
+    uiColor: 'secondary',
+    nickname: 'Looking good',
+  },
+});
diff --git a/src/legacy/server/status/lib/index.js b/src/core/server/status/routes/index.ts
similarity index 92%
rename from src/legacy/server/status/lib/index.js
rename to src/core/server/status/routes/index.ts
index 93db8b2d22561..db2e8daf0b9ac 100644
--- a/src/legacy/server/status/lib/index.js
+++ b/src/core/server/status/routes/index.ts
@@ -17,4 +17,4 @@
  * under the License.
  */
 
-export { getKibanaInfoForStats } from './get_kibana_info_for_stats';
+export { registerStatusRoute } from './status';
diff --git a/src/core/server/status/routes/integration_tests/status.test.ts b/src/core/server/status/routes/integration_tests/status.test.ts
new file mode 100644
index 0000000000000..e0f86342e3a8a
--- /dev/null
+++ b/src/core/server/status/routes/integration_tests/status.test.ts
@@ -0,0 +1,322 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { BehaviorSubject } from 'rxjs';
+import { first } from 'rxjs/operators';
+import supertest from 'supertest';
+import { omit } from 'lodash';
+
+import { createCoreContext, createHttpServer } from '../../../http/test_utils';
+import { ContextService } from '../../../context';
+import { metricsServiceMock } from '../../../metrics/metrics_service.mock';
+import { MetricsServiceSetup } from '../../../metrics';
+import { HttpService, InternalHttpServiceSetup } from '../../../http';
+
+import { registerStatusRoute } from '../status';
+import { ServiceStatus, ServiceStatusLevels } from '../../types';
+import { statusServiceMock } from '../../status_service.mock';
+
+const coreId = Symbol('core');
+
+describe('GET /api/status', () => {
+  let server: HttpService;
+  let httpSetup: InternalHttpServiceSetup;
+  let metrics: jest.Mocked<MetricsServiceSetup>;
+
+  const setupServer = async ({ allowAnonymous = true }: { allowAnonymous?: boolean } = {}) => {
+    const coreContext = createCoreContext({ coreId });
+    const contextService = new ContextService(coreContext);
+
+    server = createHttpServer(coreContext);
+    httpSetup = await server.setup({
+      context: contextService.setup({ pluginDependencies: new Map() }),
+    });
+
+    metrics = metricsServiceMock.createSetupContract();
+    const status = statusServiceMock.createSetupContract();
+    const pluginsStatus$ = new BehaviorSubject<Record<string, ServiceStatus>>({
+      a: { level: ServiceStatusLevels.available, summary: 'a is available' },
+      b: { level: ServiceStatusLevels.degraded, summary: 'b is degraded' },
+      c: { level: ServiceStatusLevels.unavailable, summary: 'c is unavailable' },
+      d: { level: ServiceStatusLevels.critical, summary: 'd is critical' },
+    });
+
+    const router = httpSetup.createRouter('');
+    registerStatusRoute({
+      router,
+      config: {
+        allowAnonymous,
+        packageInfo: {
+          branch: 'xbranch',
+          buildNum: 1234,
+          buildSha: 'xsha',
+          dist: true,
+          version: '9.9.9-SNAPSHOT',
+        },
+        serverName: 'xkibana',
+        uuid: 'xxxx-xxxxx',
+      },
+      metrics,
+      status: {
+        overall$: status.overall$,
+        core$: status.core$,
+        plugins$: pluginsStatus$,
+      },
+    });
+
+    // Register dummy auth provider for testing auth
+    httpSetup.registerAuth((req, res, auth) => {
+      if (req.headers.authorization === 'let me in') {
+        return auth.authenticated();
+      } else {
+        return auth.notHandled();
+      }
+    });
+
+    await server.start();
+  };
+
+  afterEach(async () => {
+    await server.stop();
+  });
+
+  describe('allowAnonymous: false', () => {
+    it('rejects requests with no credentials', async () => {
+      await setupServer({ allowAnonymous: false });
+      await supertest(httpSetup.server.listener).get('/api/status').expect(401);
+    });
+
+    it('rejects requests with bad credentials', async () => {
+      await setupServer({ allowAnonymous: false });
+      await supertest(httpSetup.server.listener)
+        .get('/api/status')
+        .set('Authorization', 'fake creds')
+        .expect(401);
+    });
+
+    it('accepts authenticated requests', async () => {
+      await setupServer({ allowAnonymous: false });
+      await supertest(httpSetup.server.listener)
+        .get('/api/status')
+        .set('Authorization', 'let me in')
+        .expect(200);
+    });
+  });
+
+  it('returns basic server info & metrics', async () => {
+    await setupServer();
+    const result = await supertest(httpSetup.server.listener).get('/api/status').expect(200);
+
+    expect(result.body.name).toEqual('xkibana');
+    expect(result.body.uuid).toEqual('xxxx-xxxxx');
+    expect(result.body.version).toEqual({
+      number: '9.9.9',
+      build_hash: 'xsha',
+      build_number: 1234,
+      build_snapshot: true,
+    });
+    const metricsMockValue = await metrics.getOpsMetrics$().pipe(first()).toPromise();
+    expect(result.body.metrics).toEqual({
+      last_updated: expect.any(String),
+      collection_interval_in_millis: metrics.collectionInterval,
+      ...omit(metricsMockValue, ['collected_at']),
+      requests: {
+        ...metricsMockValue.requests,
+        status_codes: metricsMockValue.requests.statusCodes,
+      },
+    });
+  });
+
+  describe('legacy status format', () => {
+    it('returns legacy status format when no query params provided', async () => {
+      await setupServer();
+      const result = await supertest(httpSetup.server.listener).get('/api/status').expect(200);
+      expect(result.body.status).toEqual({
+        overall: {
+          icon: 'success',
+          nickname: 'Looking good',
+          since: expect.any(String),
+          state: 'green',
+          title: 'Green',
+          uiColor: 'secondary',
+        },
+        statuses: [
+          {
+            icon: 'success',
+            id: 'core:elasticsearch@9.9.9',
+            message: 'Service is working',
+            since: expect.any(String),
+            state: 'green',
+            uiColor: 'secondary',
+          },
+          {
+            icon: 'success',
+            id: 'core:savedObjects@9.9.9',
+            message: 'Service is working',
+            since: expect.any(String),
+            state: 'green',
+            uiColor: 'secondary',
+          },
+          {
+            icon: 'success',
+            id: 'plugin:a@9.9.9',
+            message: 'a is available',
+            since: expect.any(String),
+            state: 'green',
+            uiColor: 'secondary',
+          },
+          {
+            icon: 'warning',
+            id: 'plugin:b@9.9.9',
+            message: 'b is degraded',
+            since: expect.any(String),
+            state: 'yellow',
+            uiColor: 'warning',
+          },
+          {
+            icon: 'danger',
+            id: 'plugin:c@9.9.9',
+            message: 'c is unavailable',
+            since: expect.any(String),
+            state: 'red',
+            uiColor: 'danger',
+          },
+          {
+            icon: 'danger',
+            id: 'plugin:d@9.9.9',
+            message: 'd is critical',
+            since: expect.any(String),
+            state: 'red',
+            uiColor: 'danger',
+          },
+        ],
+      });
+    });
+
+    it('returns legacy status format when v8format=false is provided', async () => {
+      await setupServer();
+      const result = await supertest(httpSetup.server.listener)
+        .get('/api/status?v8format=false')
+        .expect(200);
+      expect(result.body.status).toEqual({
+        overall: {
+          icon: 'success',
+          nickname: 'Looking good',
+          since: expect.any(String),
+          state: 'green',
+          title: 'Green',
+          uiColor: 'secondary',
+        },
+        statuses: [
+          {
+            icon: 'success',
+            id: 'core:elasticsearch@9.9.9',
+            message: 'Service is working',
+            since: expect.any(String),
+            state: 'green',
+            uiColor: 'secondary',
+          },
+          {
+            icon: 'success',
+            id: 'core:savedObjects@9.9.9',
+            message: 'Service is working',
+            since: expect.any(String),
+            state: 'green',
+            uiColor: 'secondary',
+          },
+          {
+            icon: 'success',
+            id: 'plugin:a@9.9.9',
+            message: 'a is available',
+            since: expect.any(String),
+            state: 'green',
+            uiColor: 'secondary',
+          },
+          {
+            icon: 'warning',
+            id: 'plugin:b@9.9.9',
+            message: 'b is degraded',
+            since: expect.any(String),
+            state: 'yellow',
+            uiColor: 'warning',
+          },
+          {
+            icon: 'danger',
+            id: 'plugin:c@9.9.9',
+            message: 'c is unavailable',
+            since: expect.any(String),
+            state: 'red',
+            uiColor: 'danger',
+          },
+          {
+            icon: 'danger',
+            id: 'plugin:d@9.9.9',
+            message: 'd is critical',
+            since: expect.any(String),
+            state: 'red',
+            uiColor: 'danger',
+          },
+        ],
+      });
+    });
+  });
+
+  describe('v8format', () => {
+    it('returns new status format when v8format=true is provided', async () => {
+      await setupServer();
+      const result = await supertest(httpSetup.server.listener)
+        .get('/api/status?v8format=true')
+        .expect(200);
+      expect(result.body.status).toEqual({
+        core: {
+          elasticsearch: {
+            level: 'available',
+            summary: 'Service is working',
+          },
+          savedObjects: {
+            level: 'available',
+            summary: 'Service is working',
+          },
+        },
+        overall: {
+          level: 'available',
+          summary: 'Service is working',
+        },
+        plugins: {
+          a: {
+            level: 'available',
+            summary: 'a is available',
+          },
+          b: {
+            level: 'degraded',
+            summary: 'b is degraded',
+          },
+          c: {
+            level: 'unavailable',
+            summary: 'c is unavailable',
+          },
+          d: {
+            level: 'critical',
+            summary: 'd is critical',
+          },
+        },
+      });
+    });
+  });
+});
diff --git a/src/core/server/status/routes/status.ts b/src/core/server/status/routes/status.ts
new file mode 100644
index 0000000000000..da01a44095529
--- /dev/null
+++ b/src/core/server/status/routes/status.ts
@@ -0,0 +1,177 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Observable, combineLatest, ReplaySubject } from 'rxjs';
+import { first } from 'rxjs/operators';
+import { schema } from '@kbn/config-schema';
+
+import { IRouter } from '../../http';
+import { MetricsServiceSetup } from '../../metrics';
+import { ServiceStatus, CoreStatus } from '../types';
+import { PluginName } from '../../plugins';
+import { calculateLegacyStatus, LegacyStatusInfo } from '../legacy_status';
+import { PackageInfo } from '../../config';
+
+const SNAPSHOT_POSTFIX = /-SNAPSHOT$/;
+
+interface Deps {
+  router: IRouter;
+  config: {
+    allowAnonymous: boolean;
+    packageInfo: PackageInfo;
+    serverName: string;
+    uuid: string;
+  };
+  metrics: MetricsServiceSetup;
+  status: {
+    overall$: Observable<ServiceStatus>;
+    core$: Observable<CoreStatus>;
+    plugins$: Observable<Record<PluginName, ServiceStatus>>;
+  };
+}
+
+interface StatusInfo {
+  overall: ServiceStatus;
+  core: CoreStatus;
+  plugins: Record<string, ServiceStatus>;
+}
+
+interface StatusHttpBody {
+  name: string;
+  uuid: string;
+  version: {
+    number: string;
+    build_hash: string;
+    build_number: number;
+    build_snapshot: boolean;
+  };
+  status: StatusInfo | LegacyStatusInfo;
+  metrics: {
+    /** ISO-8601 date string w/o timezone */
+    last_updated: string;
+    collection_interval_in_millis: number;
+    process: {
+      memory: {
+        heap: {
+          total_in_bytes: number;
+          used_in_bytes: number;
+          size_limit: number;
+        };
+        resident_set_size_in_bytes: number;
+      };
+      event_loop_delay: number;
+      pid: number;
+      uptime_in_millis: number;
+    };
+    os: {
+      load: Record<string, number>;
+      memory: {
+        total_in_bytes: number;
+        used_in_bytes: number;
+        free_in_bytes: number;
+      };
+      uptime_in_millis: number;
+      platform: string;
+      platformRelease: string;
+    };
+    response_times: {
+      max_in_millis: number;
+    };
+    requests: {
+      total: number;
+      disconnects: number;
+      statusCodes: Record<number, number>;
+      status_codes: Record<number, number>;
+    };
+    concurrent_connections: number;
+  };
+}
+
+export const registerStatusRoute = ({ router, config, metrics, status }: Deps) => {
+  // Since the status.plugins$ observable is not subscribed to elsewhere, we need to subscribe it here to eagerly load
+  // the plugins status when Kibana starts up so this endpoint responds quickly on first boot.
+  const combinedStatus$ = new ReplaySubject<
+    [ServiceStatus<unknown>, CoreStatus, Record<string, ServiceStatus<unknown>>]
+  >(1);
+  combineLatest([status.overall$, status.core$, status.plugins$]).subscribe(combinedStatus$);
+
+  router.get(
+    {
+      path: '/api/status',
+      options: {
+        authRequired: !config.allowAnonymous,
+        tags: ['api'], // ensures that unauthenticated calls receive a 401 rather than a 302 redirect to login page
+      },
+      validate: {
+        query: schema.object({
+          v8format: schema.boolean({ defaultValue: false }),
+        }),
+      },
+    },
+    async (context, req, res) => {
+      const { version, buildSha, buildNum } = config.packageInfo;
+      const versionWithoutSnapshot = version.replace(SNAPSHOT_POSTFIX, '');
+      const [overall, core, plugins] = await combinedStatus$.pipe(first()).toPromise();
+
+      let statusInfo: StatusInfo | LegacyStatusInfo;
+      if (req.query?.v8format) {
+        statusInfo = {
+          overall,
+          core,
+          plugins,
+        };
+      } else {
+        statusInfo = calculateLegacyStatus({
+          overall,
+          core,
+          plugins,
+          versionWithoutSnapshot,
+        });
+      }
+
+      const lastMetrics = await metrics.getOpsMetrics$().pipe(first()).toPromise();
+
+      const body: StatusHttpBody = {
+        name: config.serverName,
+        uuid: config.uuid,
+        version: {
+          number: versionWithoutSnapshot,
+          build_hash: buildSha,
+          build_number: buildNum,
+          build_snapshot: SNAPSHOT_POSTFIX.test(version),
+        },
+        status: statusInfo,
+        metrics: {
+          last_updated: lastMetrics.collected_at.toISOString(),
+          collection_interval_in_millis: metrics.collectionInterval,
+          os: lastMetrics.os,
+          process: lastMetrics.process,
+          response_times: lastMetrics.response_times,
+          concurrent_connections: lastMetrics.concurrent_connections,
+          requests: {
+            ...lastMetrics.requests,
+            status_codes: lastMetrics.requests.statusCodes,
+          },
+        },
+      };
+
+      return res.ok({ body });
+    }
+  );
+};
diff --git a/src/core/server/status/status_service.mock.ts b/src/core/server/status/status_service.mock.ts
index 930ee2970cf55..0ee2d03229a78 100644
--- a/src/core/server/status/status_service.mock.ts
+++ b/src/core/server/status/status_service.mock.ts
@@ -43,6 +43,7 @@ const createSetupContractMock = () => {
     set: jest.fn(),
     dependencies$: new BehaviorSubject({}),
     derivedStatus$: new BehaviorSubject(available),
+    isStatusPageAnonymous: jest.fn().mockReturnValue(false),
   };
 
   return setupContract;
diff --git a/src/core/server/status/status_service.test.ts b/src/core/server/status/status_service.test.ts
index dcb1e0a559f5d..afacaff044b6f 100644
--- a/src/core/server/status/status_service.test.ts
+++ b/src/core/server/status/status_service.test.ts
@@ -24,6 +24,9 @@ import { StatusService } from './status_service';
 import { first } from 'rxjs/operators';
 import { mockCoreContext } from '../core_context.mock';
 import { ServiceStatusLevelSnapshotSerializer } from './test_utils';
+import { environmentServiceMock } from '../environment/environment_service.mock';
+import { httpServiceMock } from '../http/http_service.mock';
+import { metricsServiceMock } from '../metrics/metrics_service.mock';
 
 expect.addSnapshotSerializer(ServiceStatusLevelSnapshotSerializer);
 
@@ -44,18 +47,36 @@ describe('StatusService', () => {
     summary: 'This is degraded!',
   };
 
+  type SetupDeps = Parameters<StatusService['setup']>[0];
+  const setupDeps = (overrides: Partial<SetupDeps>): SetupDeps => {
+    return {
+      elasticsearch: {
+        status$: of(available),
+      },
+      savedObjects: {
+        status$: of(available),
+      },
+      pluginDependencies: new Map(),
+      environment: environmentServiceMock.createSetupContract(),
+      http: httpServiceMock.createInternalSetupContract(),
+      metrics: metricsServiceMock.createInternalSetupContract(),
+      ...overrides,
+    };
+  };
+
   describe('setup', () => {
     describe('core$', () => {
       it('rolls up core status observables into single observable', async () => {
-        const setup = await service.setup({
-          elasticsearch: {
-            status$: of(available),
-          },
-          savedObjects: {
-            status$: of(degraded),
-          },
-          pluginDependencies: new Map(),
-        });
+        const setup = await service.setup(
+          setupDeps({
+            elasticsearch: {
+              status$: of(available),
+            },
+            savedObjects: {
+              status$: of(degraded),
+            },
+          })
+        );
         expect(await setup.core$.pipe(first()).toPromise()).toEqual({
           elasticsearch: available,
           savedObjects: degraded,
@@ -63,15 +84,16 @@ describe('StatusService', () => {
       });
 
       it('replays last event', async () => {
-        const setup = await service.setup({
-          elasticsearch: {
-            status$: of(available),
-          },
-          savedObjects: {
-            status$: of(degraded),
-          },
-          pluginDependencies: new Map(),
-        });
+        const setup = await service.setup(
+          setupDeps({
+            elasticsearch: {
+              status$: of(available),
+            },
+            savedObjects: {
+              status$: of(degraded),
+            },
+          })
+        );
         const subResult1 = await setup.core$.pipe(first()).toPromise();
         const subResult2 = await setup.core$.pipe(first()).toPromise();
         const subResult3 = await setup.core$.pipe(first()).toPromise();
@@ -92,15 +114,16 @@ describe('StatusService', () => {
       it('does not emit duplicate events', async () => {
         const elasticsearch$ = new BehaviorSubject(available);
         const savedObjects$ = new BehaviorSubject(degraded);
-        const setup = await service.setup({
-          elasticsearch: {
-            status$: elasticsearch$,
-          },
-          savedObjects: {
-            status$: savedObjects$,
-          },
-          pluginDependencies: new Map(),
-        });
+        const setup = await service.setup(
+          setupDeps({
+            elasticsearch: {
+              status$: elasticsearch$,
+            },
+            savedObjects: {
+              status$: savedObjects$,
+            },
+          })
+        );
 
         const statusUpdates: CoreStatus[] = [];
         const subscription = setup.core$.subscribe((status) => statusUpdates.push(status));
@@ -155,15 +178,16 @@ describe('StatusService', () => {
 
     describe('overall$', () => {
       it('exposes an overall summary', async () => {
-        const setup = await service.setup({
-          elasticsearch: {
-            status$: of(degraded),
-          },
-          savedObjects: {
-            status$: of(degraded),
-          },
-          pluginDependencies: new Map(),
-        });
+        const setup = await service.setup(
+          setupDeps({
+            elasticsearch: {
+              status$: of(degraded),
+            },
+            savedObjects: {
+              status$: of(degraded),
+            },
+          })
+        );
         expect(await setup.overall$.pipe(first()).toPromise()).toMatchObject({
           level: ServiceStatusLevels.degraded,
           summary: '[2] services are degraded',
@@ -171,15 +195,16 @@ describe('StatusService', () => {
       });
 
       it('replays last event', async () => {
-        const setup = await service.setup({
-          elasticsearch: {
-            status$: of(degraded),
-          },
-          savedObjects: {
-            status$: of(degraded),
-          },
-          pluginDependencies: new Map(),
-        });
+        const setup = await service.setup(
+          setupDeps({
+            elasticsearch: {
+              status$: of(degraded),
+            },
+            savedObjects: {
+              status$: of(degraded),
+            },
+          })
+        );
         const subResult1 = await setup.overall$.pipe(first()).toPromise();
         const subResult2 = await setup.overall$.pipe(first()).toPromise();
         const subResult3 = await setup.overall$.pipe(first()).toPromise();
@@ -200,15 +225,16 @@ describe('StatusService', () => {
       it('does not emit duplicate events', async () => {
         const elasticsearch$ = new BehaviorSubject(available);
         const savedObjects$ = new BehaviorSubject(degraded);
-        const setup = await service.setup({
-          elasticsearch: {
-            status$: elasticsearch$,
-          },
-          savedObjects: {
-            status$: savedObjects$,
-          },
-          pluginDependencies: new Map(),
-        });
+        const setup = await service.setup(
+          setupDeps({
+            elasticsearch: {
+              status$: elasticsearch$,
+            },
+            savedObjects: {
+              status$: savedObjects$,
+            },
+          })
+        );
 
         const statusUpdates: ServiceStatus[] = [];
         const subscription = setup.overall$.subscribe((status) => statusUpdates.push(status));
@@ -256,15 +282,16 @@ describe('StatusService', () => {
 
       it('debounces events in quick succession', async () => {
         const savedObjects$ = new BehaviorSubject(available);
-        const setup = await service.setup({
-          elasticsearch: {
-            status$: new BehaviorSubject(available),
-          },
-          savedObjects: {
-            status$: savedObjects$,
-          },
-          pluginDependencies: new Map(),
-        });
+        const setup = await service.setup(
+          setupDeps({
+            elasticsearch: {
+              status$: new BehaviorSubject(available),
+            },
+            savedObjects: {
+              status$: savedObjects$,
+            },
+          })
+        );
 
         const statusUpdates: ServiceStatus[] = [];
         const subscription = setup.overall$.subscribe((status) => statusUpdates.push(status));
diff --git a/src/core/server/status/status_service.ts b/src/core/server/status/status_service.ts
index 8fe65eddb61d3..9acf93f2f8197 100644
--- a/src/core/server/status/status_service.ts
+++ b/src/core/server/status/status_service.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { Observable, combineLatest } from 'rxjs';
+import { Observable, combineLatest, Subscription } from 'rxjs';
 import { map, distinctUntilChanged, shareReplay, take, debounceTime } from 'rxjs/operators';
 import { isDeepStrictEqual } from 'util';
 
@@ -25,8 +25,12 @@ import { CoreService } from '../../types';
 import { CoreContext } from '../core_context';
 import { Logger } from '../logging';
 import { InternalElasticsearchServiceSetup } from '../elasticsearch';
+import { InternalHttpServiceSetup } from '../http';
 import { InternalSavedObjectsServiceSetup } from '../saved_objects';
 import { PluginName } from '../plugins';
+import { InternalMetricsServiceSetup } from '../metrics';
+import { registerStatusRoute } from './routes';
+import { InternalEnvironmentServiceSetup } from '../environment';
 
 import { config, StatusConfigType } from './status_config';
 import { ServiceStatus, CoreStatus, InternalStatusServiceSetup } from './types';
@@ -35,7 +39,10 @@ import { PluginsStatusService } from './plugins_status';
 
 interface SetupDeps {
   elasticsearch: Pick<InternalElasticsearchServiceSetup, 'status$'>;
+  environment: InternalEnvironmentServiceSetup;
   pluginDependencies: ReadonlyMap<PluginName, PluginName[]>;
+  http: InternalHttpServiceSetup;
+  metrics: InternalMetricsServiceSetup;
   savedObjects: Pick<InternalSavedObjectsServiceSetup, 'status$'>;
 }
 
@@ -44,13 +51,21 @@ export class StatusService implements CoreService<InternalStatusServiceSetup> {
   private readonly config$: Observable<StatusConfigType>;
 
   private pluginsStatus?: PluginsStatusService;
+  private overallSubscription?: Subscription;
 
-  constructor(coreContext: CoreContext) {
+  constructor(private readonly coreContext: CoreContext) {
     this.logger = coreContext.logger.get('status');
     this.config$ = coreContext.configService.atPath<StatusConfigType>(config.path);
   }
 
-  public async setup({ elasticsearch, pluginDependencies, savedObjects }: SetupDeps) {
+  public async setup({
+    elasticsearch,
+    pluginDependencies,
+    http,
+    metrics,
+    savedObjects,
+    environment,
+  }: SetupDeps) {
     const statusConfig = await this.config$.pipe(take(1)).toPromise();
     const core$ = this.setupCoreStatus({ elasticsearch, savedObjects });
     this.pluginsStatus = new PluginsStatusService({ core$, pluginDependencies });
@@ -73,6 +88,26 @@ export class StatusService implements CoreService<InternalStatusServiceSetup> {
       shareReplay(1)
     );
 
+    // Create an unused subscription to ensure all underlying lazy observables are started.
+    this.overallSubscription = overall$.subscribe();
+
+    const router = http.createRouter('');
+    registerStatusRoute({
+      router,
+      config: {
+        allowAnonymous: statusConfig.allowAnonymous,
+        packageInfo: this.coreContext.env.packageInfo,
+        serverName: http.getServerInfo().name,
+        uuid: environment.instanceUuid,
+      },
+      metrics,
+      status: {
+        overall$,
+        plugins$: this.pluginsStatus.getAll$(),
+        core$,
+      },
+    });
+
     return {
       core$,
       overall$,
@@ -87,7 +122,12 @@ export class StatusService implements CoreService<InternalStatusServiceSetup> {
 
   public start() {}
 
-  public stop() {}
+  public stop() {
+    if (this.overallSubscription) {
+      this.overallSubscription.unsubscribe();
+      this.overallSubscription = undefined;
+    }
+  }
 
   private setupCoreStatus({
     elasticsearch,
diff --git a/src/core/server/status/types.ts b/src/core/server/status/types.ts
index 9fa33a8c6d40c..8efaede79e9d4 100644
--- a/src/core/server/status/types.ts
+++ b/src/core/server/status/types.ts
@@ -71,6 +71,9 @@ export const ServiceStatusLevels = deepFreeze({
   available: {
     toString: () => 'available',
     valueOf: () => 0,
+    toJSON() {
+      return this.toString();
+    },
   },
   /**
    * Some features may not be working.
@@ -78,6 +81,9 @@ export const ServiceStatusLevels = deepFreeze({
   degraded: {
     toString: () => 'degraded',
     valueOf: () => 1,
+    toJSON() {
+      return this.toString();
+    },
   },
   /**
    * The service is unavailable, but other functions that do not depend on this service should work.
@@ -85,6 +91,9 @@ export const ServiceStatusLevels = deepFreeze({
   unavailable: {
     toString: () => 'unavailable',
     valueOf: () => 2,
+    toJSON() {
+      return this.toString();
+    },
   },
   /**
    * Block all user functions and display the status page, reserved for Core services only.
@@ -92,6 +101,9 @@ export const ServiceStatusLevels = deepFreeze({
   critical: {
     toString: () => 'critical',
     valueOf: () => 3,
+    toJSON() {
+      return this.toString();
+    },
   },
 });
 
@@ -217,11 +229,17 @@ export interface StatusServiceSetup {
    * through the dependency tree
    */
   derivedStatus$: Observable<ServiceStatus>;
+
+  /**
+   * Whether or not the status HTTP APIs are available to unauthenticated users when an authentication provider is
+   * present.
+   */
+  isStatusPageAnonymous: () => boolean;
 }
 
 /** @internal */
-export interface InternalStatusServiceSetup extends Pick<StatusServiceSetup, 'core$' | 'overall$'> {
-  isStatusPageAnonymous: () => boolean;
+export interface InternalStatusServiceSetup
+  extends Pick<StatusServiceSetup, 'core$' | 'overall$' | 'isStatusPageAnonymous'> {
   // Namespaced under `plugins` key to improve clarity that these are APIs for plugins specifically.
   plugins: {
     set(plugin: PluginName, status$: Observable<ServiceStatus>): void;
diff --git a/src/core/utils/context.mock.ts b/src/core/utils/context.mock.ts
index de844f3f0f07d..273d64ec8f822 100644
--- a/src/core/utils/context.mock.ts
+++ b/src/core/utils/context.mock.ts
@@ -21,15 +21,13 @@ import { IContextContainer } from './context';
 
 export type ContextContainerMock = jest.Mocked<IContextContainer<any>>;
 
-const createContextMock = () => {
+const createContextMock = (mockContext = {}) => {
   const contextMock: ContextContainerMock = {
     registerContext: jest.fn(),
-    createHandler: jest.fn((id, handler) => (...args: any[]) =>
-      Promise.resolve(handler({}, ...args))
-    ),
+    createHandler: jest.fn(),
   };
   contextMock.createHandler.mockImplementation((pluginId, handler) => (...args) =>
-    handler({}, ...args)
+    handler(mockContext, ...args)
   );
   return contextMock;
 };
diff --git a/src/dev/build/tasks/os_packages/docker_generator/run.ts b/src/dev/build/tasks/os_packages/docker_generator/run.ts
index 362c34d416743..19487efe1366c 100644
--- a/src/dev/build/tasks/os_packages/docker_generator/run.ts
+++ b/src/dev/build/tasks/os_packages/docker_generator/run.ts
@@ -40,7 +40,7 @@ export async function runDockerGenerator(
   ubi: boolean = false
 ) {
   // UBI var config
-  const baseOSImage = ubi ? 'registry.access.redhat.com/ubi8/ubi-minimal:latest' : 'centos:8';
+  const baseOSImage = ubi ? 'docker.elastic.co/ubi8/ubi-minimal:latest' : 'centos:8';
   const ubiVersionTag = 'ubi8';
   const ubiImageFlavor = ubi ? `-${ubiVersionTag}` : '';
 
diff --git a/src/dev/jest/config.js b/src/dev/jest/config.js
index 486c8563c5456..5d31db63773fa 100644
--- a/src/dev/jest/config.js
+++ b/src/dev/jest/config.js
@@ -25,7 +25,6 @@ export default {
     '<rootDir>/src/plugins',
     '<rootDir>/src/legacy/ui',
     '<rootDir>/src/core',
-    '<rootDir>/src/legacy/core_plugins',
     '<rootDir>/src/legacy/server',
     '<rootDir>/src/cli',
     '<rootDir>/src/cli_keystore',
@@ -51,14 +50,11 @@ export default {
     'packages/kbn-ui-framework/src/services/**/*.js',
     '!packages/kbn-ui-framework/src/services/index.js',
     '!packages/kbn-ui-framework/src/services/**/*/index.js',
-    'src/legacy/core_plugins/**/*.{js,mjs,jsx,ts,tsx}',
-    '!src/legacy/core_plugins/**/{__test__,__snapshots__}/**/*',
   ],
   moduleNameMapper: {
     '@elastic/eui$': '<rootDir>/node_modules/@elastic/eui/test-env',
     '@elastic/eui/lib/(.*)?': '<rootDir>/node_modules/@elastic/eui/test-env/$1',
     '^src/plugins/(.*)': '<rootDir>/src/plugins/$1',
-    '^plugins/([^/.]*)(.*)': '<rootDir>/src/legacy/core_plugins/$1/public$2',
     '^uiExports/(.*)': '<rootDir>/src/dev/jest/mocks/file_mock.js',
     '^test_utils/(.*)': '<rootDir>/src/test_utils/public/$1',
     '^fixtures/(.*)': '<rootDir>/src/fixtures/$1',
diff --git a/src/dev/precommit_hook/casing_check_config.js b/src/dev/precommit_hook/casing_check_config.js
index e22dc03cf57aa..ba58dcdfa4d58 100644
--- a/src/dev/precommit_hook/casing_check_config.js
+++ b/src/dev/precommit_hook/casing_check_config.js
@@ -132,11 +132,6 @@ export const REMOVE_EXTENSION = ['packages/kbn-plugin-generator/template/**/*.ej
  * @type {Array}
  */
 export const TEMPORARILY_IGNORED_PATHS = [
-  'src/legacy/core_plugins/console/public/src/directives/helpExample.txt',
-  'src/legacy/core_plugins/console/public/src/sense_editor/theme-sense-dark.js',
-  'src/legacy/core_plugins/tile_map/public/__tests__/scaledCircleMarkers.png',
-  'src/legacy/core_plugins/tile_map/public/__tests__/shadedCircleMarkers.png',
-  'src/legacy/core_plugins/tile_map/public/__tests__/shadedGeohashGrid.png',
   'src/fixtures/config_upgrade_from_4.0.0_to_4.0.1-snapshot.json',
   'src/core/server/core_app/assets/favicons/android-chrome-192x192.png',
   'src/core/server/core_app/assets/favicons/android-chrome-256x256.png',
diff --git a/src/legacy/core_plugins/elasticsearch/index.d.ts b/src/legacy/core_plugins/elasticsearch/index.d.ts
deleted file mode 100644
index 83e7bb19e57ba..0000000000000
--- a/src/legacy/core_plugins/elasticsearch/index.d.ts
+++ /dev/null
@@ -1,526 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import {
-  Client as ESClient,
-  GenericParams,
-  // root params
-  BulkIndexDocumentsParams,
-  ClearScrollParams,
-  CountParams,
-  CreateDocumentParams,
-  DeleteDocumentParams,
-  DeleteDocumentByQueryParams,
-  DeleteScriptParams,
-  DeleteTemplateParams,
-  ExistsParams,
-  ExplainParams,
-  FieldStatsParams,
-  GetParams,
-  GetResponse,
-  GetScriptParams,
-  GetSourceParams,
-  GetTemplateParams,
-  IndexDocumentParams,
-  InfoParams,
-  MGetParams,
-  MSearchParams,
-  MSearchTemplateParams,
-  MTermVectorsParams,
-  PingParams,
-  PutScriptParams,
-  PutTemplateParams,
-  ReindexParams,
-  ReindexRethrottleParams,
-  RenderSearchTemplateParams,
-  ScrollParams,
-  SearchParams,
-  SearchShardsParams,
-  SearchTemplateParams,
-  SuggestParams,
-  TermvectorsParams,
-  UpdateDocumentParams,
-  UpdateDocumentByQueryParams,
-  MGetResponse,
-  MSearchResponse,
-  SearchResponse,
-  // cat
-  CatAliasesParams,
-  CatAllocationParams,
-  CatFielddataParams,
-  CatHealthParams,
-  CatHelpParams,
-  CatIndicesParams,
-  CatCommonParams,
-  CatRecoveryParams,
-  CatSegmentsParams,
-  CatShardsParams,
-  CatSnapshotsParams,
-  CatTasksParams,
-  CatThreadPoolParams,
-  // cluster
-  ClusterAllocationExplainParams,
-  ClusterGetSettingsParams,
-  ClusterHealthParams,
-  ClusterPendingTasksParams,
-  ClusterPutSettingsParams,
-  ClusterRerouteParams,
-  ClusterStateParams,
-  ClusterStatsParams,
-  // indices
-  IndicesAnalyzeParams,
-  IndicesClearCacheParams,
-  IndicesCloseParams,
-  IndicesCreateParams,
-  IndicesDeleteParams,
-  IndicesDeleteAliasParams,
-  IndicesDeleteTemplateParams,
-  IndicesExistsParams,
-  IndicesExistsAliasParams,
-  IndicesExistsTemplateParams,
-  IndicesExistsTypeParams,
-  IndicesFlushParams,
-  IndicesFlushSyncedParams,
-  IndicesForcemergeParams,
-  IndicesGetParams,
-  IndicesGetAliasParams,
-  IndicesGetFieldMappingParams,
-  IndicesGetMappingParams,
-  IndicesGetSettingsParams,
-  IndicesGetTemplateParams,
-  IndicesGetUpgradeParams,
-  IndicesOpenParams,
-  IndicesPutAliasParams,
-  IndicesPutMappingParams,
-  IndicesPutSettingsParams,
-  IndicesPutTemplateParams,
-  IndicesRecoveryParams,
-  IndicesRefreshParams,
-  IndicesRolloverParams,
-  IndicesSegmentsParams,
-  IndicesShardStoresParams,
-  IndicesShrinkParams,
-  IndicesStatsParams,
-  IndicesUpdateAliasesParams,
-  IndicesUpgradeParams,
-  IndicesValidateQueryParams,
-  // ingest
-  IngestDeletePipelineParams,
-  IngestGetPipelineParams,
-  IngestPutPipelineParams,
-  IngestSimulateParams,
-  // nodes
-  NodesHotThreadsParams,
-  NodesInfoParams,
-  NodesStatsParams,
-  // snapshot
-  SnapshotCreateParams,
-  SnapshotCreateRepositoryParams,
-  SnapshotDeleteParams,
-  SnapshotDeleteRepositoryParams,
-  SnapshotGetParams,
-  SnapshotGetRepositoryParams,
-  SnapshotRestoreParams,
-  SnapshotStatusParams,
-  SnapshotVerifyRepositoryParams,
-  // tasks
-  TasksCancelParams,
-  TasksGetParams,
-  TasksListParams,
-} from 'elasticsearch';
-
-export class Cluster {
-  public callWithRequest: CallClusterWithRequest;
-  public callWithInternalUser: CallCluster;
-  constructor(config: ClusterConfig);
-}
-
-export interface ClusterConfig {
-  [option: string]: any;
-}
-
-export interface Request {
-  headers: RequestHeaders;
-}
-
-interface RequestHeaders {
-  [name: string]: string;
-}
-
-interface AssistantAPIClientParams extends GenericParams {
-  path: '/_migration/assistance';
-  method: 'GET';
-}
-
-type MIGRATION_ASSISTANCE_INDEX_ACTION = 'upgrade' | 'reindex';
-type MIGRATION_DEPRECATION_LEVEL = 'none' | 'info' | 'warning' | 'critical';
-
-export interface AssistanceAPIResponse {
-  indices: {
-    [indexName: string]: {
-      action_required: MIGRATION_ASSISTANCE_INDEX_ACTION;
-    };
-  };
-}
-
-interface DeprecationAPIClientParams extends GenericParams {
-  path: '/_migration/deprecations';
-  method: 'GET';
-}
-
-export interface DeprecationInfo {
-  level: MIGRATION_DEPRECATION_LEVEL;
-  message: string;
-  url: string;
-  details?: string;
-}
-
-export interface IndexSettingsDeprecationInfo {
-  [indexName: string]: DeprecationInfo[];
-}
-
-export interface DeprecationAPIResponse {
-  cluster_settings: DeprecationInfo[];
-  ml_settings: DeprecationInfo[];
-  node_settings: DeprecationInfo[];
-  index_settings: IndexSettingsDeprecationInfo;
-}
-
-export interface CallClusterOptions {
-  wrap401Errors?: boolean;
-  signal?: AbortSignal;
-}
-
-export interface CallClusterWithRequest {
-  /* eslint-disable */
-  (request: Request, endpoint: 'bulk', params: BulkIndexDocumentsParams, options?: CallClusterOptions): ReturnType<ESClient['bulk']>;
-  (request: Request, endpoint: 'clearScroll', params: ClearScrollParams, options?: CallClusterOptions): ReturnType<ESClient['clearScroll']>;
-  (request: Request, endpoint: 'count', params: CountParams, options?: CallClusterOptions): ReturnType<ESClient['count']>;
-  (request: Request, endpoint: 'create', params: CreateDocumentParams, options?: CallClusterOptions): ReturnType<ESClient['create']>;
-  (request: Request, endpoint: 'delete', params: DeleteDocumentParams, options?: CallClusterOptions): ReturnType<ESClient['delete']>;
-  (request: Request, endpoint: 'deleteByQuery', params: DeleteDocumentByQueryParams, options?: CallClusterOptions): ReturnType<ESClient['deleteByQuery']>;
-  (request: Request, endpoint: 'deleteScript', params: DeleteScriptParams, options?: CallClusterOptions): ReturnType<ESClient['deleteScript']>;
-  (request: Request, endpoint: 'deleteTemplate', params: DeleteTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['deleteTemplate']>;
-  (request: Request, endpoint: 'exists', params: ExistsParams, options?: CallClusterOptions): ReturnType<ESClient['exists']>;
-  (request: Request, endpoint: 'explain', params: ExplainParams, options?: CallClusterOptions): ReturnType<ESClient['explain']>;
-  (request: Request, endpoint: 'fieldStats', params: FieldStatsParams, options?: CallClusterOptions): ReturnType<ESClient['fieldStats']>;
-  // Generic types cannot be properly looked up with ReturnType. Hard code these explicitly.
-  <T>(request: Request, endpoint: 'get', params: GetParams, options?: CallClusterOptions): Promise<GetResponse<T>>;
-  (request: Request, endpoint: 'getScript', params: GetScriptParams, options?: CallClusterOptions): ReturnType<ESClient['getScript']>;
-  (request: Request, endpoint: 'getSource', params: GetSourceParams, options?: CallClusterOptions): ReturnType<ESClient['getSource']>;
-  (request: Request, endpoint: 'getTemplate', params: GetTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['getTemplate']>;
-  // Generic types cannot be properly looked up with ReturnType. Hard code these explicitly.
-  <T>(request: Request, endpoint: 'index', params: IndexDocumentParams<T>, options?: CallClusterOptions): ReturnType<ESClient['index']>;
-  (request: Request, endpoint: 'info', params: InfoParams, options?: CallClusterOptions): ReturnType<ESClient['info']>;
-  // Generic types cannot be properly looked up with ReturnType. Hard code these explicitly.
-  <T>(request: Request, endpoint: 'mget', params: MGetParams, options?: CallClusterOptions): Promise<MGetResponse<T>>;
-  <T>(request: Request, endpoint: 'msearch', params: MSearchParams, options?: CallClusterOptions): Promise<MSearchResponse<T>>;
-  <T>(request: Request, endpoint: 'msearchTemplate', params: MSearchTemplateParams, options?: CallClusterOptions): Promise<MSearchResponse<T>>;
-  (request: Request, endpoint: 'mtermvectors', params: MTermVectorsParams, options?: CallClusterOptions): ReturnType<ESClient['mtermvectors']>;
-  (request: Request, endpoint: 'ping', params: PingParams, options?: CallClusterOptions): ReturnType<ESClient['ping']>;
-  (request: Request, endpoint: 'putScript', params: PutScriptParams, options?: CallClusterOptions): ReturnType<ESClient['putScript']>;
-  (request: Request, endpoint: 'putTemplate', params: PutTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['putTemplate']>;
-  (request: Request, endpoint: 'reindex', params: ReindexParams, options?: CallClusterOptions): ReturnType<ESClient['reindex']>;
-  (request: Request, endpoint: 'reindexRethrottle', params: ReindexRethrottleParams, options?: CallClusterOptions): ReturnType<ESClient['reindexRethrottle']>;
-  (request: Request, endpoint: 'renderSearchTemplate', params: RenderSearchTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['renderSearchTemplate']>;
-  // Generic types cannot be properly looked up with ReturnType. Hard code these explicitly.
-  <T>(request: Request, endpoint: 'scroll', params: ScrollParams, options?: CallClusterOptions): Promise<SearchResponse<T>>;
-  <T>(request: Request, endpoint: 'search', params: SearchParams, options?: CallClusterOptions): Promise<SearchResponse<T>>;
-  (request: Request, endpoint: 'searchShards', params: SearchShardsParams, options?: CallClusterOptions): ReturnType<ESClient['searchShards']>;
-  (request: Request, endpoint: 'searchTemplate', params: SearchTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['searchTemplate']>;
-  (request: Request, endpoint: 'suggest', params: SuggestParams, options?: CallClusterOptions): ReturnType<ESClient['suggest']>;
-  (request: Request, endpoint: 'termvectors', params: TermvectorsParams, options?: CallClusterOptions): ReturnType<ESClient['termvectors']>;
-  (request: Request, endpoint: 'update', params: UpdateDocumentParams, options?: CallClusterOptions): ReturnType<ESClient['update']>;
-  (request: Request, endpoint: 'updateByQuery', params: UpdateDocumentByQueryParams, options?: CallClusterOptions): ReturnType<ESClient['updateByQuery']>;
-
-  // cat namespace
-  (request: Request, endpoint: 'cat.aliases', params: CatAliasesParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['aliases']>;
-  (request: Request, endpoint: 'cat.allocation', params: CatAllocationParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['allocation']>;
-  (request: Request, endpoint: 'cat.count', params: CatAllocationParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['count']>;
-  (request: Request, endpoint: 'cat.fielddata', params: CatFielddataParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['fielddata']>;
-  (request: Request, endpoint: 'cat.health', params: CatHealthParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['health']>;
-  (request: Request, endpoint: 'cat.help', params: CatHelpParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['help']>;
-  (request: Request, endpoint: 'cat.indices', params: CatIndicesParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['indices']>;
-  (request: Request, endpoint: 'cat.master', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['master']>;
-  (request: Request, endpoint: 'cat.nodeattrs', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['nodeattrs']>;
-  (request: Request, endpoint: 'cat.nodes', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['nodes']>;
-  (request: Request, endpoint: 'cat.pendingTasks', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['pendingTasks']>;
-  (request: Request, endpoint: 'cat.plugins', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['plugins']>;
-  (request: Request, endpoint: 'cat.recovery', params: CatRecoveryParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['recovery']>;
-  (request: Request, endpoint: 'cat.repositories', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['repositories']>;
-  (request: Request, endpoint: 'cat.segments', params: CatSegmentsParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['segments']>;
-  (request: Request, endpoint: 'cat.shards', params: CatShardsParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['shards']>;
-  (request: Request, endpoint: 'cat.snapshots', params: CatSnapshotsParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['snapshots']>;
-  (request: Request, endpoint: 'cat.tasks', params: CatTasksParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['tasks']>;
-  (request: Request, endpoint: 'cat.threadPool', params: CatThreadPoolParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['threadPool']>;
-
-  // cluster namespace
-  (request: Request, endpoint: 'cluster.allocationExplain', params: ClusterAllocationExplainParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['allocationExplain']>;
-  (request: Request, endpoint: 'cluster.getSettings', params: ClusterGetSettingsParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['getSettings']>;
-  (request: Request, endpoint: 'cluster.health', params: ClusterHealthParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['health']>;
-  (request: Request, endpoint: 'cluster.pendingTasks', params: ClusterPendingTasksParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['pendingTasks']>;
-  (request: Request, endpoint: 'cluster.putSettings', params: ClusterPutSettingsParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['putSettings']>;
-  (request: Request, endpoint: 'cluster.reroute', params: ClusterRerouteParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['reroute']>;
-  (request: Request, endpoint: 'cluster.state', params: ClusterStateParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['state']>;
-  (request: Request, endpoint: 'cluster.stats', params: ClusterStatsParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['stats']>;
-
-  // indices namespace
-  (request: Request, endpoint: 'indices.analyze', params: IndicesAnalyzeParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['analyze']>;
-  (request: Request, endpoint: 'indices.clearCache', params: IndicesClearCacheParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['clearCache']>;
-  (request: Request, endpoint: 'indices.close', params: IndicesCloseParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['close']>;
-  (request: Request, endpoint: 'indices.create', params: IndicesCreateParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['create']>;
-  (request: Request, endpoint: 'indices.delete', params: IndicesDeleteParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['delete']>;
-  (request: Request, endpoint: 'indices.deleteAlias', params: IndicesDeleteAliasParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['deleteAlias']>;
-  (request: Request, endpoint: 'indices.deleteTemplate', params: IndicesDeleteTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['deleteTemplate']>;
-  (request: Request, endpoint: 'indices.exists', params: IndicesExistsParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['exists']>;
-  (request: Request, endpoint: 'indices.existsAlias', params: IndicesExistsAliasParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['existsAlias']>;
-  (request: Request, endpoint: 'indices.existsTemplate', params: IndicesExistsTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['existsTemplate']>;
-  (request: Request, endpoint: 'indices.existsType', params: IndicesExistsTypeParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['existsType']>;
-  (request: Request, endpoint: 'indices.flush', params: IndicesFlushParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['flush']>;
-  (request: Request, endpoint: 'indices.flushSynced', params: IndicesFlushSyncedParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['flushSynced']>;
-  (request: Request, endpoint: 'indices.forcemerge', params: IndicesForcemergeParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['forcemerge']>;
-  (request: Request, endpoint: 'indices.get', params: IndicesGetParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['get']>;
-  (request: Request, endpoint: 'indices.getAlias', params: IndicesGetAliasParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getAlias']>;
-  (request: Request, endpoint: 'indices.getFieldMapping', params: IndicesGetFieldMappingParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getFieldMapping']>;
-  (request: Request, endpoint: 'indices.getMapping', params: IndicesGetMappingParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getMapping']>;
-  (request: Request, endpoint: 'indices.getSettings', params: IndicesGetSettingsParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getSettings']>;
-  (request: Request, endpoint: 'indices.getTemplate', params: IndicesGetTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getTemplate']>;
-  (request: Request, endpoint: 'indices.getUpgrade', params: IndicesGetUpgradeParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getUpgrade']>;
-  (request: Request, endpoint: 'indices.open', params: IndicesOpenParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['open']>;
-  (request: Request, endpoint: 'indices.putAlias', params: IndicesPutAliasParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['putAlias']>;
-  (request: Request, endpoint: 'indices.putMapping', params: IndicesPutMappingParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['putMapping']>;
-  (request: Request, endpoint: 'indices.putSettings', params: IndicesPutSettingsParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['putSettings']>;
-  (request: Request, endpoint: 'indices.putTemplate', params: IndicesPutTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['putTemplate']>;
-  (request: Request, endpoint: 'indices.recovery', params: IndicesRecoveryParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['recovery']>;
-  (request: Request, endpoint: 'indices.refresh', params: IndicesRefreshParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['refresh']>;
-  (request: Request, endpoint: 'indices.rollover', params: IndicesRolloverParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['rollover']>;
-  (request: Request, endpoint: 'indices.segments', params: IndicesSegmentsParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['segments']>;
-  (request: Request, endpoint: 'indices.shardStores', params: IndicesShardStoresParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['shardStores']>;
-  (request: Request, endpoint: 'indices.shrink', params: IndicesShrinkParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['shrink']>;
-  (request: Request, endpoint: 'indices.stats', params: IndicesStatsParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['stats']>;
-  (request: Request, endpoint: 'indices.updateAliases', params: IndicesUpdateAliasesParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['updateAliases']>;
-  (request: Request, endpoint: 'indices.upgrade', params: IndicesUpgradeParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['upgrade']>;
-  (request: Request, endpoint: 'indices.validateQuery', params: IndicesValidateQueryParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['validateQuery']>;
-
-  // ingest namepsace
-  (request: Request, endpoint: 'ingest.deletePipeline', params: IngestDeletePipelineParams, options?: CallClusterOptions): ReturnType<ESClient['ingest']['deletePipeline']>;
-  (request: Request, endpoint: 'ingest.getPipeline', params: IngestGetPipelineParams, options?: CallClusterOptions): ReturnType<ESClient['ingest']['getPipeline']>;
-  (request: Request, endpoint: 'ingest.putPipeline', params: IngestPutPipelineParams, options?: CallClusterOptions): ReturnType<ESClient['ingest']['putPipeline']>;
-  (request: Request, endpoint: 'ingest.simulate', params: IngestSimulateParams, options?: CallClusterOptions): ReturnType<ESClient['ingest']['simulate']>;
-
-  // nodes namespace
-  (request: Request, endpoint: 'nodes.hotThreads', params: NodesHotThreadsParams, options?: CallClusterOptions): ReturnType<ESClient['nodes']['hotThreads']>;
-  (request: Request, endpoint: 'nodes.info', params: NodesInfoParams, options?: CallClusterOptions): ReturnType<ESClient['nodes']['info']>;
-  (request: Request, endpoint: 'nodes.stats', params: NodesStatsParams, options?: CallClusterOptions): ReturnType<ESClient['nodes']['stats']>;
-
-  // snapshot namespace
-  (request: Request, endpoint: 'snapshot.create', params: SnapshotCreateParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['create']>;
-  (request: Request, endpoint: 'snapshot.createRepository', params: SnapshotCreateRepositoryParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['createRepository']>;
-  (request: Request, endpoint: 'snapshot.delete', params: SnapshotDeleteParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['delete']>;
-  (request: Request, endpoint: 'snapshot.deleteRepository', params: SnapshotDeleteRepositoryParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['deleteRepository']>;
-  (request: Request, endpoint: 'snapshot.get', params: SnapshotGetParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['get']>;
-  (request: Request, endpoint: 'snapshot.getRepository', params: SnapshotGetRepositoryParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['getRepository']>;
-  (request: Request, endpoint: 'snapshot.restore', params: SnapshotRestoreParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['restore']>;
-  (request: Request, endpoint: 'snapshot.status', params: SnapshotStatusParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['status']>;
-  (request: Request, endpoint: 'snapshot.verifyRepository', params: SnapshotVerifyRepositoryParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['verifyRepository']>;
-
-  // tasks namespace
-  (request: Request, endpoint: 'tasks.cancel', params: TasksCancelParams, options?: CallClusterOptions): ReturnType<ESClient['tasks']['cancel']>;
-  (request: Request, endpoint: 'tasks.get', params: TasksGetParams, options?: CallClusterOptions): ReturnType<ESClient['tasks']['get']>;
-  (request: Request, endpoint: 'tasks.list', params: TasksListParams, options?: CallClusterOptions): ReturnType<ESClient['tasks']['list']>;
-
-  // other APIs accessed via transport.request
-  (
-    request: Request,
-    endpoint: 'transport.request',
-    clientParams: AssistantAPIClientParams,
-    options?: {}
-  ): Promise<AssistanceAPIResponse>;
-  (
-    request: Request,
-    endpoint: 'transport.request',
-    clientParams: DeprecationAPIClientParams,
-    options?: {}
-  ): Promise<DeprecationAPIResponse>;
-
-  // Catch-all definition
-  <T = any>(
-    request: Request,
-    endpoint: string,
-    clientParams?: any,
-    options?: CallClusterOptions
-  ): Promise<T>;
-  /* eslint-enable */
-}
-
-export interface CallCluster {
-  /* eslint-disable */
-  (endpoint: 'bulk', params: BulkIndexDocumentsParams, options?: CallClusterOptions): ReturnType<ESClient['bulk']>;
-  (endpoint: 'clearScroll', params: ClearScrollParams, options?: CallClusterOptions): ReturnType<ESClient['clearScroll']>;
-  (endpoint: 'count', params: CountParams, options?: CallClusterOptions): ReturnType<ESClient['count']>;
-  (endpoint: 'create', params: CreateDocumentParams, options?: CallClusterOptions): ReturnType<ESClient['create']>;
-  (endpoint: 'delete', params: DeleteDocumentParams, options?: CallClusterOptions): ReturnType<ESClient['delete']>;
-  (endpoint: 'deleteByQuery', params: DeleteDocumentByQueryParams, options?: CallClusterOptions): ReturnType<ESClient['deleteByQuery']>;
-  (endpoint: 'deleteScript', params: DeleteScriptParams, options?: CallClusterOptions): ReturnType<ESClient['deleteScript']>;
-  (endpoint: 'deleteTemplate', params: DeleteTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['deleteTemplate']>;
-  (endpoint: 'exists', params: ExistsParams, options?: CallClusterOptions): ReturnType<ESClient['exists']>;
-  (endpoint: 'explain', params: ExplainParams, options?: CallClusterOptions): ReturnType<ESClient['explain']>;
-  (endpoint: 'fieldStats', params: FieldStatsParams, options?: CallClusterOptions): ReturnType<ESClient['fieldStats']>;
-  // Generic types cannot be properly looked up with ReturnType. Hard code these explicitly.
-  <T>(endpoint: 'get', params: GetParams, options?: CallClusterOptions): Promise<GetResponse<T>>;
-  (endpoint: 'getScript', params: GetScriptParams, options?: CallClusterOptions): ReturnType<ESClient['getScript']>;
-  (endpoint: 'getSource', params: GetSourceParams, options?: CallClusterOptions): ReturnType<ESClient['getSource']>;
-  (endpoint: 'getTemplate', params: GetTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['getTemplate']>;
-  // Generic types cannot be properly looked up with ReturnType. Hard code these explicitly.
-  <T>(endpoint: 'index', params: IndexDocumentParams<T>, options?: CallClusterOptions): ReturnType<ESClient['index']>;
-  (endpoint: 'info', params: InfoParams, options?: CallClusterOptions): ReturnType<ESClient['info']>;
-  // Generic types cannot be properly looked up with ReturnType. Hard code these explicitly.
-  <T>(endpoint: 'mget', params: MGetParams, options?: CallClusterOptions): Promise<MGetResponse<T>>;
-  <T>(endpoint: 'msearch', params: MSearchParams, options?: CallClusterOptions): Promise<MSearchResponse<T>>;
-  <T>(endpoint: 'msearchTemplate', params: MSearchTemplateParams, options?: CallClusterOptions): Promise<MSearchResponse<T>>;
-  (endpoint: 'mtermvectors', params: MTermVectorsParams, options?: CallClusterOptions): ReturnType<ESClient['mtermvectors']>;
-  (endpoint: 'ping', params: PingParams, options?: CallClusterOptions): ReturnType<ESClient['ping']>;
-  (endpoint: 'putScript', params: PutScriptParams, options?: CallClusterOptions): ReturnType<ESClient['putScript']>;
-  (endpoint: 'putTemplate', params: PutTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['putTemplate']>;
-  (endpoint: 'reindex', params: ReindexParams, options?: CallClusterOptions): ReturnType<ESClient['reindex']>;
-  (endpoint: 'reindexRethrottle', params: ReindexRethrottleParams, options?: CallClusterOptions): ReturnType<ESClient['reindexRethrottle']>;
-  (endpoint: 'renderSearchTemplate', params: RenderSearchTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['renderSearchTemplate']>;
-  // Generic types cannot be properly looked up with ReturnType. Hard code these explicitly.
-  <T>(endpoint: 'scroll', params: ScrollParams, options?: CallClusterOptions): Promise<SearchResponse<T>>;
-  <T>(endpoint: 'search', params: SearchParams, options?: CallClusterOptions): Promise<SearchResponse<T>>;
-  (endpoint: 'searchShards', params: SearchShardsParams, options?: CallClusterOptions): ReturnType<ESClient['searchShards']>;
-  (endpoint: 'searchTemplate', params: SearchTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['searchTemplate']>;
-  (endpoint: 'suggest', params: SuggestParams, options?: CallClusterOptions): ReturnType<ESClient['suggest']>;
-  (endpoint: 'termvectors', params: TermvectorsParams, options?: CallClusterOptions): ReturnType<ESClient['termvectors']>;
-  (endpoint: 'update', params: UpdateDocumentParams, options?: CallClusterOptions): ReturnType<ESClient['update']>;
-  (endpoint: 'updateByQuery', params: UpdateDocumentByQueryParams, options?: CallClusterOptions): ReturnType<ESClient['updateByQuery']>;
-
-  // cat namespace
-  (endpoint: 'cat.aliases', params: CatAliasesParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['aliases']>;
-  (endpoint: 'cat.allocation', params: CatAllocationParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['allocation']>;
-  (endpoint: 'cat.count', params: CatAllocationParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['count']>;
-  (endpoint: 'cat.fielddata', params: CatFielddataParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['fielddata']>;
-  (endpoint: 'cat.health', params: CatHealthParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['health']>;
-  (endpoint: 'cat.help', params: CatHelpParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['help']>;
-  (endpoint: 'cat.indices', params: CatIndicesParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['indices']>;
-  (endpoint: 'cat.master', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['master']>;
-  (endpoint: 'cat.nodeattrs', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['nodeattrs']>;
-  (endpoint: 'cat.nodes', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['nodes']>;
-  (endpoint: 'cat.pendingTasks', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['pendingTasks']>;
-  (endpoint: 'cat.plugins', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['plugins']>;
-  (endpoint: 'cat.recovery', params: CatRecoveryParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['recovery']>;
-  (endpoint: 'cat.repositories', params: CatCommonParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['repositories']>;
-  (endpoint: 'cat.segments', params: CatSegmentsParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['segments']>;
-  (endpoint: 'cat.shards', params: CatShardsParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['shards']>;
-  (endpoint: 'cat.snapshots', params: CatSnapshotsParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['snapshots']>;
-  (endpoint: 'cat.tasks', params: CatTasksParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['tasks']>;
-  (endpoint: 'cat.threadPool', params: CatThreadPoolParams, options?: CallClusterOptions): ReturnType<ESClient['cat']['threadPool']>;
-
-  // cluster namespace
-  (endpoint: 'cluster.allocationExplain', params: ClusterAllocationExplainParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['allocationExplain']>;
-  (endpoint: 'cluster.getSettings', params: ClusterGetSettingsParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['getSettings']>;
-  (endpoint: 'cluster.health', params: ClusterHealthParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['health']>;
-  (endpoint: 'cluster.pendingTasks', params: ClusterPendingTasksParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['pendingTasks']>;
-  (endpoint: 'cluster.putSettings', params: ClusterPutSettingsParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['putSettings']>;
-  (endpoint: 'cluster.reroute', params: ClusterRerouteParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['reroute']>;
-  (endpoint: 'cluster.state', params: ClusterStateParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['state']>;
-  (endpoint: 'cluster.stats', params: ClusterStatsParams, options?: CallClusterOptions): ReturnType<ESClient['cluster']['stats']>;
-
-  // indices namespace
-  (endpoint: 'indices.analyze', params: IndicesAnalyzeParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['analyze']>;
-  (endpoint: 'indices.clearCache', params: IndicesClearCacheParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['clearCache']>;
-  (endpoint: 'indices.close', params: IndicesCloseParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['close']>;
-  (endpoint: 'indices.create', params: IndicesCreateParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['create']>;
-  (endpoint: 'indices.delete', params: IndicesDeleteParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['delete']>;
-  (endpoint: 'indices.deleteAlias', params: IndicesDeleteAliasParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['deleteAlias']>;
-  (endpoint: 'indices.deleteTemplate', params: IndicesDeleteTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['deleteTemplate']>;
-  (endpoint: 'indices.exists', params: IndicesExistsParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['exists']>;
-  (endpoint: 'indices.existsAlias', params: IndicesExistsAliasParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['existsAlias']>;
-  (endpoint: 'indices.existsTemplate', params: IndicesExistsTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['existsTemplate']>;
-  (endpoint: 'indices.existsType', params: IndicesExistsTypeParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['existsType']>;
-  (endpoint: 'indices.flush', params: IndicesFlushParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['flush']>;
-  (endpoint: 'indices.flushSynced', params: IndicesFlushSyncedParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['flushSynced']>;
-  (endpoint: 'indices.forcemerge', params: IndicesForcemergeParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['forcemerge']>;
-  (endpoint: 'indices.get', params: IndicesGetParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['get']>;
-  (endpoint: 'indices.getAlias', params: IndicesGetAliasParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getAlias']>;
-  (endpoint: 'indices.getFieldMapping', params: IndicesGetFieldMappingParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getFieldMapping']>;
-  (endpoint: 'indices.getMapping', params: IndicesGetMappingParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getMapping']>;
-  (endpoint: 'indices.getSettings', params: IndicesGetSettingsParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getSettings']>;
-  (endpoint: 'indices.getTemplate', params: IndicesGetTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getTemplate']>;
-  (endpoint: 'indices.getUpgrade', params: IndicesGetUpgradeParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['getUpgrade']>;
-  (endpoint: 'indices.open', params: IndicesOpenParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['open']>;
-  (endpoint: 'indices.putAlias', params: IndicesPutAliasParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['putAlias']>;
-  (endpoint: 'indices.putMapping', params: IndicesPutMappingParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['putMapping']>;
-  (endpoint: 'indices.putSettings', params: IndicesPutSettingsParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['putSettings']>;
-  (endpoint: 'indices.putTemplate', params: IndicesPutTemplateParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['putTemplate']>;
-  (endpoint: 'indices.recovery', params: IndicesRecoveryParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['recovery']>;
-  (endpoint: 'indices.refresh', params: IndicesRefreshParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['refresh']>;
-  (endpoint: 'indices.rollover', params: IndicesRolloverParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['rollover']>;
-  (endpoint: 'indices.segments', params: IndicesSegmentsParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['segments']>;
-  (endpoint: 'indices.shardStores', params: IndicesShardStoresParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['shardStores']>;
-  (endpoint: 'indices.shrink', params: IndicesShrinkParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['shrink']>;
-  (endpoint: 'indices.stats', params: IndicesStatsParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['stats']>;
-  (endpoint: 'indices.updateAliases', params: IndicesUpdateAliasesParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['updateAliases']>;
-  (endpoint: 'indices.upgrade', params: IndicesUpgradeParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['upgrade']>;
-  (endpoint: 'indices.validateQuery', params: IndicesValidateQueryParams, options?: CallClusterOptions): ReturnType<ESClient['indices']['validateQuery']>;
-
-  // ingest namespace
-  (endpoint: 'ingest.deletePipeline', params: IngestDeletePipelineParams, options?: CallClusterOptions): ReturnType<ESClient['ingest']['deletePipeline']>;
-  (endpoint: 'ingest.getPipeline', params: IngestGetPipelineParams, options?: CallClusterOptions): ReturnType<ESClient['ingest']['getPipeline']>;
-  (endpoint: 'ingest.putPipeline', params: IngestPutPipelineParams, options?: CallClusterOptions): ReturnType<ESClient['ingest']['putPipeline']>;
-  (endpoint: 'ingest.simulate', params: IngestSimulateParams, options?: CallClusterOptions): ReturnType<ESClient['ingest']['simulate']>;
-
-  // nodes namespace
-  (endpoint: 'nodes.hotThreads', params: NodesHotThreadsParams, options?: CallClusterOptions): ReturnType<ESClient['nodes']['hotThreads']>;
-  (endpoint: 'nodes.info', params: NodesInfoParams, options?: CallClusterOptions): ReturnType<ESClient['nodes']['info']>;
-  (endpoint: 'nodes.stats', params: NodesStatsParams, options?: CallClusterOptions): ReturnType<ESClient['nodes']['stats']>;
-
-  // snapshot namespace
-  (endpoint: 'snapshot.create', params: SnapshotCreateParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['create']>;
-  (endpoint: 'snapshot.createRepository', params: SnapshotCreateRepositoryParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['createRepository']>;
-  (endpoint: 'snapshot.delete', params: SnapshotDeleteParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['delete']>;
-  (endpoint: 'snapshot.deleteRepository', params: SnapshotDeleteRepositoryParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['deleteRepository']>;
-  (endpoint: 'snapshot.get', params: SnapshotGetParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['get']>;
-  (endpoint: 'snapshot.getRepository', params: SnapshotGetRepositoryParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['getRepository']>;
-  (endpoint: 'snapshot.restore', params: SnapshotRestoreParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['restore']>;
-  (endpoint: 'snapshot.status', params: SnapshotStatusParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['status']>;
-  (endpoint: 'snapshot.verifyRepository', params: SnapshotVerifyRepositoryParams, options?: CallClusterOptions): ReturnType<ESClient['snapshot']['verifyRepository']>;
-
-  // tasks namespace
-  (endpoint: 'tasks.cancel', params: TasksCancelParams, options?: CallClusterOptions): ReturnType<ESClient['tasks']['cancel']>;
-  (endpoint: 'tasks.get', params: TasksGetParams, options?: CallClusterOptions): ReturnType<ESClient['tasks']['get']>;
-  (endpoint: 'tasks.list', params: TasksListParams, options?: CallClusterOptions): ReturnType<ESClient['tasks']['list']>;
-
-  // other APIs accessed via transport.request
-  (endpoint: 'transport.request', clientParams: AssistantAPIClientParams, options?: {}): Promise<
-    AssistanceAPIResponse
-  >;
-  (endpoint: 'transport.request', clientParams: DeprecationAPIClientParams, options?: {}): Promise<
-    DeprecationAPIResponse
-  >;
-
-  // Catch-all definition
-  <T = any>(endpoint: string, clientParams?: any, options?: CallClusterOptions): Promise<T>;
-  /* eslint-enable */
-}
-
-export interface ElasticsearchPlugin {
-  status: { on: (status: string, cb: () => void) => void };
-  getCluster(name: string): Cluster;
-}
diff --git a/src/legacy/core_plugins/elasticsearch/index.js b/src/legacy/core_plugins/elasticsearch/index.js
deleted file mode 100644
index f90f490d68035..0000000000000
--- a/src/legacy/core_plugins/elasticsearch/index.js
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { Cluster } from './server/lib/cluster';
-import { createProxy } from './server/lib/create_proxy';
-
-export default function (kibana) {
-  return new kibana.Plugin({
-    require: [],
-
-    async init(server) {
-      // All methods that ES plugin exposes are synchronous so we should get the first
-      // value from all observables here to be able to synchronously return and create
-      // cluster clients afterwards.
-      const { client } = server.newPlatform.setup.core.elasticsearch.legacy;
-      const adminCluster = new Cluster(client);
-      const dataCluster = new Cluster(client);
-
-      const clusters = new Map();
-      server.expose('getCluster', (name) => {
-        if (name === 'admin') {
-          return adminCluster;
-        }
-
-        if (name === 'data') {
-          return dataCluster;
-        }
-
-        return clusters.get(name);
-      });
-
-      server.events.on('stop', () => {
-        for (const cluster of clusters.values()) {
-          cluster.close();
-        }
-
-        clusters.clear();
-      });
-
-      createProxy(server);
-    },
-  });
-}
diff --git a/src/legacy/core_plugins/elasticsearch/package.json b/src/legacy/core_plugins/elasticsearch/package.json
deleted file mode 100644
index b5403e1f13de7..0000000000000
--- a/src/legacy/core_plugins/elasticsearch/package.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "name": "elasticsearch",
-  "version": "kibana",
-  "types": "index.d.ts"
-}
diff --git a/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.js b/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.js
deleted file mode 100644
index 0b8786f0c2841..0000000000000
--- a/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.js
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { AbortController } from 'abortcontroller-polyfill/dist/cjs-ponyfill';
-
-/*
- * A simple utility for generating a handler that provides a signal to the handler that signals when
- * the client has closed the connection on this request.
- */
-export function abortableRequestHandler(fn) {
-  return (req, ...args) => {
-    const controller = new AbortController();
-    req.events.once('disconnect', () => {
-      controller.abort();
-    });
-    return fn(controller.signal, req, ...args);
-  };
-}
diff --git a/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.test.js b/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.test.js
deleted file mode 100644
index d79dd4ae4e449..0000000000000
--- a/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.test.js
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { AbortSignal } from 'abortcontroller-polyfill/dist/cjs-ponyfill';
-import { abortableRequestHandler } from './abortable_request_handler';
-
-describe('abortableRequestHandler', () => {
-  jest.useFakeTimers();
-
-  it('should call abort if disconnected', () => {
-    const eventHandlers = new Map();
-    const mockRequest = {
-      events: {
-        once: jest.fn((key, fn) => eventHandlers.set(key, fn)),
-      },
-    };
-
-    const handler = jest.fn();
-    const onAborted = jest.fn();
-    const abortableHandler = abortableRequestHandler(handler);
-    abortableHandler(mockRequest);
-
-    const [signal, request] = handler.mock.calls[0];
-
-    expect(signal instanceof AbortSignal).toBe(true);
-    expect(request).toBe(mockRequest);
-
-    signal.addEventListener('abort', onAborted);
-
-    // Shouldn't be aborted or call onAborted prior to disconnecting
-    expect(signal.aborted).toBe(false);
-    expect(onAborted).not.toBeCalled();
-
-    expect(eventHandlers.has('disconnect')).toBe(true);
-    eventHandlers.get('disconnect')();
-    jest.runAllTimers();
-
-    // Should be aborted and call onAborted after disconnecting
-    expect(signal.aborted).toBe(true);
-    expect(onAborted).toBeCalled();
-  });
-});
diff --git a/src/legacy/core_plugins/elasticsearch/server/lib/cluster.ts b/src/legacy/core_plugins/elasticsearch/server/lib/cluster.ts
deleted file mode 100644
index 0e7692f6be755..0000000000000
--- a/src/legacy/core_plugins/elasticsearch/server/lib/cluster.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Request } from 'hapi';
-import { errors } from 'elasticsearch';
-import { LegacyCallAPIOptions, LegacyClusterClient, FakeRequest } from 'kibana/server';
-
-export class Cluster {
-  public readonly errors = errors;
-
-  constructor(private readonly clusterClient: LegacyClusterClient) {}
-
-  public callWithRequest = async (
-    req: Request | FakeRequest,
-    endpoint: string,
-    clientParams?: Record<string, unknown>,
-    options?: LegacyCallAPIOptions
-  ) => {
-    return await this.clusterClient
-      .asScoped(req)
-      .callAsCurrentUser(endpoint, clientParams, options);
-  };
-
-  public callWithInternalUser = async (
-    endpoint: string,
-    clientParams?: Record<string, unknown>,
-    options?: LegacyCallAPIOptions
-  ) => {
-    return await this.clusterClient.callAsInternalUser(endpoint, clientParams, options);
-  };
-
-  public close() {
-    this.clusterClient.close();
-  }
-}
diff --git a/src/legacy/core_plugins/elasticsearch/server/lib/create_proxy.js b/src/legacy/core_plugins/elasticsearch/server/lib/create_proxy.js
deleted file mode 100644
index 7302241c46939..0000000000000
--- a/src/legacy/core_plugins/elasticsearch/server/lib/create_proxy.js
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import Joi from 'joi';
-import { abortableRequestHandler } from './abortable_request_handler';
-
-export function createProxy(server) {
-  const { callWithRequest } = server.plugins.elasticsearch.getCluster('data');
-
-  server.route({
-    method: 'POST',
-    path: '/elasticsearch/_msearch',
-    config: {
-      payload: {
-        parse: 'gunzip',
-      },
-    },
-    handler: abortableRequestHandler((signal, req, h) => {
-      const { query, payload } = req;
-      return callWithRequest(
-        req,
-        'transport.request',
-        {
-          path: '/_msearch',
-          method: 'POST',
-          query,
-          body: payload.toString('utf8'),
-        },
-        { signal }
-      ).finally((r) => h.response(r));
-    }),
-  });
-
-  server.route({
-    method: 'POST',
-    path: '/elasticsearch/{index}/_search',
-    config: {
-      validate: {
-        params: Joi.object().keys({
-          index: Joi.string().required(),
-        }),
-      },
-    },
-    handler: abortableRequestHandler(async (signal, req) => {
-      const { query, payload: body } = req;
-      try {
-        return await callWithRequest(
-          req,
-          'transport.request',
-          {
-            path: `/${encodeURIComponent(req.params.index)}/_search`,
-            method: 'POST',
-            query,
-            body,
-          },
-          { signal }
-        );
-      } catch (error) {
-        return JSON.parse(error.response);
-      }
-    }),
-  });
-}
diff --git a/src/legacy/server/kbn_server.d.ts b/src/legacy/server/kbn_server.d.ts
index 8827dc53c5275..3cfda0e0696bb 100644
--- a/src/legacy/server/kbn_server.d.ts
+++ b/src/legacy/server/kbn_server.d.ts
@@ -33,7 +33,6 @@ import {
 import { LegacyConfig, ILegacyInternals } from '../../core/server/legacy';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { UiPlugins } from '../../core/server/plugins';
-import { ElasticsearchPlugin } from '../core_plugins/elasticsearch';
 
 // lot of legacy code was assuming this type only had these two methods
 export type KibanaConfig = Pick<LegacyConfig, 'get' | 'has'>;
@@ -41,10 +40,7 @@ export type KibanaConfig = Pick<LegacyConfig, 'get' | 'has'>;
 // Extend the defaults with the plugins and server methods we need.
 declare module 'hapi' {
   interface PluginProperties {
-    elasticsearch: ElasticsearchPlugin;
-    kibana: any;
     spaces: any;
-    // add new plugin types here
   }
 
   interface Server {
diff --git a/src/legacy/server/kbn_server.js b/src/legacy/server/kbn_server.js
index 24d00abb99a05..107e5f6387833 100644
--- a/src/legacy/server/kbn_server.js
+++ b/src/legacy/server/kbn_server.js
@@ -28,7 +28,6 @@ import httpMixin from './http';
 import { coreMixin } from './core';
 import { loggingMixin } from './logging';
 import warningsMixin from './warnings';
-import { statusMixin } from './status';
 import configCompleteMixin from './config/complete';
 import { optimizeMixin } from '../../optimize';
 import * as Plugins from './plugins';
@@ -90,7 +89,6 @@ export default class KbnServer {
 
         loggingMixin,
         warningsMixin,
-        statusMixin,
 
         // scan translations dirs, register locale files and initialize i18n engine.
         i18nMixin,
diff --git a/src/legacy/server/plugins/lib/plugin.js b/src/legacy/server/plugins/lib/plugin.js
index 2b392d13d595a..48389061199ff 100644
--- a/src/legacy/server/plugins/lib/plugin.js
+++ b/src/legacy/server/plugins/lib/plugin.js
@@ -79,12 +79,7 @@ export class Plugin {
         );
       }
 
-      // Many of the plugins are simply adding static assets to the server and we don't need
-      // to track their "status". Since plugins must have an init() function to even set its status
-      // we shouldn't even create a status unless the plugin can use it.
       if (this.externalInit) {
-        this.status = kbnServer.status.createForPlugin(this);
-        server.expose('status', this.status);
         await this.externalInit(server, options);
       }
     };
@@ -93,12 +88,6 @@ export class Plugin {
       plugin: { register, name: id, version },
       options: config.has(configPrefix) ? config.get(configPrefix) : null,
     });
-
-    // Only change the plugin status to green if the
-    // initial status has not been changed
-    if (this.status && this.status.state === 'uninitialized') {
-      this.status.green('Ready');
-    }
   }
 
   async postInit() {
diff --git a/src/legacy/server/status/index.js b/src/legacy/server/status/index.js
deleted file mode 100644
index ab7ec471a67ff..0000000000000
--- a/src/legacy/server/status/index.js
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import ServerStatus from './server_status';
-import { Metrics } from './lib/metrics';
-import { registerStatusApi, registerStatsApi } from './routes';
-import Oppsy from 'oppsy';
-import { cloneDeep } from 'lodash';
-import { getOSInfo } from './lib/get_os_info';
-
-export function statusMixin(kbnServer, server, config) {
-  kbnServer.status = new ServerStatus(kbnServer.server);
-  const { usageCollection } = server.newPlatform.setup.plugins;
-
-  const metrics = new Metrics(config, server);
-
-  const oppsy = new Oppsy(server);
-  oppsy.on('ops', (event) => {
-    // Oppsy has a bad race condition that will modify this data before
-    // we ship it off to the buffer. Let's create our copy first.
-    event = cloneDeep(event);
-    // Oppsy used to provide this, but doesn't anymore. Grab it ourselves.
-    server.listener.getConnections((_, count) => {
-      event.concurrent_connections = count;
-
-      // captures (performs transforms on) the latest event data and stashes
-      // the metrics for status/stats API payload
-      metrics.capture(event).then((data) => {
-        kbnServer.metrics = data;
-      });
-    });
-  });
-  oppsy.start(config.get('ops.interval'));
-
-  server.events.on('stop', () => {
-    oppsy.stop();
-  });
-
-  // init routes
-  registerStatusApi(kbnServer, server, config);
-  registerStatsApi(usageCollection, server, config, kbnServer);
-
-  // expore shared functionality
-  server.decorate('server', 'getOSInfo', getOSInfo);
-}
diff --git a/src/legacy/server/status/lib/__mocks__/_fs_stubs.js b/src/legacy/server/status/lib/__mocks__/_fs_stubs.js
deleted file mode 100644
index 2be6402baa5fe..0000000000000
--- a/src/legacy/server/status/lib/__mocks__/_fs_stubs.js
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export function cGroups(hierarchy) {
-  if (!hierarchy) {
-    hierarchy = Math.random().toString(36).substring(7);
-  }
-
-  const cpuAcctDir = `/sys/fs/cgroup/cpuacct/${hierarchy}`;
-  const cpuDir = `/sys/fs/cgroup/cpu/${hierarchy}`;
-
-  const cGroupContents = [
-    '10:freezer:/',
-    '9:net_cls,net_prio:/',
-    '8:pids:/',
-    '7:blkio:/',
-    '6:memory:/',
-    '5:devices:/user.slice',
-    '4:hugetlb:/',
-    '3:perf_event:/',
-    '2:cpu,cpuacct,cpuset:/' + hierarchy,
-    '1:name=systemd:/user.slice/user-1000.slice/session-2359.scope',
-  ].join('\n');
-
-  const cpuStatContents = ['nr_periods 0', 'nr_throttled 10', 'throttled_time 20'].join('\n');
-
-  return {
-    hierarchy,
-    cGroupContents,
-    cpuStatContents,
-    cpuAcctDir,
-    cpuDir,
-    files: {
-      '/proc/self/cgroup': cGroupContents,
-      [`${cpuAcctDir}/cpuacct.usage`]: '357753491408',
-      [`${cpuDir}/cpu.cfs_period_us`]: '100000',
-      [`${cpuDir}/cpu.cfs_quota_us`]: '5000',
-      [`${cpuDir}/cpu.stat`]: cpuStatContents,
-    },
-  };
-}
-
-class FSError extends Error {
-  constructor(fileName, code) {
-    super('Stub File System Stub Error: ' + fileName);
-    this.code = code;
-    this.stack = null;
-  }
-}
-
-let _mockFiles = Object.create({});
-
-export const setMockFiles = (mockFiles) => {
-  _mockFiles = Object.create({});
-  if (mockFiles) {
-    const files = Object.keys(mockFiles);
-    for (const file of files) {
-      _mockFiles[file] = mockFiles[file];
-    }
-  }
-};
-
-export const readFileMock = (fileName, callback) => {
-  if (_mockFiles.hasOwnProperty(fileName)) {
-    callback(null, _mockFiles[fileName]);
-  } else {
-    const err = new FSError(fileName, 'ENOENT');
-    callback(err, null);
-  }
-};
diff --git a/src/legacy/server/status/lib/case_conversion.test.ts b/src/legacy/server/status/lib/case_conversion.test.ts
deleted file mode 100644
index a231ee0ba4b0f..0000000000000
--- a/src/legacy/server/status/lib/case_conversion.test.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { keysToSnakeCaseShallow } from './case_conversion';
-
-describe('keysToSnakeCaseShallow', () => {
-  test("should convert all of an object's keys to snake case", () => {
-    const data = {
-      camelCase: 'camel_case',
-      'kebab-case': 'kebab_case',
-      snake_case: 'snake_case',
-    };
-
-    const result = keysToSnakeCaseShallow(data);
-
-    expect(result.camel_case).toBe('camel_case');
-    expect(result.kebab_case).toBe('kebab_case');
-    expect(result.snake_case).toBe('snake_case');
-  });
-});
diff --git a/src/legacy/server/status/lib/case_conversion.ts b/src/legacy/server/status/lib/case_conversion.ts
deleted file mode 100644
index a3ae15028daeb..0000000000000
--- a/src/legacy/server/status/lib/case_conversion.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { mapKeys, snakeCase } from 'lodash';
-
-export function keysToSnakeCaseShallow(object: Record<string, any>) {
-  return mapKeys(object, (value, key) => snakeCase(key));
-}
diff --git a/src/legacy/server/status/lib/cgroup.js b/src/legacy/server/status/lib/cgroup.js
deleted file mode 100644
index 4d21cafbedcaa..0000000000000
--- a/src/legacy/server/status/lib/cgroup.js
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import fs from 'fs';
-import { promisify } from 'bluebird';
-import { join as joinPath } from 'path';
-
-// Logic from elasticsearch/core/src/main/java/org/elasticsearch/monitor/os/OsProbe.java
-
-const CONTROL_GROUP_RE = new RegExp('\\d+:([^:]+):(/.*)');
-const CONTROLLER_SEPARATOR_RE = ',';
-
-const PROC_SELF_CGROUP_FILE = '/proc/self/cgroup';
-const PROC_CGROUP_CPU_DIR = '/sys/fs/cgroup/cpu';
-const PROC_CGROUP_CPUACCT_DIR = '/sys/fs/cgroup/cpuacct';
-
-const GROUP_CPUACCT = 'cpuacct';
-const CPUACCT_USAGE_FILE = 'cpuacct.usage';
-
-const GROUP_CPU = 'cpu';
-const CPU_FS_PERIOD_US_FILE = 'cpu.cfs_period_us';
-const CPU_FS_QUOTA_US_FILE = 'cpu.cfs_quota_us';
-const CPU_STATS_FILE = 'cpu.stat';
-
-const readFile = promisify(fs.readFile);
-
-export function readControlGroups() {
-  return readFile(PROC_SELF_CGROUP_FILE).then((data) => {
-    const response = {};
-
-    data
-      .toString()
-      .split(/\n/)
-      .forEach((line) => {
-        const matches = line.match(CONTROL_GROUP_RE);
-
-        if (matches === null) {
-          return;
-        }
-
-        const controllers = matches[1].split(CONTROLLER_SEPARATOR_RE);
-        controllers.forEach((controller) => {
-          response[controller] = matches[2];
-        });
-      });
-
-    return response;
-  });
-}
-
-function fileContentsToInteger(path) {
-  return readFile(path).then((data) => {
-    return parseInt(data.toString(), 10);
-  });
-}
-
-function readCPUAcctUsage(controlGroup) {
-  return fileContentsToInteger(joinPath(PROC_CGROUP_CPUACCT_DIR, controlGroup, CPUACCT_USAGE_FILE));
-}
-
-function readCPUFsPeriod(controlGroup) {
-  return fileContentsToInteger(joinPath(PROC_CGROUP_CPU_DIR, controlGroup, CPU_FS_PERIOD_US_FILE));
-}
-
-function readCPUFsQuota(controlGroup) {
-  return fileContentsToInteger(joinPath(PROC_CGROUP_CPU_DIR, controlGroup, CPU_FS_QUOTA_US_FILE));
-}
-
-export function readCPUStat(controlGroup) {
-  return new Promise((resolve, reject) => {
-    const stat = {
-      number_of_elapsed_periods: -1,
-      number_of_times_throttled: -1,
-      time_throttled_nanos: -1,
-    };
-
-    readFile(joinPath(PROC_CGROUP_CPU_DIR, controlGroup, CPU_STATS_FILE))
-      .then((data) => {
-        data
-          .toString()
-          .split(/\n/)
-          .forEach((line) => {
-            const fields = line.split(/\s+/);
-
-            switch (fields[0]) {
-              case 'nr_periods':
-                stat.number_of_elapsed_periods = parseInt(fields[1], 10);
-                break;
-
-              case 'nr_throttled':
-                stat.number_of_times_throttled = parseInt(fields[1], 10);
-                break;
-
-              case 'throttled_time':
-                stat.time_throttled_nanos = parseInt(fields[1], 10);
-                break;
-            }
-          });
-
-        resolve(stat);
-      })
-      .catch((err) => {
-        if (err.code === 'ENOENT') {
-          return resolve(stat);
-        }
-
-        reject(err);
-      });
-  });
-}
-
-export function getAllStats(options = {}) {
-  return new Promise((resolve, reject) => {
-    readControlGroups()
-      .then((groups) => {
-        const cpuPath = options.cpuPath || groups[GROUP_CPU];
-        const cpuAcctPath = options.cpuAcctPath || groups[GROUP_CPUACCT];
-
-        // prevents undefined cgroup paths
-        if (!cpuPath || !cpuAcctPath) {
-          return resolve(null);
-        }
-
-        return Promise.all([
-          readCPUAcctUsage(cpuAcctPath),
-          readCPUFsPeriod(cpuPath),
-          readCPUFsQuota(cpuPath),
-          readCPUStat(cpuPath),
-        ])
-          .then(([cpuAcctUsage, cpuFsPeriod, cpuFsQuota, cpuStat]) => {
-            resolve({
-              cpuacct: {
-                control_group: cpuAcctPath,
-                usage_nanos: cpuAcctUsage,
-              },
-
-              cpu: {
-                control_group: cpuPath,
-                cfs_period_micros: cpuFsPeriod,
-                cfs_quota_micros: cpuFsQuota,
-                stat: cpuStat,
-              },
-            });
-          })
-          .catch(rejectUnlessFileNotFound);
-      })
-      .catch(rejectUnlessFileNotFound);
-
-    function rejectUnlessFileNotFound(err) {
-      if (err.code === 'ENOENT') {
-        resolve(null);
-      } else {
-        reject(err);
-      }
-    }
-  });
-}
diff --git a/src/legacy/server/status/lib/cgroup.test.js b/src/legacy/server/status/lib/cgroup.test.js
deleted file mode 100644
index 62feba45d1b3c..0000000000000
--- a/src/legacy/server/status/lib/cgroup.test.js
+++ /dev/null
@@ -1,224 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-jest.mock('fs', () => ({
-  readFile: jest.fn(),
-}));
-
-import fs from 'fs';
-import { cGroups as cGroupsFsStub, setMockFiles, readFileMock } from './__mocks__/_fs_stubs';
-import { getAllStats, readControlGroups, readCPUStat } from './cgroup';
-
-describe('Control Group', function () {
-  const fsStub = cGroupsFsStub();
-
-  beforeAll(() => {
-    fs.readFile.mockImplementation(readFileMock);
-  });
-
-  afterEach(() => {
-    setMockFiles();
-  });
-
-  describe('readControlGroups', () => {
-    it('parses the file', async () => {
-      setMockFiles({ '/proc/self/cgroup': fsStub.cGroupContents });
-      const cGroup = await readControlGroups();
-
-      expect(cGroup).toEqual({
-        freezer: '/',
-        net_cls: '/',
-        net_prio: '/',
-        pids: '/',
-        blkio: '/',
-        memory: '/',
-        devices: '/user.slice',
-        hugetlb: '/',
-        perf_event: '/',
-        cpu: `/${fsStub.hierarchy}`,
-        cpuacct: `/${fsStub.hierarchy}`,
-        cpuset: `/${fsStub.hierarchy}`,
-        'name=systemd': '/user.slice/user-1000.slice/session-2359.scope',
-      });
-    });
-  });
-
-  describe('readCPUStat', () => {
-    it('parses the file', async () => {
-      setMockFiles({ '/sys/fs/cgroup/cpu/fakeGroup/cpu.stat': fsStub.cpuStatContents });
-      const cpuStat = await readCPUStat('fakeGroup');
-
-      expect(cpuStat).toEqual({
-        number_of_elapsed_periods: 0,
-        number_of_times_throttled: 10,
-        time_throttled_nanos: 20,
-      });
-    });
-
-    it('returns default stats for missing file', async () => {
-      setMockFiles();
-      const cpuStat = await readCPUStat('fakeGroup');
-
-      expect(cpuStat).toEqual({
-        number_of_elapsed_periods: -1,
-        number_of_times_throttled: -1,
-        time_throttled_nanos: -1,
-      });
-    });
-  });
-
-  describe('getAllStats', () => {
-    it('can override the cpu group path', async () => {
-      setMockFiles({
-        '/proc/self/cgroup': fsStub.cGroupContents,
-        [`${fsStub.cpuAcctDir}/cpuacct.usage`]: '357753491408',
-        '/sys/fs/cgroup/cpu/docker/cpu.cfs_period_us': '100000',
-        '/sys/fs/cgroup/cpu/docker/cpu.cfs_quota_us': '5000',
-        '/sys/fs/cgroup/cpu/docker/cpu.stat': fsStub.cpuStatContents,
-      });
-
-      const stats = await getAllStats({ cpuPath: '/docker' });
-
-      expect(stats).toEqual({
-        cpuacct: {
-          control_group: `/${fsStub.hierarchy}`,
-          usage_nanos: 357753491408,
-        },
-        cpu: {
-          control_group: '/docker',
-          cfs_period_micros: 100000,
-          cfs_quota_micros: 5000,
-          stat: {
-            number_of_elapsed_periods: 0,
-            number_of_times_throttled: 10,
-            time_throttled_nanos: 20,
-          },
-        },
-      });
-    });
-
-    it('handles an undefined control group', async () => {
-      setMockFiles({
-        '/proc/self/cgroup': '',
-        [`${fsStub.cpuAcctDir}/cpuacct.usage`]: '357753491408',
-        [`${fsStub.cpuDir}/cpu.stat`]: fsStub.cpuStatContents,
-        [`${fsStub.cpuDir}/cpu.cfs_period_us`]: '100000',
-        [`${fsStub.cpuDir}/cpu.cfs_quota_us`]: '5000',
-      });
-
-      const stats = await getAllStats();
-
-      expect(stats).toBe(null);
-    });
-
-    it('can override the cpuacct group path', async () => {
-      setMockFiles({
-        '/proc/self/cgroup': fsStub.cGroupContents,
-        '/sys/fs/cgroup/cpuacct/docker/cpuacct.usage': '357753491408',
-        [`${fsStub.cpuDir}/cpu.cfs_period_us`]: '100000',
-        [`${fsStub.cpuDir}/cpu.cfs_quota_us`]: '5000',
-        [`${fsStub.cpuDir}/cpu.stat`]: fsStub.cpuStatContents,
-      });
-
-      const stats = await getAllStats({ cpuAcctPath: '/docker' });
-
-      expect(stats).toEqual({
-        cpuacct: {
-          control_group: '/docker',
-          usage_nanos: 357753491408,
-        },
-        cpu: {
-          control_group: `/${fsStub.hierarchy}`,
-          cfs_period_micros: 100000,
-          cfs_quota_micros: 5000,
-          stat: {
-            number_of_elapsed_periods: 0,
-            number_of_times_throttled: 10,
-            time_throttled_nanos: 20,
-          },
-        },
-      });
-    });
-
-    it('extracts control group stats', async () => {
-      setMockFiles(fsStub.files);
-      const stats = await getAllStats();
-
-      expect(stats).toEqual({
-        cpuacct: {
-          control_group: `/${fsStub.hierarchy}`,
-          usage_nanos: 357753491408,
-        },
-        cpu: {
-          control_group: `/${fsStub.hierarchy}`,
-          cfs_period_micros: 100000,
-          cfs_quota_micros: 5000,
-          stat: {
-            number_of_elapsed_periods: 0,
-            number_of_times_throttled: 10,
-            time_throttled_nanos: 20,
-          },
-        },
-      });
-    });
-
-    it('returns null when all files are missing', async () => {
-      setMockFiles();
-      const stats = await getAllStats();
-      expect(stats).toBeNull();
-    });
-
-    it('returns null if CPU accounting files are missing', async () => {
-      setMockFiles({
-        '/proc/self/cgroup': fsStub.cGroupContents,
-        [`${fsStub.cpuDir}/cpu.stat`]: fsStub.cpuStatContents,
-      });
-      const stats = await getAllStats();
-
-      expect(stats).toBeNull();
-    });
-
-    it('returns -1 stat values if cpuStat file is missing', async () => {
-      setMockFiles({
-        '/proc/self/cgroup': fsStub.cGroupContents,
-        [`${fsStub.cpuAcctDir}/cpuacct.usage`]: '357753491408',
-        [`${fsStub.cpuDir}/cpu.cfs_period_us`]: '100000',
-        [`${fsStub.cpuDir}/cpu.cfs_quota_us`]: '5000',
-      });
-      const stats = await getAllStats();
-
-      expect(stats).toEqual({
-        cpu: {
-          cfs_period_micros: 100000,
-          cfs_quota_micros: 5000,
-          control_group: `/${fsStub.hierarchy}`,
-          stat: {
-            number_of_elapsed_periods: -1,
-            number_of_times_throttled: -1,
-            time_throttled_nanos: -1,
-          },
-        },
-        cpuacct: {
-          control_group: `/${fsStub.hierarchy}`,
-          usage_nanos: 357753491408,
-        },
-      });
-    });
-  });
-});
diff --git a/src/legacy/server/status/lib/get_kibana_info_for_stats.js b/src/legacy/server/status/lib/get_kibana_info_for_stats.js
deleted file mode 100644
index 62628a2c40ff9..0000000000000
--- a/src/legacy/server/status/lib/get_kibana_info_for_stats.js
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { get } from 'lodash';
-
-const snapshotRegex = /-snapshot/i;
-
-/**
- * This provides a meta data attribute along with Kibana stats.
- *
- * @param {Object} kbnServer manager of Kibana services - see `src/legacy/server/kbn_server` in Kibana core
- * @param {Object} config Server config
- * @param {String} host Kibana host
- * @return {Object} The object containing a "kibana" field and source instance details.
- */
-export function getKibanaInfoForStats(server, kbnServer) {
-  const config = server.config();
-  const status = kbnServer.status.toJSON();
-
-  return {
-    uuid: config.get('server.uuid'),
-    name: config.get('server.name'),
-    index: config.get('kibana.index'),
-    host: config.get('server.host'),
-    locale: config.get('i18n.locale'),
-    transport_address: `${config.get('server.host')}:${config.get('server.port')}`,
-    version: kbnServer.version.replace(snapshotRegex, ''),
-    snapshot: snapshotRegex.test(kbnServer.version),
-    status: get(status, 'overall.state'),
-  };
-}
diff --git a/src/legacy/server/status/lib/get_os_info.js b/src/legacy/server/status/lib/get_os_info.js
deleted file mode 100644
index e3835fec34c88..0000000000000
--- a/src/legacy/server/status/lib/get_os_info.js
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import os from 'os';
-import getos from 'getos';
-import { promisify } from 'util';
-
-/**
- * Returns an object of OS information/
- */
-export async function getOSInfo() {
-  const osInfo = {
-    platform: os.platform(),
-    // Include the platform name in the release to avoid grouping unrelated platforms together.
-    // release 1.0 across windows, linux, and darwin don't mean anything useful.
-    platformRelease: `${os.platform()}-${os.release()}`,
-  };
-
-  // Get distribution information for linux
-  if (os.platform() === 'linux') {
-    try {
-      const distro = await promisify(getos)();
-      osInfo.distro = distro.dist;
-      // Include distro name in release for same reason as above.
-      osInfo.distroRelease = `${distro.dist}-${distro.release}`;
-    } catch (e) {
-      // ignore errors
-    }
-  }
-
-  return osInfo;
-}
diff --git a/src/legacy/server/status/lib/get_os_info.test.js b/src/legacy/server/status/lib/get_os_info.test.js
deleted file mode 100644
index 11af7e1588090..0000000000000
--- a/src/legacy/server/status/lib/get_os_info.test.js
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-jest.mock('os', () => ({
-  platform: jest.fn(),
-  release: jest.fn(),
-}));
-jest.mock('getos');
-
-import os from 'os';
-import getos from 'getos';
-
-import { getOSInfo } from './get_os_info';
-
-describe('getOSInfo', () => {
-  it('returns basic OS info on non-linux', async () => {
-    os.platform.mockImplementation(() => 'darwin');
-    os.release.mockImplementation(() => '1.0.0');
-
-    const osInfo = await getOSInfo();
-
-    expect(osInfo).toEqual({
-      platform: 'darwin',
-      platformRelease: 'darwin-1.0.0',
-    });
-  });
-
-  it('returns basic OS info and distro info on linux', async () => {
-    os.platform.mockImplementation(() => 'linux');
-    os.release.mockImplementation(() => '4.9.93-linuxkit-aufs');
-
-    // Mock getos response
-    getos.mockImplementation((cb) =>
-      cb(null, {
-        os: 'linux',
-        dist: 'Ubuntu Linux',
-        codename: 'precise',
-        release: '12.04',
-      })
-    );
-
-    const osInfo = await getOSInfo();
-
-    expect(osInfo).toEqual({
-      platform: 'linux',
-      platformRelease: 'linux-4.9.93-linuxkit-aufs',
-      // linux distro info
-      distro: 'Ubuntu Linux',
-      distroRelease: 'Ubuntu Linux-12.04',
-    });
-  });
-});
diff --git a/src/legacy/server/status/lib/metrics.js b/src/legacy/server/status/lib/metrics.js
deleted file mode 100644
index 478bf0829b1aa..0000000000000
--- a/src/legacy/server/status/lib/metrics.js
+++ /dev/null
@@ -1,146 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import os from 'os';
-import v8 from 'v8';
-import { get, isObject, merge } from 'lodash';
-import { keysToSnakeCaseShallow } from './case_conversion';
-import { getAllStats as cGroupStats } from './cgroup';
-import { getOSInfo } from './get_os_info';
-
-const requestDefaults = {
-  disconnects: 0,
-  statusCodes: {},
-  total: 0,
-};
-
-export class Metrics {
-  constructor(config, server) {
-    this.config = config;
-    this.server = server;
-    this.checkCGroupStats = true;
-  }
-
-  static getStubMetrics() {
-    return {
-      process: {
-        memory: {
-          heap: {},
-        },
-      },
-      os: {
-        cpu: {},
-        memory: {},
-      },
-      response_times: {},
-      requests: {},
-    };
-  }
-
-  async capture(hapiEvent) {
-    const timestamp = new Date().toISOString();
-    const event = await this.captureEvent(hapiEvent);
-    const cgroup = await this.captureCGroupsIfAvailable();
-
-    const metrics = {
-      last_updated: timestamp,
-      collection_interval_in_millis: this.config.get('ops.interval'),
-    };
-
-    return merge(metrics, event, cgroup);
-  }
-
-  async captureEvent(hapiEvent) {
-    const heapStats = v8.getHeapStatistics();
-    const port = this.config.get('server.port');
-    const avgInMillis = get(hapiEvent, ['responseTimes', port, 'avg']); // sadly, it's possible for this to be NaN
-    const maxInMillis = get(hapiEvent, ['responseTimes', port, 'max']);
-
-    return {
-      process: {
-        memory: {
-          heap: {
-            // https://nodejs.org/docs/latest-v8.x/api/process.html#process_process_memoryusage
-            total_in_bytes: get(hapiEvent, 'psmem.heapTotal'),
-            used_in_bytes: get(hapiEvent, 'psmem.heapUsed'),
-            size_limit: heapStats.heap_size_limit,
-          },
-          resident_set_size_in_bytes: get(hapiEvent, 'psmem.rss'),
-        },
-        event_loop_delay: get(hapiEvent, 'psdelay'),
-        pid: process.pid,
-        uptime_in_millis: process.uptime() * 1000,
-      },
-      os: {
-        load: {
-          '1m': get(hapiEvent, 'osload.0'),
-          '5m': get(hapiEvent, 'osload.1'),
-          '15m': get(hapiEvent, 'osload.2'),
-        },
-        memory: {
-          total_in_bytes: os.totalmem(),
-          free_in_bytes: os.freemem(),
-          used_in_bytes: get(hapiEvent, 'osmem.total') - get(hapiEvent, 'osmem.free'),
-        },
-        uptime_in_millis: os.uptime() * 1000,
-        ...(await getOSInfo()),
-      },
-      response_times: {
-        avg_in_millis: isNaN(avgInMillis) ? undefined : avgInMillis, // convert NaN to undefined
-        max_in_millis: maxInMillis,
-      },
-      requests: {
-        ...requestDefaults,
-        ...keysToSnakeCaseShallow(get(hapiEvent, ['requests', port])),
-      },
-      concurrent_connections: hapiEvent.concurrent_connections,
-    };
-  }
-
-  async captureCGroups() {
-    try {
-      const cgroup = await cGroupStats({
-        cpuPath: this.config.get('ops.cGroupOverrides.cpuPath'),
-        cpuAcctPath: this.config.get('ops.cGroupOverrides.cpuAcctPath'),
-      });
-
-      if (isObject(cgroup)) {
-        return {
-          os: {
-            cgroup,
-          },
-        };
-      }
-    } catch (e) {
-      this.server.log(['error', 'metrics', 'cgroup'], e);
-    }
-  }
-
-  async captureCGroupsIfAvailable() {
-    if (this.checkCGroupStats === true) {
-      const cgroup = await this.captureCGroups();
-
-      if (isObject(cgroup)) {
-        return cgroup;
-      }
-
-      this.checkCGroupStats = false;
-    }
-  }
-}
diff --git a/src/legacy/server/status/lib/metrics.test.js b/src/legacy/server/status/lib/metrics.test.js
deleted file mode 100644
index cc9c2607a2b59..0000000000000
--- a/src/legacy/server/status/lib/metrics.test.js
+++ /dev/null
@@ -1,245 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-jest.mock('fs', () => ({
-  readFile: jest.fn(),
-}));
-
-jest.mock('os', () => ({
-  freemem: jest.fn(),
-  totalmem: jest.fn(),
-  uptime: jest.fn(),
-  platform: jest.fn(),
-  release: jest.fn(),
-}));
-
-jest.mock('process', () => ({
-  uptime: jest.fn(),
-}));
-
-import fs from 'fs';
-import os from 'os';
-import _ from 'lodash';
-import sinon from 'sinon';
-import { cGroups as cGroupsFsStub, setMockFiles, readFileMock } from './__mocks__/_fs_stubs';
-import { Metrics } from './metrics';
-
-describe('Metrics', function () {
-  fs.readFile.mockImplementation(readFileMock);
-
-  const sampleConfig = {
-    ops: {
-      interval: 5000,
-    },
-    server: {
-      port: 5603,
-    },
-  };
-  const config = { get: (path) => _.get(sampleConfig, path) };
-
-  let metrics;
-
-  beforeEach(() => {
-    const server = { log: sinon.mock() };
-
-    metrics = new Metrics(config, server);
-  });
-
-  afterEach(() => {
-    setMockFiles();
-  });
-
-  describe('capture', () => {
-    it('merges all metrics', async () => {
-      setMockFiles();
-      sinon
-        .stub(metrics, 'captureEvent')
-        .returns({ a: [{ b: 2 }, { d: 4 }], process: { uptime_ms: 1980 } });
-      sinon.stub(metrics, 'captureCGroupsIfAvailable').returns({ a: [{ c: 3 }, { e: 5 }] });
-      sinon.stub(Date.prototype, 'toISOString').returns('2017-04-14T18:35:41.534Z');
-
-      const capturedMetrics = await metrics.capture();
-      expect(capturedMetrics).toMatchObject({
-        last_updated: '2017-04-14T18:35:41.534Z',
-        collection_interval_in_millis: 5000,
-        a: [
-          { b: 2, c: 3 },
-          { d: 4, e: 5 },
-        ],
-        process: { uptime_ms: 1980 },
-      });
-    });
-  });
-
-  describe('captureEvent', () => {
-    it('parses the hapi event', async () => {
-      sinon.stub(os, 'uptime').returns(12000);
-      sinon.stub(process, 'uptime').returns(5000);
-
-      os.freemem.mockImplementation(() => 12);
-      os.totalmem.mockImplementation(() => 24);
-
-      const pidMock = jest.fn();
-      pidMock.mockReturnValue(8675309);
-      Object.defineProperty(process, 'pid', { get: pidMock }); //
-
-      const hapiEvent = {
-        requests: { 5603: { total: 22, disconnects: 0, statusCodes: { 200: 22 } } },
-        responseTimes: { 5603: { avg: 1.8636363636363635, max: 4 } },
-        osload: [2.20751953125, 2.02294921875, 1.89794921875],
-        osmem: { total: 17179869184, free: 102318080 },
-        osup: 1008991,
-        psup: 7.168,
-        psmem: { rss: 193716224, heapTotal: 168194048, heapUsed: 130553400, external: 1779619 },
-        concurrent_connections: 0,
-        psdelay: 1.6091690063476562,
-        host: 'blahblah.local',
-      };
-
-      expect(await metrics.captureEvent(hapiEvent)).toMatchObject({
-        concurrent_connections: 0,
-        os: {
-          load: {
-            '15m': 1.89794921875,
-            '1m': 2.20751953125,
-            '5m': 2.02294921875,
-          },
-          memory: {
-            free_in_bytes: 12,
-            total_in_bytes: 24,
-          },
-          uptime_in_millis: 12000000,
-        },
-        process: {
-          memory: {
-            heap: {
-              total_in_bytes: 168194048,
-              used_in_bytes: 130553400,
-            },
-            resident_set_size_in_bytes: 193716224,
-          },
-          pid: 8675309,
-        },
-        requests: {
-          disconnects: 0,
-          total: 22,
-        },
-        response_times: {
-          avg_in_millis: 1.8636363636363635,
-          max_in_millis: 4,
-        },
-      });
-    });
-
-    it('parses event with missing fields / NaN for responseTimes.avg', async () => {
-      const hapiEvent = {
-        requests: {
-          5603: { total: 22, disconnects: 0, statusCodes: { 200: 22 } },
-        },
-        responseTimes: { 5603: { avg: NaN, max: 4 } },
-        host: 'blahblah.local',
-      };
-
-      expect(await metrics.captureEvent(hapiEvent)).toMatchObject({
-        process: { memory: { heap: {} }, pid: 8675309, uptime_in_millis: 5000000 },
-        os: {
-          load: {},
-          memory: { free_in_bytes: 12, total_in_bytes: 24 },
-        },
-        response_times: { max_in_millis: 4 },
-        requests: { total: 22, disconnects: 0 },
-      });
-    });
-  });
-
-  describe('captureCGroups', () => {
-    afterEach(() => {
-      setMockFiles();
-    });
-
-    it('returns undefined if cgroups do not exist', async () => {
-      setMockFiles();
-
-      const stats = await metrics.captureCGroups();
-
-      expect(stats).toBe(undefined);
-    });
-
-    it('returns cgroups', async () => {
-      const fsStub = cGroupsFsStub();
-      setMockFiles(fsStub.files);
-
-      const capturedMetrics = await metrics.captureCGroups();
-
-      expect(capturedMetrics).toMatchObject({
-        os: {
-          cgroup: {
-            cpuacct: {
-              control_group: `/${fsStub.hierarchy}`,
-              usage_nanos: 357753491408,
-            },
-            cpu: {
-              control_group: `/${fsStub.hierarchy}`,
-              cfs_period_micros: 100000,
-              cfs_quota_micros: 5000,
-              stat: {
-                number_of_elapsed_periods: 0,
-                number_of_times_throttled: 10,
-                time_throttled_nanos: 20,
-              },
-            },
-          },
-        },
-      });
-    });
-  });
-
-  describe('captureCGroupsIfAvailable', () => {
-    afterEach(() => {
-      setMockFiles();
-    });
-
-    it('marks cgroups as unavailable and prevents subsequent calls', async () => {
-      setMockFiles();
-      sinon.spy(metrics, 'captureCGroups');
-
-      expect(metrics.checkCGroupStats).toBe(true);
-
-      await metrics.captureCGroupsIfAvailable();
-      expect(metrics.checkCGroupStats).toBe(false);
-
-      await metrics.captureCGroupsIfAvailable();
-      sinon.assert.calledOnce(metrics.captureCGroups);
-    });
-
-    it('allows subsequent calls if cgroups are available', async () => {
-      const fsStub = cGroupsFsStub();
-      setMockFiles(fsStub.files);
-      sinon.spy(metrics, 'captureCGroups');
-
-      expect(metrics.checkCGroupStats).toBe(true);
-
-      await metrics.captureCGroupsIfAvailable();
-      expect(metrics.checkCGroupStats).toBe(true);
-
-      await metrics.captureCGroupsIfAvailable();
-      sinon.assert.calledTwice(metrics.captureCGroups);
-    });
-  });
-});
diff --git a/src/legacy/server/status/routes/api/register_stats.js b/src/legacy/server/status/routes/api/register_stats.js
deleted file mode 100644
index 2cd780d21f681..0000000000000
--- a/src/legacy/server/status/routes/api/register_stats.js
+++ /dev/null
@@ -1,164 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import Joi from 'joi';
-import boom from 'boom';
-import { defaultsDeep } from 'lodash';
-import { i18n } from '@kbn/i18n';
-import { wrapAuthConfig } from '../../wrap_auth_config';
-import { getKibanaInfoForStats } from '../../lib';
-
-const STATS_NOT_READY_MESSAGE = i18n.translate('server.stats.notReadyMessage', {
-  defaultMessage: 'Stats are not ready yet. Please try again later.',
-});
-
-/*
- * API for Kibana meta info and accumulated operations stats
- * Including ?extended in the query string fetches Elasticsearch cluster_uuid and usageCollection data
- *   - Requests to set isExtended = true
- *       GET /api/stats?extended=true
- *       GET /api/stats?extended
- *   - No value or 'false' is isExtended = false
- *   - Any other value causes a statusCode 400 response (Bad Request)
- * Including ?exclude_usage in the query string excludes the usage stats from the response. Same value semantics as ?extended
- */
-export function registerStatsApi(usageCollection, server, config, kbnServer) {
-  const wrapAuth = wrapAuthConfig(config.get('status.allowAnonymous'));
-
-  const getClusterUuid = async (callCluster) => {
-    const { cluster_uuid: uuid } = await callCluster('info', { filterPath: 'cluster_uuid' });
-    return uuid;
-  };
-
-  const getUsage = async (callCluster) => {
-    const usage = await usageCollection.bulkFetchUsage(callCluster);
-    return usageCollection.toObject(usage);
-  };
-
-  let lastMetrics = null;
-  /* kibana_stats gets singled out from the collector set as it is used
-   * for health-checking Kibana and fetch does not rely on fetching data
-   * from ES */
-  server.newPlatform.start.core.metrics.getOpsMetrics$().subscribe((metrics) => {
-    lastMetrics = {
-      ...metrics,
-      timestamp: new Date().toISOString(),
-    };
-  });
-
-  server.route(
-    wrapAuth({
-      method: 'GET',
-      path: '/api/stats',
-      config: {
-        validate: {
-          query: Joi.object({
-            extended: Joi.string().valid('', 'true', 'false'),
-            legacy: Joi.string().valid('', 'true', 'false'),
-            exclude_usage: Joi.string().valid('', 'true', 'false'),
-          }),
-        },
-        tags: ['api'],
-      },
-      async handler(req) {
-        const isExtended = req.query.extended !== undefined && req.query.extended !== 'false';
-        const isLegacy = req.query.legacy !== undefined && req.query.legacy !== 'false';
-        const shouldGetUsage =
-          req.query.exclude_usage === undefined || req.query.exclude_usage === 'false';
-
-        let extended;
-        if (isExtended) {
-          const { callWithRequest } = req.server.plugins.elasticsearch.getCluster('admin');
-          const callCluster = (...args) => callWithRequest(req, ...args);
-          const collectorsReady = await usageCollection.areAllCollectorsReady();
-
-          if (shouldGetUsage && !collectorsReady) {
-            return boom.serverUnavailable(STATS_NOT_READY_MESSAGE);
-          }
-
-          const usagePromise = shouldGetUsage ? getUsage(callCluster) : Promise.resolve({});
-          try {
-            const [usage, clusterUuid] = await Promise.all([
-              usagePromise,
-              getClusterUuid(callCluster),
-            ]);
-
-            let modifiedUsage = usage;
-            if (isLegacy) {
-              // In an effort to make telemetry more easily augmented, we need to ensure
-              // we can passthrough the data without every part of the process needing
-              // to know about the change; however, to support legacy use cases where this
-              // wasn't true, we need to be backwards compatible with how the legacy data
-              // looked and support those use cases here.
-              modifiedUsage = Object.keys(usage).reduce((accum, usageKey) => {
-                if (usageKey === 'kibana') {
-                  accum = {
-                    ...accum,
-                    ...usage[usageKey],
-                  };
-                } else if (usageKey === 'reporting') {
-                  accum = {
-                    ...accum,
-                    xpack: {
-                      ...accum.xpack,
-                      reporting: usage[usageKey],
-                    },
-                  };
-                } else {
-                  // I don't think we need to it this for the above conditions, but do it for most as it will
-                  // match the behavior done in monitoring/bulk_uploader
-                  defaultsDeep(accum, { [usageKey]: usage[usageKey] });
-                }
-
-                return accum;
-              }, {});
-
-              extended = {
-                usage: modifiedUsage,
-                clusterUuid,
-              };
-            } else {
-              extended = usageCollection.toApiFieldNames({
-                usage: modifiedUsage,
-                clusterUuid,
-              });
-            }
-          } catch (e) {
-            throw boom.boomify(e);
-          }
-        }
-
-        if (!lastMetrics) {
-          return boom.serverUnavailable(STATS_NOT_READY_MESSAGE);
-        }
-        const kibanaStats = usageCollection.toApiFieldNames({
-          ...lastMetrics,
-          kibana: getKibanaInfoForStats(server, kbnServer),
-          last_updated: new Date().toISOString(),
-          collection_interval_in_millis: config.get('ops.interval'),
-        });
-
-        return {
-          ...kibanaStats,
-          ...extended,
-        };
-      },
-    })
-  );
-}
diff --git a/src/legacy/server/status/routes/api/register_status.js b/src/legacy/server/status/routes/api/register_status.js
deleted file mode 100644
index 259a00667810f..0000000000000
--- a/src/legacy/server/status/routes/api/register_status.js
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { wrapAuthConfig } from '../../wrap_auth_config';
-
-const matchSnapshot = /-SNAPSHOT$/;
-
-export function registerStatusApi(kbnServer, server, config) {
-  const wrapAuth = wrapAuthConfig(config.get('status.allowAnonymous'));
-
-  server.route(
-    wrapAuth({
-      method: 'GET',
-      path: '/api/status',
-      config: {
-        tags: ['api'],
-      },
-      async handler() {
-        return {
-          name: config.get('server.name'),
-          uuid: config.get('server.uuid'),
-          version: {
-            number: config.get('pkg.version').replace(matchSnapshot, ''),
-            build_hash: config.get('pkg.buildSha'),
-            build_number: config.get('pkg.buildNum'),
-            build_snapshot: matchSnapshot.test(config.get('pkg.version')),
-          },
-          status: kbnServer.status.toJSON(),
-          metrics: kbnServer.metrics,
-        };
-      },
-    })
-  );
-}
diff --git a/src/legacy/server/status/samples.js b/src/legacy/server/status/samples.js
deleted file mode 100644
index 9c41e29945a77..0000000000000
--- a/src/legacy/server/status/samples.js
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-
-function Samples(max) {
-  this.vals = {};
-  this.max = max || Infinity;
-  this.length = 0;
-}
-
-Samples.prototype.add = function (sample) {
-  const vals = this.vals;
-  const length = (this.length = Math.min(this.length + 1, this.max));
-
-  _.forOwn(sample, function (val, name) {
-    if (val == null) val = null;
-
-    if (!vals[name]) vals[name] = new Array(length);
-    vals[name].unshift([Date.now(), val]);
-    vals[name].length = length;
-  });
-};
-
-Samples.prototype.toJSON = function () {
-  return this.vals;
-};
-
-export default Samples;
diff --git a/src/legacy/server/status/server_status.js b/src/legacy/server/status/server_status.js
deleted file mode 100644
index 81d07de55faaf..0000000000000
--- a/src/legacy/server/status/server_status.js
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-
-import * as states from './states';
-import Status from './status';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { pkg } from '../../../core/server/utils';
-
-export default class ServerStatus {
-  constructor(server) {
-    this.server = server;
-    this._created = {};
-  }
-
-  create(id) {
-    const status = new Status(id, this.server);
-    this._created[status.id] = status;
-    return status;
-  }
-
-  createForPlugin(plugin) {
-    if (plugin.version === 'kibana') plugin.version = pkg.version;
-    const status = this.create(`plugin:${plugin.id}@${plugin.version}`);
-    status.plugin = plugin;
-    return status;
-  }
-
-  each(fn) {
-    const self = this;
-    _.forOwn(self._created, function (status, i, list) {
-      if (status.state !== 'disabled') {
-        fn.call(self, status, i, list);
-      }
-    });
-  }
-
-  get(id) {
-    return this._created[id];
-  }
-
-  getForPluginId(pluginId) {
-    return _.find(this._created, (s) => s.plugin && s.plugin.id === pluginId);
-  }
-
-  getState(id) {
-    const status = this.get(id);
-    if (!status) return undefined;
-    return status.state || 'uninitialized';
-  }
-
-  getStateForPluginId(pluginId) {
-    const status = this.getForPluginId(pluginId);
-    if (!status) return undefined;
-    return status.state || 'uninitialized';
-  }
-
-  overall() {
-    const state = Object
-      // take all created status objects
-      .values(this._created)
-      // get the state descriptor for each status
-      .map((status) => states.get(status.state))
-      // reduce to the state with the highest severity, defaulting to green
-      .reduce((a, b) => (a.severity > b.severity ? a : b), states.get('green'));
-
-    const statuses = _.filter(this._created, { state: state.id });
-    const since = _.get(_.sortBy(statuses, 'since'), [0, 'since']);
-
-    return {
-      state: state.id,
-      title: state.title,
-      nickname: _.sample(state.nicknames),
-      icon: state.icon,
-      uiColor: states.get(state.id).uiColor,
-      since: since,
-    };
-  }
-
-  isGreen() {
-    return this.overall().state === 'green';
-  }
-
-  notGreen() {
-    return !this.isGreen();
-  }
-
-  toString() {
-    const overall = this.overall();
-    return `${overall.title} – ${overall.nickname}`;
-  }
-
-  toJSON() {
-    return {
-      overall: this.overall(),
-      statuses: _.values(this._created),
-    };
-  }
-}
diff --git a/src/legacy/server/status/server_status.test.js b/src/legacy/server/status/server_status.test.js
deleted file mode 100644
index bf94d693b1310..0000000000000
--- a/src/legacy/server/status/server_status.test.js
+++ /dev/null
@@ -1,145 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { find } from 'lodash';
-import sinon from 'sinon';
-
-import * as states from './states';
-import Status from './status';
-import ServerStatus from './server_status';
-
-describe('ServerStatus class', function () {
-  const plugin = { id: 'name', version: '1.2.3' };
-
-  let server;
-  let serverStatus;
-
-  beforeEach(function () {
-    server = { expose: sinon.stub(), logWithMetadata: sinon.stub() };
-    serverStatus = new ServerStatus(server);
-  });
-
-  describe('#create(id)', () => {
-    it('should create a new plugin with an id', () => {
-      const status = serverStatus.create('someid');
-      expect(status).toBeInstanceOf(Status);
-    });
-  });
-
-  describe('#createForPlugin(plugin)', function () {
-    it('should create a new status by plugin', function () {
-      const status = serverStatus.createForPlugin(plugin);
-      expect(status).toBeInstanceOf(Status);
-    });
-  });
-
-  describe('#get(id)', () => {
-    it('exposes statuses by their id', () => {
-      const status = serverStatus.create('statusid');
-      expect(serverStatus.get('statusid')).toBe(status);
-    });
-
-    it('does not get the status for a plugin', () => {
-      serverStatus.createForPlugin(plugin);
-      expect(serverStatus.get(plugin)).toBe(undefined);
-    });
-  });
-
-  describe('#getForPluginId(plugin)', function () {
-    it('exposes plugin status for the plugin', function () {
-      const status = serverStatus.createForPlugin(plugin);
-      expect(serverStatus.getForPluginId(plugin.id)).toBe(status);
-    });
-
-    it('does not get plain statuses by their id', function () {
-      serverStatus.create('someid');
-      expect(serverStatus.getForPluginId('someid')).toBe(undefined);
-    });
-  });
-
-  describe('#getState(id)', function () {
-    it('should expose the state of a status by id', function () {
-      const status = serverStatus.create('someid');
-      status.green();
-      expect(serverStatus.getState('someid')).toBe('green');
-    });
-  });
-
-  describe('#getStateForPluginId(plugin)', function () {
-    it('should expose the state of a plugin by id', function () {
-      const status = serverStatus.createForPlugin(plugin);
-      status.green();
-      expect(serverStatus.getStateForPluginId(plugin.id)).toBe('green');
-    });
-  });
-
-  describe('#overall()', function () {
-    it('considers each status to produce a summary', function () {
-      const status = serverStatus.createForPlugin(plugin);
-
-      expect(serverStatus.overall().state).toBe('uninitialized');
-
-      const match = function (overall, state) {
-        expect(overall).toHaveProperty('state', state.id);
-        expect(overall).toHaveProperty('title', state.title);
-        expect(overall).toHaveProperty('icon', state.icon);
-        expect(overall).toHaveProperty('uiColor', state.uiColor);
-        expect(state.nicknames).toContain(overall.nickname);
-      };
-
-      status.green();
-      match(serverStatus.overall(), states.get('green'));
-
-      status.yellow();
-      match(serverStatus.overall(), states.get('yellow'));
-
-      status.red();
-      match(serverStatus.overall(), states.get('red'));
-    });
-  });
-
-  describe('#toJSON()', function () {
-    it('serializes to overall status and individuals', function () {
-      const pluginOne = { id: 'one', version: '1.0.0' };
-      const pluginTwo = { id: 'two', version: '2.0.0' };
-      const pluginThree = { id: 'three', version: 'kibana' };
-
-      const service = serverStatus.create('some service');
-      const p1 = serverStatus.createForPlugin(pluginOne);
-      const p2 = serverStatus.createForPlugin(pluginTwo);
-      const p3 = serverStatus.createForPlugin(pluginThree);
-
-      service.green();
-      p1.yellow();
-      p2.red();
-
-      const json = JSON.parse(JSON.stringify(serverStatus));
-      expect(json).toHaveProperty('overall');
-      expect(json.overall.state).toEqual(serverStatus.overall().state);
-      expect(json.statuses).toHaveLength(4);
-
-      const out = (status) => find(json.statuses, { id: status.id });
-      expect(out(service)).toHaveProperty('state', 'green');
-      expect(out(p1)).toHaveProperty('state', 'yellow');
-      expect(out(p2)).toHaveProperty('state', 'red');
-      expect(out(p3)).toHaveProperty('id');
-      expect(out(p3).id).not.toContain('undefined');
-    });
-  });
-});
diff --git a/src/legacy/server/status/states.js b/src/legacy/server/status/states.js
deleted file mode 100644
index 4a34684571c3c..0000000000000
--- a/src/legacy/server/status/states.js
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import { i18n } from '@kbn/i18n';
-
-export const getAll = () => [
-  {
-    id: 'red',
-    title: i18n.translate('server.status.redTitle', {
-      defaultMessage: 'Red',
-    }),
-    icon: 'danger',
-    uiColor: 'danger',
-    severity: 1000,
-    nicknames: ['Danger Will Robinson! Danger!'],
-  },
-  {
-    id: 'uninitialized',
-    title: i18n.translate('server.status.uninitializedTitle', {
-      defaultMessage: 'Uninitialized',
-    }),
-    icon: 'spinner',
-    uiColor: 'default',
-    severity: 900,
-    nicknames: ['Initializing'],
-  },
-  {
-    id: 'yellow',
-    title: i18n.translate('server.status.yellowTitle', {
-      defaultMessage: 'Yellow',
-    }),
-    icon: 'warning',
-    uiColor: 'warning',
-    severity: 800,
-    nicknames: ['S.N.A.F.U', "I'll be back", 'brb'],
-  },
-  {
-    id: 'green',
-    title: i18n.translate('server.status.greenTitle', {
-      defaultMessage: 'Green',
-    }),
-    icon: 'success',
-    uiColor: 'secondary',
-    severity: 0,
-    nicknames: ['Looking good'],
-  },
-  {
-    id: 'disabled',
-    title: i18n.translate('server.status.disabledTitle', {
-      defaultMessage: 'Disabled',
-    }),
-    severity: -1,
-    icon: 'toggle-off',
-    uiColor: 'default',
-    nicknames: ['Am I even a thing?'],
-  },
-];
-
-export const getAllById = () => _.keyBy(exports.getAll(), 'id');
-
-export const defaults = {
-  icon: 'question',
-  severity: Infinity,
-};
-
-export function get(id) {
-  return exports.getAllById()[id] || _.defaults({ id: id }, exports.defaults);
-}
diff --git a/src/legacy/server/status/status.js b/src/legacy/server/status/status.js
deleted file mode 100644
index 10e94da3ac352..0000000000000
--- a/src/legacy/server/status/status.js
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import * as states from './states';
-import { EventEmitter } from 'events';
-
-export default class Status extends EventEmitter {
-  constructor(id, server) {
-    super();
-
-    if (!id || typeof id !== 'string') {
-      throw new TypeError('Status constructor requires an `id` string');
-    }
-
-    this.id = id;
-    this.since = new Date();
-    this.state = 'uninitialized';
-    this.message = 'uninitialized';
-
-    this.on('change', function (previous, previousMsg) {
-      this.since = new Date();
-
-      const tags = ['status', this.id, this.state === 'red' ? 'error' : 'info'];
-
-      server.logWithMetadata(
-        tags,
-        `Status changed from ${previous} to ${this.state}${
-          this.message ? ' - ' + this.message : ''
-        }`,
-        {
-          state: this.state,
-          message: this.message,
-          prevState: previous,
-          prevMsg: previousMsg,
-        }
-      );
-    });
-  }
-
-  toJSON() {
-    return {
-      id: this.id,
-      state: this.state,
-      icon: states.get(this.state).icon,
-      message: this.message,
-      uiColor: states.get(this.state).uiColor,
-      since: this.since,
-    };
-  }
-
-  on(eventName, handler) {
-    super.on(eventName, handler);
-
-    if (eventName === this.state) {
-      setImmediate(() => handler(this.state, this.message));
-    }
-  }
-
-  once(eventName, handler) {
-    if (eventName === this.state) {
-      setImmediate(() => handler(this.state, this.message));
-    } else {
-      super.once(eventName, handler);
-    }
-  }
-}
-
-states.getAll().forEach(function (state) {
-  Status.prototype[state.id] = function (message) {
-    if (this.state === 'disabled') return;
-
-    const previous = this.state;
-    const previousMsg = this.message;
-
-    this.error = null;
-    this.message = message || state.title;
-    this.state = state.id;
-
-    if (message instanceof Error) {
-      this.error = message;
-      this.message = message.message;
-    }
-
-    if (previous === this.state && previousMsg === this.message) {
-      // noop
-      return;
-    }
-
-    this.emit(state.id, previous, previousMsg, this.state, this.message);
-    this.emit('change', previous, previousMsg, this.state, this.message);
-  };
-});
diff --git a/src/legacy/server/status/status.test.js b/src/legacy/server/status/status.test.js
deleted file mode 100644
index def7b5a2182e1..0000000000000
--- a/src/legacy/server/status/status.test.js
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-import ServerStatus from './server_status';
-
-describe('Status class', function () {
-  const plugin = { id: 'test', version: '1.2.3' };
-
-  let server;
-  let serverStatus;
-
-  beforeEach(function () {
-    server = { expose: sinon.stub(), logWithMetadata: sinon.stub() };
-    serverStatus = new ServerStatus(server);
-  });
-
-  it('should have an "uninitialized" state initially', () => {
-    expect(serverStatus.createForPlugin(plugin)).toHaveProperty('state', 'uninitialized');
-  });
-
-  it('emits change when the status is set', function (done) {
-    const status = serverStatus.createForPlugin(plugin);
-
-    status.once('change', function (prevState, prevMsg, newState, newMsg) {
-      expect(newState).toBe('green');
-      expect(newMsg).toBe('GREEN');
-      expect(prevState).toBe('uninitialized');
-
-      status.once('change', function (prevState, prevMsg, newState, newMsg) {
-        expect(newState).toBe('red');
-        expect(newMsg).toBe('RED');
-        expect(prevState).toBe('green');
-        expect(prevMsg).toBe('GREEN');
-
-        done();
-      });
-
-      status.red('RED');
-    });
-
-    status.green('GREEN');
-  });
-
-  it('should only trigger the change listener when something changes', function () {
-    const status = serverStatus.createForPlugin(plugin);
-    const stub = sinon.stub();
-    status.on('change', stub);
-    status.green('Ready');
-    status.green('Ready');
-    status.red('Not Ready');
-    sinon.assert.calledTwice(stub);
-  });
-
-  it('should create a JSON representation of the status', function () {
-    const status = serverStatus.createForPlugin(plugin);
-    status.green('Ready');
-
-    const json = status.toJSON();
-    expect(json.id).toEqual(status.id);
-    expect(json.state).toEqual('green');
-    expect(json.message).toEqual('Ready');
-  });
-
-  it('should call on handler if status is already matched', function (done) {
-    const status = serverStatus.createForPlugin(plugin);
-    const msg = 'Test Ready';
-    status.green(msg);
-
-    status.on('green', function (prev, prevMsg) {
-      expect(arguments.length).toBe(2);
-      expect(prev).toBe('green');
-      expect(prevMsg).toBe(msg);
-      expect(status.message).toBe(msg);
-      done();
-    });
-  });
-
-  it('should call once handler if status is already matched', function (done) {
-    const status = serverStatus.createForPlugin(plugin);
-    const msg = 'Test Ready';
-    status.green(msg);
-
-    status.once('green', function (prev, prevMsg) {
-      expect(arguments.length).toBe(2);
-      expect(prev).toBe('green');
-      expect(prevMsg).toBe(msg);
-      expect(status.message).toBe(msg);
-      done();
-    });
-  });
-
-  function testState(color) {
-    it(`should change the state to ${color} when #${color}() is called`, function () {
-      const status = serverStatus.createForPlugin(plugin);
-      const message = 'testing ' + color;
-      status[color](message);
-      expect(status).toHaveProperty('state', color);
-      expect(status).toHaveProperty('message', message);
-    });
-
-    it(`should trigger the "change" listener when #${color}() is called`, function (done) {
-      const status = serverStatus.createForPlugin(plugin);
-      const message = 'testing ' + color;
-      status.on('change', function (prev, prevMsg) {
-        expect(status.state).toBe(color);
-        expect(status.message).toBe(message);
-
-        expect(prev).toBe('uninitialized');
-        expect(prevMsg).toBe('uninitialized');
-        done();
-      });
-      status[color](message);
-    });
-
-    it(`should trigger the "${color}" listener when #${color}() is called`, function (done) {
-      const status = serverStatus.createForPlugin(plugin);
-      const message = 'testing ' + color;
-      status.on(color, function () {
-        expect(status.state).toBe(color);
-        expect(status.message).toBe(message);
-        done();
-      });
-      status[color](message);
-    });
-  }
-
-  testState('green');
-  testState('yellow');
-  testState('red');
-});
diff --git a/src/legacy/server/status/wrap_auth_config.js b/src/legacy/server/status/wrap_auth_config.js
deleted file mode 100644
index 04e71a02d30de..0000000000000
--- a/src/legacy/server/status/wrap_auth_config.js
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { assign, identity } from 'lodash';
-
-export const wrapAuthConfig = (allowAnonymous) => {
-  if (allowAnonymous) {
-    return (options) => assign(options, { config: { auth: false } });
-  }
-  return identity;
-};
diff --git a/src/legacy/server/status/wrap_auth_config.test.js b/src/legacy/server/status/wrap_auth_config.test.js
deleted file mode 100644
index fa0230a96a587..0000000000000
--- a/src/legacy/server/status/wrap_auth_config.test.js
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { wrapAuthConfig } from './wrap_auth_config';
-
-describe('Status wrapAuthConfig', () => {
-  let options;
-
-  beforeEach(() => {
-    options = {
-      method: 'GET',
-      path: '/status',
-      handler: function (request, h) {
-        return h.response();
-      },
-    };
-  });
-
-  it('should return a function', () => {
-    expect(typeof wrapAuthConfig()).toBe('function');
-    expect(typeof wrapAuthConfig(true)).toBe('function');
-    expect(typeof wrapAuthConfig(false)).toBe('function');
-  });
-
-  it('should not add auth config by default', () => {
-    const wrapAuth = wrapAuthConfig();
-    const wrapped = wrapAuth(options);
-    expect(wrapped).not.toHaveProperty('config');
-  });
-
-  it('should not add auth config if allowAnonymous is false', () => {
-    const wrapAuth = wrapAuthConfig(false);
-    const wrapped = wrapAuth(options);
-    expect(wrapped).not.toHaveProperty('config');
-  });
-
-  it('should add auth config if allowAnonymous is true', () => {
-    const wrapAuth = wrapAuthConfig(true);
-    const wrapped = wrapAuth(options);
-    expect(wrapped).toHaveProperty('config');
-    expect(wrapped.config).toHaveProperty('auth');
-    expect(wrapped.config.auth).toBe(false);
-  });
-});
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.test.ts b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.test.ts
index c79c7900148ea..d3b3a73a4b50f 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.test.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.test.ts
@@ -113,15 +113,13 @@ describe('IndexPatterns', () => {
   test('caches saved objects', async () => {
     await indexPatterns.getIds();
     await indexPatterns.getTitles();
-    await indexPatterns.getFields(['id', 'title']);
     expect(savedObjectsClient.find).toHaveBeenCalledTimes(1);
   });
 
   test('can refresh the saved objects caches', async () => {
     await indexPatterns.getIds();
     await indexPatterns.getTitles(true);
-    await indexPatterns.getFields(['id', 'title'], true);
-    expect(savedObjectsClient.find).toHaveBeenCalledTimes(3);
+    expect(savedObjectsClient.find).toHaveBeenCalledTimes(2);
   });
 
   test('deletes the index pattern', async () => {
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
index 88a7e9f6cef4c..47484f8ec75bb 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
@@ -41,8 +41,6 @@ const indexPatternCache = createIndexPatternCache();
 const MAX_ATTEMPTS_TO_RESOLVE_CONFLICTS = 3;
 const savedObjectType = 'index-pattern';
 
-type IndexPatternCachedFieldType = 'id' | 'title';
-
 export interface IndexPatternSavedObjectAttrs {
   title: string;
 }
@@ -116,22 +114,6 @@ export class IndexPatternsService {
     return this.savedObjectsCache.map((obj) => obj?.attributes?.title);
   };
 
-  getFields = async (fields: IndexPatternCachedFieldType[], refresh: boolean = false) => {
-    if (!this.savedObjectsCache || refresh) {
-      await this.refreshSavedObjectsCache();
-    }
-    if (!this.savedObjectsCache) {
-      return [];
-    }
-    return this.savedObjectsCache.map((obj: Record<string, any>) => {
-      const result: Partial<Record<IndexPatternCachedFieldType, string>> = {};
-      fields.forEach(
-        (f: IndexPatternCachedFieldType) => (result[f] = obj[f] || obj?.attributes?.[f])
-      );
-      return result;
-    });
-  };
-
   getFieldsForTimePattern = (options: GetFieldsOptions = {}) => {
     return this.apiClient.getFieldsForTimePattern(options);
   };
diff --git a/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.test.ts b/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.test.ts
index fd788d3339295..d3a95b32cd425 100644
--- a/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.test.ts
@@ -139,6 +139,19 @@ describe('calculateHistogramInterval', () => {
           })
         ).toEqual(0.02);
       });
+
+      test('should correctly fallback to the default value for empty string', () => {
+        expect(
+          calculateHistogramInterval({
+            ...params,
+            maxBucketsUserInput: '',
+            values: {
+              min: 0.1,
+              max: 0.9,
+            },
+          })
+        ).toBe(0.01);
+      });
     });
   });
 });
diff --git a/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.ts b/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.ts
index f4e42fa8881ef..378340e876296 100644
--- a/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.ts
+++ b/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.ts
@@ -27,7 +27,7 @@ interface IntervalValuesRange {
 export interface CalculateHistogramIntervalParams {
   interval: string;
   maxBucketsUiSettings: number;
-  maxBucketsUserInput?: number;
+  maxBucketsUserInput?: number | '';
   intervalBase?: number;
   values?: IntervalValuesRange;
 }
@@ -77,12 +77,7 @@ const calculateForGivenInterval = (
      - The lower power of 10, times 2
      - The lower power of 10, times 5
  **/
-const calculateAutoInterval = (
-  diff: number,
-  maxBucketsUiSettings: CalculateHistogramIntervalParams['maxBucketsUiSettings'],
-  maxBucketsUserInput: CalculateHistogramIntervalParams['maxBucketsUserInput']
-) => {
-  const maxBars = Math.min(maxBucketsUiSettings, maxBucketsUserInput ?? maxBucketsUiSettings);
+const calculateAutoInterval = (diff: number, maxBars: number) => {
   const exactInterval = diff / maxBars;
 
   const lowerPower = Math.pow(10, Math.floor(Math.log10(exactInterval)));
@@ -122,7 +117,11 @@ export const calculateHistogramInterval = ({
 
     if (diff) {
       calculatedInterval = isAuto
-        ? calculateAutoInterval(diff, maxBucketsUiSettings, maxBucketsUserInput)
+        ? calculateAutoInterval(
+            diff,
+            // Mind maxBucketsUserInput can be an empty string, hence we need to ensure it here
+            Math.min(maxBucketsUiSettings, maxBucketsUserInput || maxBucketsUiSettings)
+          )
         : calculateForGivenInterval(diff, calculatedInterval, maxBucketsUiSettings);
     }
   }
diff --git a/src/plugins/data/public/ui/query_string_input/query_string_input.tsx b/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
index f159cac664a9e..8e1151b387fee 100644
--- a/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
+++ b/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
@@ -546,13 +546,16 @@ export class QueryStringInputUI extends Component<Props, State> {
     this.updateSuggestions.cancel();
     this.componentIsUnmounting = true;
     window.removeEventListener('resize', this.handleAutoHeight);
-    window.removeEventListener('scroll', this.handleListUpdate);
+    window.removeEventListener('scroll', this.handleListUpdate, { capture: true });
   }
 
-  handleListUpdate = () =>
-    this.setState({
+  handleListUpdate = () => {
+    if (this.componentIsUnmounting) return;
+
+    return this.setState({
       queryBarRect: this.queryBarInputDivRefInstance.current?.getBoundingClientRect(),
     });
+  };
 
   handleAutoHeight = () => {
     if (this.inputRef !== null && document.activeElement === this.inputRef) {
diff --git a/src/plugins/discover/public/application/_discover.scss b/src/plugins/discover/public/application/_discover.scss
index 69df2a75b8d75..bc704439d161b 100644
--- a/src/plugins/discover/public/application/_discover.scss
+++ b/src/plugins/discover/public/application/_discover.scss
@@ -5,6 +5,11 @@
   overflow: hidden;
 }
 
+.dscAppContainer {
+  > * {
+    position: relative;
+  }
+}
 discover-app {
   flex-grow: 1;
 }
@@ -17,9 +22,12 @@ discover-app {
 
 // SASSTODO: replace the z-index value with a variable
 .dscWrapper {
+  padding-left: $euiSizeXL;
   padding-right: $euiSizeS;
-  padding-left: 21px;
   z-index: 1;
+  @include euiBreakpoint('xs', 's', 'm') {
+    padding-left: $euiSizeS;
+  }
 }
 
 @include euiPanel('.dscWrapper__content');
@@ -104,14 +112,51 @@ discover-app {
   top: $euiSizeXS;
 }
 
-[fixed-scroll] {
+.dscTableFixedScroll {
   overflow-x: auto;
   padding-bottom: 0;
 
-  + .fixed-scroll-scroller {
+  + .dscTableFixedScroll__scroller {
     position: fixed;
     bottom: 0;
     overflow-x: auto;
     overflow-y: hidden;
   }
 }
+
+.dscCollapsibleSidebar {
+  position: relative;
+  z-index: $euiZLevel1;
+
+  .dscCollapsibleSidebar__collapseButton {
+    position: absolute;
+    top: 0;
+    right: -$euiSizeXL + 4;
+    cursor: pointer;
+    z-index: -1;
+    min-height: $euiSizeM;
+    min-width: $euiSizeM;
+    padding: $euiSizeXS * .5;
+  }
+
+  &.closed {
+    width: 0 !important;
+    border-right-width: 0;
+    border-left-width: 0;
+    .dscCollapsibleSidebar__collapseButton {
+      right: -$euiSizeL + 4;
+    }
+  }
+}
+
+@include euiBreakpoint('xs', 's', 'm') {
+  .dscCollapsibleSidebar {
+    &.closed {
+      display: none;
+    }
+
+    .dscCollapsibleSidebar__collapseButton {
+      display: none;
+    }
+  }
+}
diff --git a/src/plugins/discover/public/application/angular/directives/__snapshots__/no_results.test.js.snap b/src/plugins/discover/public/application/angular/directives/__snapshots__/no_results.test.js.snap
index e7aea41e2d08e..e69e10e29e801 100644
--- a/src/plugins/discover/public/application/angular/directives/__snapshots__/no_results.test.js.snap
+++ b/src/plugins/discover/public/application/angular/directives/__snapshots__/no_results.test.js.snap
@@ -167,132 +167,6 @@ Array [
 ]
 `;
 
-exports[`DiscoverNoResults props shardFailures doesn't render failures list when there are no failures 1`] = `
-Array [
-  <div
-    class="euiSpacer euiSpacer--xl"
-  />,
-  <div
-    class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
-  >
-    <div
-      class="euiFlexItem euiFlexItem--flexGrowZero dscNoResults"
-    >
-      <div
-        class="euiCallOut euiCallOut--warning"
-        data-test-subj="discoverNoResults"
-      >
-        <div
-          class="euiCallOutHeader"
-        >
-          <div
-            aria-hidden="true"
-            class="euiCallOutHeader__icon"
-            data-euiicon-type="help"
-          />
-          <span
-            class="euiCallOutHeader__title"
-          >
-            No results match your search criteria
-          </span>
-        </div>
-      </div>
-    </div>
-  </div>,
-]
-`;
-
-exports[`DiscoverNoResults props shardFailures renders failures list when there are failures 1`] = `
-Array [
-  <div
-    class="euiSpacer euiSpacer--xl"
-  />,
-  <div
-    class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
-  >
-    <div
-      class="euiFlexItem euiFlexItem--flexGrowZero dscNoResults"
-    >
-      <div
-        class="euiCallOut euiCallOut--warning"
-        data-test-subj="discoverNoResults"
-      >
-        <div
-          class="euiCallOutHeader"
-        >
-          <div
-            aria-hidden="true"
-            class="euiCallOutHeader__icon"
-            data-euiicon-type="help"
-          />
-          <span
-            class="euiCallOutHeader__title"
-          >
-            No results match your search criteria
-          </span>
-        </div>
-      </div>
-      <div
-        class="euiSpacer euiSpacer--xl"
-      />
-      <div
-        class="euiText euiText--medium"
-      >
-        <h3>
-          Address shard failures
-        </h3>
-        <p>
-          The following shard failures occurred:
-        </p>
-        <div>
-          <div
-            class="euiText euiText--extraSmall"
-          >
-            <strong>
-              Index &lsquo;A&rsquo;
-            </strong>
-            , shard &lsquo;1&rsquo;
-          </div>
-          <div
-            class="euiSpacer euiSpacer--s"
-          />
-          <div>
-            <pre>
-              <code>
-                {"reason":"Awful error"}
-              </code>
-            </pre>
-          </div>
-          <div
-            class="euiSpacer euiSpacer--l"
-          />
-        </div>
-        <div>
-          <div
-            class="euiText euiText--extraSmall"
-          >
-            <strong>
-              Index &lsquo;B&rsquo;
-            </strong>
-            , shard &lsquo;2&rsquo;
-          </div>
-          <div
-            class="euiSpacer euiSpacer--s"
-          />
-          <div>
-            <pre>
-              <code>
-                {"reason":"Bad error"}
-              </code>
-            </pre>
-          </div>
-        </div>
-      </div>
-    </div>
-  </div>,
-]
-`;
-
 exports[`DiscoverNoResults props timeFieldName renders time range feedback 1`] = `
 Array [
   <div
diff --git a/src/plugins/discover/public/application/angular/directives/_index.scss b/src/plugins/discover/public/application/angular/directives/_index.scss
index 2bfc74ffa0279..d4b365547b40c 100644
--- a/src/plugins/discover/public/application/angular/directives/_index.scss
+++ b/src/plugins/discover/public/application/angular/directives/_index.scss
@@ -1,3 +1,2 @@
 @import 'no_results';
 @import 'histogram';
-@import './collapsible_sidebar/index';
diff --git a/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/_collapsible_sidebar.scss b/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/_collapsible_sidebar.scss
deleted file mode 100644
index 68594cbe538cf..0000000000000
--- a/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/_collapsible_sidebar.scss
+++ /dev/null
@@ -1,44 +0,0 @@
-// SASSTODO: Can't rename main class
-// because it's also the name of the angular directive
-.collapsible-sidebar {
-  position: relative;
-  z-index: $kbnDiscoverSidebarDepth;
-
-  .kbnCollapsibleSidebar__collapseButton {
-    position: absolute;
-    top: 0;
-    right: -21px;
-    cursor: pointer;
-    z-index: -1;
-  }
-
-  &.closed {
-    width: 0 !important;
-    border-right-width: 0;
-    border-left-width: 0;
-
-    > * {
-      visibility: hidden;
-    }
-
-    .kbnCollapsibleSidebar__collapseButton {
-      visibility: visible;
-
-      .chevron-cont:before {
-        content: "\F138";
-      }
-    }
-  }
-}
-
-@include euiBreakpoint('xs', 's', 'm') {
-  .collapsible-sidebar {
-    &.closed {
-      display: none;
-    }
-
-    .kbnCollapsibleSidebar__collapseButton {
-      display: none;
-    }
-  }
-}
diff --git a/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/_depth.scss b/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/_depth.scss
deleted file mode 100644
index 4bc59001f9931..0000000000000
--- a/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/_depth.scss
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * 1. The local nav contains tooltips which should pop over the filter bar.
- * 2. The filter and local nav components should always appear above the dashboard grid items.
- * 3. The filter and local nav components should always appear above the discover content.
- * 4. The sidebar collapser button should appear above the main Discover content but below the top elements.
- * 5. Dragged panels in dashboard should always appear above other panels.
- */
-$kbnFilterBarDepth: 4; /* 1 */
-$kbnLocalNavDepth: 5; /* 1 */
-$kbnDashboardGridDepth: 1; /* 2 */
-$kbnDashboardDraggingGridDepth: 2; /* 5 */
-$kbnDiscoverWrapperDepth: 1; /* 3 */
-$kbnDiscoverSidebarDepth: 2; /* 4 */
diff --git a/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/_index.scss b/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/_index.scss
deleted file mode 100644
index 1409920d11aa7..0000000000000
--- a/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/_index.scss
+++ /dev/null
@@ -1,2 +0,0 @@
-@import 'depth';
-@import 'collapsible_sidebar';
diff --git a/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/collapsible_sidebar.ts b/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/collapsible_sidebar.ts
deleted file mode 100644
index 16fbb0af9f3fd..0000000000000
--- a/src/plugins/discover/public/application/angular/directives/collapsible_sidebar/collapsible_sidebar.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import $ from 'jquery';
-import { IScope } from 'angular';
-
-interface LazyScope extends IScope {
-  [key: string]: any;
-}
-
-export function CollapsibleSidebarProvider() {
-  // simply a list of all of all of angulars .col-md-* classes except 12
-  const listOfWidthClasses = _.times(11, function (i) {
-    return 'col-md-' + i;
-  });
-
-  return {
-    restrict: 'C',
-    link: ($scope: LazyScope, $elem: any) => {
-      let isCollapsed = false;
-      const $collapser = $(
-        `<button
-          data-test-subj="collapseSideBarButton"
-          type="button"
-          aria-expanded="true"
-          aria-label="Toggle sidebar"
-          class="kuiCollapseButton kbnCollapsibleSidebar__collapseButton"
-        ></button>`
-      );
-      // If the collapsable element has an id, also set aria-controls
-      if ($elem.attr('id')) {
-        $collapser.attr('aria-controls', $elem.attr('id'));
-      }
-      const $icon = $('<span class="kuiIcon fa-chevron-circle-left"></span>');
-      $collapser.append($icon);
-      const $siblings = $elem.siblings();
-
-      const siblingsClass = listOfWidthClasses.reduce((prev: string, className: string) => {
-        if (prev) return prev;
-        return $siblings.hasClass(className) && className;
-      }, '');
-
-      // If there is are only two elements we can assume the other one will take 100% of the width.
-      const hasSingleSibling = $siblings.length === 1 && siblingsClass;
-
-      $collapser.on('click', function () {
-        if (isCollapsed) {
-          isCollapsed = false;
-          $elem.removeClass('closed');
-          $icon.addClass('fa-chevron-circle-left');
-          $icon.removeClass('fa-chevron-circle-right');
-          $collapser.attr('aria-expanded', 'true');
-        } else {
-          isCollapsed = true;
-          $elem.addClass('closed');
-          $icon.removeClass('fa-chevron-circle-left');
-          $icon.addClass('fa-chevron-circle-right');
-          $collapser.attr('aria-expanded', 'false');
-        }
-
-        if (hasSingleSibling) {
-          $siblings.toggleClass(siblingsClass + ' col-md-12');
-        }
-
-        if ($scope.toggleSidebar) $scope.toggleSidebar();
-      });
-
-      $collapser.appendTo($elem);
-    },
-  };
-}
diff --git a/src/plugins/discover/public/application/angular/directives/debounce/debounce.js b/src/plugins/discover/public/application/angular/directives/debounce/debounce.js
index 586e8ed4fab59..8ce2b042c0efe 100644
--- a/src/plugins/discover/public/application/angular/directives/debounce/debounce.js
+++ b/src/plugins/discover/public/application/angular/directives/debounce/debounce.js
@@ -21,7 +21,7 @@ import _ from 'lodash';
 // Debounce service, angularized version of lodash debounce
 // borrowed heavily from https://github.com/shahata/angular-debounce
 
-export function DebounceProviderTimeout($timeout) {
+export function createDebounceProviderTimeout($timeout) {
   return function (func, wait, options) {
     let timeout;
     let args;
@@ -66,7 +66,3 @@ export function DebounceProviderTimeout($timeout) {
     return debounce;
   };
 }
-
-export function DebounceProvider(debounce) {
-  return debounce;
-}
diff --git a/src/plugins/discover/public/application/angular/directives/debounce/debounce.test.ts b/src/plugins/discover/public/application/angular/directives/debounce/debounce.test.ts
index ccdee153002e4..0cdc214cf97f5 100644
--- a/src/plugins/discover/public/application/angular/directives/debounce/debounce.test.ts
+++ b/src/plugins/discover/public/application/angular/directives/debounce/debounce.test.ts
@@ -24,7 +24,7 @@ import 'angular-sanitize';
 import 'angular-route';
 
 // @ts-ignore
-import { DebounceProvider } from './index';
+import { createDebounceProviderTimeout } from './debounce';
 import { coreMock } from '../../../../../../../core/public/mocks';
 import { initializeInnerAngularModule } from '../../../../get_inner_angular';
 import { navigationPluginMock } from '../../../../../../navigation/public/mocks';
@@ -33,7 +33,6 @@ import { initAngularBootstrap } from '../../../../../../kibana_legacy/public';
 
 describe('debounce service', function () {
   let debounce: (fn: () => void, timeout: number, options?: any) => any;
-  let debounceFromProvider: (fn: () => void, timeout: number, options?: any) => any;
   let $timeout: ITimeoutService;
   let spy: SinonSpy;
 
@@ -51,22 +50,17 @@ describe('debounce service', function () {
 
     angular.mock.module('app/discover');
 
-    angular.mock.inject(
-      ($injector: auto.IInjectorService, _$timeout_: ITimeoutService, Private: any) => {
-        $timeout = _$timeout_;
+    angular.mock.inject(($injector: auto.IInjectorService, _$timeout_: ITimeoutService) => {
+      $timeout = _$timeout_;
 
-        debounce = $injector.get('debounce');
-        debounceFromProvider = Private(DebounceProvider);
-      }
-    );
+      debounce = createDebounceProviderTimeout($timeout);
+    });
   });
 
   it('should have a cancel method', function () {
     const bouncer = debounce(() => {}, 100);
-    const bouncerFromProvider = debounceFromProvider(() => {}, 100);
 
     expect(bouncer).toHaveProperty('cancel');
-    expect(bouncerFromProvider).toHaveProperty('cancel');
   });
 
   describe('delayed execution', function () {
@@ -77,7 +71,6 @@ describe('debounce service', function () {
 
     it('should delay execution', function () {
       const bouncer = debounce(spy, 100);
-      const bouncerFromProvider = debounceFromProvider(spy, 100);
 
       bouncer();
       sinon.assert.notCalled(spy);
@@ -85,16 +78,10 @@ describe('debounce service', function () {
       sinon.assert.calledOnce(spy);
 
       spy.resetHistory();
-
-      bouncerFromProvider();
-      sinon.assert.notCalled(spy);
-      $timeout.flush();
-      sinon.assert.calledOnce(spy);
     });
 
     it('should fire on leading edge', function () {
       const bouncer = debounce(spy, 100, { leading: true });
-      const bouncerFromProvider = debounceFromProvider(spy, 100, { leading: true });
 
       bouncer();
       sinon.assert.calledOnce(spy);
@@ -102,19 +89,10 @@ describe('debounce service', function () {
       sinon.assert.calledTwice(spy);
 
       spy.resetHistory();
-
-      bouncerFromProvider();
-      sinon.assert.calledOnce(spy);
-      $timeout.flush();
-      sinon.assert.calledTwice(spy);
     });
 
     it('should only fire on leading edge', function () {
       const bouncer = debounce(spy, 100, { leading: true, trailing: false });
-      const bouncerFromProvider = debounceFromProvider(spy, 100, {
-        leading: true,
-        trailing: false,
-      });
 
       bouncer();
       sinon.assert.calledOnce(spy);
@@ -122,17 +100,11 @@ describe('debounce service', function () {
       sinon.assert.calledOnce(spy);
 
       spy.resetHistory();
-
-      bouncerFromProvider();
-      sinon.assert.calledOnce(spy);
-      $timeout.flush();
-      sinon.assert.calledOnce(spy);
     });
 
     it('should reset delayed execution', function () {
       const cancelSpy = sinon.spy($timeout, 'cancel');
       const bouncer = debounce(spy, 100);
-      const bouncerFromProvider = debounceFromProvider(spy, 100);
 
       bouncer();
       sandbox.clock.tick(1);
@@ -145,15 +117,6 @@ describe('debounce service', function () {
 
       spy.resetHistory();
       cancelSpy.resetHistory();
-
-      bouncerFromProvider();
-      sandbox.clock.tick(1);
-
-      bouncerFromProvider();
-      sinon.assert.notCalled(spy);
-      $timeout.flush();
-      sinon.assert.calledOnce(spy);
-      sinon.assert.calledOnce(cancelSpy);
     });
   });
 
@@ -161,7 +124,6 @@ describe('debounce service', function () {
     it('should cancel the $timeout', function () {
       const cancelSpy = sinon.spy($timeout, 'cancel');
       const bouncer = debounce(spy, 100);
-      const bouncerFromProvider = debounceFromProvider(spy, 100);
 
       bouncer();
       bouncer.cancel();
@@ -170,12 +132,6 @@ describe('debounce service', function () {
       $timeout.verifyNoPendingTasks();
 
       cancelSpy.resetHistory();
-
-      bouncerFromProvider();
-      bouncerFromProvider.cancel();
-      sinon.assert.calledOnce(cancelSpy);
-      // throws if pending timeouts
-      $timeout.verifyNoPendingTasks();
     });
   });
 });
diff --git a/src/plugins/discover/public/application/angular/directives/debounce/index.js b/src/plugins/discover/public/application/angular/directives/debounce/index.js
index 35b8339263626..3c51895f19828 100644
--- a/src/plugins/discover/public/application/angular/directives/debounce/index.js
+++ b/src/plugins/discover/public/application/angular/directives/debounce/index.js
@@ -17,6 +17,4 @@
  * under the License.
  */
 
-import './debounce';
-
-export { DebounceProvider } from './debounce';
+export { createDebounceProviderTimeout } from './debounce';
diff --git a/src/plugins/discover/public/application/angular/directives/fixed_scroll.js b/src/plugins/discover/public/application/angular/directives/fixed_scroll.js
index 182b4aeca9a23..e2d5f10a0faf7 100644
--- a/src/plugins/discover/public/application/angular/directives/fixed_scroll.js
+++ b/src/plugins/discover/public/application/angular/directives/fixed_scroll.js
@@ -19,7 +19,7 @@
 
 import $ from 'jquery';
 import _ from 'lodash';
-import { DebounceProvider } from './debounce';
+import { createDebounceProviderTimeout } from './debounce';
 
 const SCROLLER_HEIGHT = 20;
 
@@ -28,124 +28,128 @@ const SCROLLER_HEIGHT = 20;
  * to the target element's real scrollbar. This is useful when the target element's horizontal scrollbar
  * might be waaaay down the page, like the doc table on Discover.
  */
-export function FixedScrollProvider(Private) {
-  const debounce = Private(DebounceProvider);
-
+export function FixedScrollProvider($timeout) {
   return {
     restrict: 'A',
     link: function ($scope, $el) {
-      let $window = $(window);
-      let $scroller = $('<div class="fixed-scroll-scroller">').height(SCROLLER_HEIGHT);
-
-      /**
-       * Remove the listeners bound in listen()
-       * @type {function}
-       */
-      let unlisten = _.noop;
-
-      /**
-       * Listen for scroll events on the $scroller and the $el, sets unlisten()
-       *
-       * unlisten must be called before calling or listen() will throw an Error
-       *
-       * Since the browser emits "scroll" events after setting scrollLeft
-       * the listeners also prevent tug-of-war
-       *
-       * @throws {Error} If unlisten was not called first
-       * @return {undefined}
-       */
-      function listen() {
-        if (unlisten !== _.noop) {
-          throw new Error(
-            'fixedScroll listeners were not cleaned up properly before re-listening!'
-          );
-        }
-
-        let blockTo;
-        function bind($from, $to) {
-          function handler() {
-            if (blockTo === $to) return (blockTo = null);
-            $to.scrollLeft((blockTo = $from).scrollLeft());
-          }
-
-          $from.on('scroll', handler);
-          return function () {
-            $from.off('scroll', handler);
-          };
-        }
-
-        unlisten = _.flow(bind($el, $scroller), bind($scroller, $el), function () {
-          unlisten = _.noop;
-        });
-      }
-
-      /**
-       * Revert DOM changes and event listeners
-       * @return {undefined}
-       */
-      function cleanUp() {
-        unlisten();
-        $scroller.detach();
-        $el.css('padding-bottom', 0);
-      }
-
-      /**
-       * Modify the DOM and attach event listeners based on need.
-       * Is called many times to re-setup, must be idempotent
-       * @return {undefined}
-       */
-      function setup() {
-        cleanUp();
-
-        const containerWidth = $el.width();
-        const contentWidth = $el.prop('scrollWidth');
-        const containerHorizOverflow = contentWidth - containerWidth;
-
-        const elTop = $el.offset().top - $window.scrollTop();
-        const elBottom = elTop + $el.height();
-        const windowVertOverflow = elBottom - $window.height();
-
-        const requireScroller = containerHorizOverflow > 0 && windowVertOverflow > 0;
-        if (!requireScroller) return;
-
-        // push the content away from the scroller
-        $el.css('padding-bottom', SCROLLER_HEIGHT);
-
-        // fill the scroller with a dummy element that mimics the content
-        $scroller
-          .width(containerWidth)
-          .html($('<div>').css({ width: contentWidth, height: SCROLLER_HEIGHT }))
-          .insertAfter($el);
+      return createFixedScroll($scope, $timeout)($el);
+    },
+  };
+}
 
-        // listen for scroll events
-        listen();
+export function createFixedScroll($scope, $timeout) {
+  const debounce = createDebounceProviderTimeout($timeout);
+  return function (el) {
+    const $el = typeof el.css === 'function' ? el : $(el);
+    let $window = $(window);
+    let $scroller = $('<div class="dscTableFixedScroll__scroller">').height(SCROLLER_HEIGHT);
+
+    /**
+     * Remove the listeners bound in listen()
+     * @type {function}
+     */
+    let unlisten = _.noop;
+
+    /**
+     * Listen for scroll events on the $scroller and the $el, sets unlisten()
+     *
+     * unlisten must be called before calling or listen() will throw an Error
+     *
+     * Since the browser emits "scroll" events after setting scrollLeft
+     * the listeners also prevent tug-of-war
+     *
+     * @throws {Error} If unlisten was not called first
+     * @return {undefined}
+     */
+    function listen() {
+      if (unlisten !== _.noop) {
+        throw new Error('fixedScroll listeners were not cleaned up properly before re-listening!');
       }
 
-      let width;
-      let scrollWidth;
-      function checkWidth() {
-        const newScrollWidth = $el.prop('scrollWidth');
-        const newWidth = $el.width();
-
-        if (scrollWidth !== newScrollWidth || width !== newWidth) {
-          $scope.$apply(setup);
-
-          scrollWidth = newScrollWidth;
-          width = newWidth;
+      let blockTo;
+      function bind($from, $to) {
+        function handler() {
+          if (blockTo === $to) return (blockTo = null);
+          $to.scrollLeft((blockTo = $from).scrollLeft());
         }
-      }
 
-      const debouncedCheckWidth = debounce(checkWidth, 100, {
-        invokeApply: false,
-      });
-      $scope.$watch(debouncedCheckWidth);
+        $from.on('scroll', handler);
+        return function () {
+          $from.off('scroll', handler);
+        };
+      }
 
-      // cleanup when the scope is destroyed
-      $scope.$on('$destroy', function () {
-        cleanUp();
-        debouncedCheckWidth.cancel();
-        $scroller = $window = null;
+      unlisten = _.flow(bind($el, $scroller), bind($scroller, $el), function () {
+        unlisten = _.noop;
       });
-    },
+    }
+
+    /**
+     * Revert DOM changes and event listeners
+     * @return {undefined}
+     */
+    function cleanUp() {
+      unlisten();
+      $scroller.detach();
+      $el.css('padding-bottom', 0);
+    }
+
+    /**
+     * Modify the DOM and attach event listeners based on need.
+     * Is called many times to re-setup, must be idempotent
+     * @return {undefined}
+     */
+    function setup() {
+      cleanUp();
+
+      const containerWidth = $el.width();
+      const contentWidth = $el.prop('scrollWidth');
+      const containerHorizOverflow = contentWidth - containerWidth;
+
+      const elTop = $el.offset().top - $window.scrollTop();
+      const elBottom = elTop + $el.height();
+      const windowVertOverflow = elBottom - $window.height();
+
+      const requireScroller = containerHorizOverflow > 0 && windowVertOverflow > 0;
+      if (!requireScroller) return;
+
+      // push the content away from the scroller
+      $el.css('padding-bottom', SCROLLER_HEIGHT);
+
+      // fill the scroller with a dummy element that mimics the content
+      $scroller
+        .width(containerWidth)
+        .html($('<div>').css({ width: contentWidth, height: SCROLLER_HEIGHT }))
+        .insertAfter($el);
+
+      // listen for scroll events
+      listen();
+    }
+
+    let width;
+    let scrollWidth;
+    function checkWidth() {
+      const newScrollWidth = $el.prop('scrollWidth');
+      const newWidth = $el.width();
+
+      if (scrollWidth !== newScrollWidth || width !== newWidth) {
+        $scope.$apply(setup);
+
+        scrollWidth = newScrollWidth;
+        width = newWidth;
+      }
+    }
+
+    const debouncedCheckWidth = debounce(checkWidth, 100, {
+      invokeApply: false,
+    });
+    $scope.$watch(debouncedCheckWidth);
+
+    function destroy() {
+      cleanUp();
+      debouncedCheckWidth.cancel();
+      $scroller = $window = null;
+    }
+    return destroy;
   };
 }
diff --git a/src/plugins/discover/public/application/angular/directives/fixed_scroll.test.js b/src/plugins/discover/public/application/angular/directives/fixed_scroll.test.js
index 65255d6c0c4a4..e44bb45cf2431 100644
--- a/src/plugins/discover/public/application/angular/directives/fixed_scroll.test.js
+++ b/src/plugins/discover/public/application/angular/directives/fixed_scroll.test.js
@@ -23,17 +23,12 @@ import $ from 'jquery';
 
 import sinon from 'sinon';
 
-import { PrivateProvider, initAngularBootstrap } from '../../../../../kibana_legacy/public';
+import { initAngularBootstrap } from '../../../../../kibana_legacy/public';
 import { FixedScrollProvider } from './fixed_scroll';
-import { DebounceProviderTimeout } from './debounce/debounce';
 
 const testModuleName = 'fixedScroll';
 
-angular
-  .module(testModuleName, [])
-  .provider('Private', PrivateProvider)
-  .service('debounce', ['$timeout', DebounceProviderTimeout])
-  .directive('fixedScroll', FixedScrollProvider);
+angular.module(testModuleName, []).directive('fixedScroll', FixedScrollProvider);
 
 describe('FixedScroll directive', function () {
   const sandbox = sinon.createSandbox();
@@ -127,7 +122,7 @@ describe('FixedScroll directive', function () {
         return {
           $container: $el,
           $content: $content,
-          $scroller: $parent.find('.fixed-scroll-scroller'),
+          $scroller: $parent.find('.dscTableFixedScroll__scroller'),
         };
       };
     });
diff --git a/src/plugins/discover/public/application/angular/directives/no_results.js b/src/plugins/discover/public/application/angular/directives/no_results.js
index 965c1271c2f2c..d8a39d9178e93 100644
--- a/src/plugins/discover/public/application/angular/directives/no_results.js
+++ b/src/plugins/discover/public/application/angular/directives/no_results.js
@@ -24,7 +24,6 @@ import PropTypes from 'prop-types';
 import {
   EuiCallOut,
   EuiCode,
-  EuiCodeBlock,
   EuiDescriptionList,
   EuiFlexGroup,
   EuiFlexItem,
@@ -37,72 +36,12 @@ import { getServices } from '../../../kibana_services';
 // eslint-disable-next-line react/prefer-stateless-function
 export class DiscoverNoResults extends Component {
   static propTypes = {
-    shardFailures: PropTypes.array,
     timeFieldName: PropTypes.string,
     queryLanguage: PropTypes.string,
   };
 
   render() {
-    const { shardFailures, timeFieldName, queryLanguage } = this.props;
-
-    let shardFailuresMessage;
-
-    if (shardFailures && shardFailures.length) {
-      const failures = shardFailures.map((failure, index) => (
-        <div key={`${failure.index}${failure.shard}${failure.reason}`}>
-          <EuiText size="xs">
-            <FormattedMessage
-              id="discover.noResults.indexFailureShardText"
-              defaultMessage="{index}, shard {failureShard}"
-              values={{
-                index: (
-                  <strong>
-                    <FormattedMessage
-                      id="discover.noResults.indexFailureIndexText"
-                      defaultMessage="Index {failureIndex}"
-                      values={{
-                        failureIndex: `&lsquo;${failure.index}&rsquo;`,
-                      }}
-                    />
-                  </strong>
-                ),
-                failureShard: `&lsquo;${failure.shard}&rsquo;`,
-              }}
-            />
-          </EuiText>
-
-          <EuiSpacer size="s" />
-
-          <EuiCodeBlock paddingSize="s">{JSON.stringify(failure.reason)}</EuiCodeBlock>
-
-          {index < shardFailures.length - 1 ? <EuiSpacer size="l" /> : undefined}
-        </div>
-      ));
-
-      shardFailuresMessage = (
-        <Fragment>
-          <EuiSpacer size="xl" />
-
-          <EuiText>
-            <h3>
-              <FormattedMessage
-                id="discover.noResults.addressShardFailuresTitle"
-                defaultMessage="Address shard failures"
-              />
-            </h3>
-
-            <p>
-              <FormattedMessage
-                id="discover.noResults.shardFailuresDescription"
-                defaultMessage="The following shard failures occurred:"
-              />
-            </p>
-
-            {failures}
-          </EuiText>
-        </Fragment>
-      );
-    }
+    const { timeFieldName, queryLanguage } = this.props;
 
     let timeFieldMessage;
 
@@ -264,8 +203,6 @@ export class DiscoverNoResults extends Component {
                 iconType="help"
                 data-test-subj="discoverNoResults"
               />
-
-              {shardFailuresMessage}
               {timeFieldMessage}
               {luceneQueryMessage}
             </EuiFlexItem>
diff --git a/src/plugins/discover/public/application/angular/directives/no_results.test.js b/src/plugins/discover/public/application/angular/directives/no_results.test.js
index 7de792c612993..60c50048a39ef 100644
--- a/src/plugins/discover/public/application/angular/directives/no_results.test.js
+++ b/src/plugins/discover/public/application/angular/directives/no_results.test.js
@@ -42,35 +42,6 @@ beforeEach(() => {
 
 describe('DiscoverNoResults', () => {
   describe('props', () => {
-    describe('shardFailures', () => {
-      test('renders failures list when there are failures', () => {
-        const shardFailures = [
-          {
-            index: 'A',
-            shard: '1',
-            reason: { reason: 'Awful error' },
-          },
-          {
-            index: 'B',
-            shard: '2',
-            reason: { reason: 'Bad error' },
-          },
-        ];
-
-        const component = renderWithIntl(<DiscoverNoResults shardFailures={shardFailures} />);
-
-        expect(component).toMatchSnapshot();
-      });
-
-      test(`doesn't render failures list when there are no failures`, () => {
-        const shardFailures = [];
-
-        const component = renderWithIntl(<DiscoverNoResults shardFailures={shardFailures} />);
-
-        expect(component).toMatchSnapshot();
-      });
-    });
-
     describe('timeFieldName', () => {
       test('renders time range feedback', () => {
         const component = renderWithIntl(<DiscoverNoResults timeFieldName="awesome_time_field" />);
diff --git a/src/plugins/discover/public/application/angular/discover.html b/src/plugins/discover/public/application/angular/discover.html
deleted file mode 100644
index e0e452aaa41c5..0000000000000
--- a/src/plugins/discover/public/application/angular/discover.html
+++ /dev/null
@@ -1,160 +0,0 @@
-<discover-app class="app-container" data-fetch-counter="{{fetchCounter}}">
-  <h1 class="euiScreenReaderOnly">{{screenTitle}}</h1>
-
-  <!-- Local nav. -->
-  <kbn-top-nav
-    app-name="'discover'"
-    config="topNavMenu"
-    set-menu-mount-point="setHeaderActionMenu"
-    index-patterns="[indexPattern]"
-    on-query-submit="handleRefresh"
-    on-saved-query-id-change="updateSavedQueryId"
-    saved-query-id="state.savedQuery"
-    screen-title="screenTitle"
-    show-date-picker="indexPattern.isTimeBased()"
-    show-save-query="showSaveQuery"
-    show-search-bar="true"
-    use-default-behaviors="true"
-  >
-  </kbn-top-nav>
-
-  <main class="container-fluid">
-    <div class="row">
-      <div class="col-md-2 dscSidebar__container collapsible-sidebar" id="discover-sidebar" data-test-subj="discover-sidebar">
-        <div class="dscFieldChooser">
-          <discover-sidebar
-            columns="state.columns"
-            field-counts="fieldCounts"
-            hits="rows"
-            index-pattern-list="opts.indexPatternList"
-            on-add-field="addColumn"
-            on-add-filter="filterQuery"
-            on-remove-field="removeColumn"
-            selected-index-pattern="searchSource.getField('index')"
-            set-index-pattern="setIndexPattern"
-          >
-          </discover-sidebar>
-        </div>
-      </div>
-
-      <div class="dscWrapper col-md-10">
-        <discover-no-results
-          ng-show="resultState === 'none'"
-          shard-failures="failures"
-          time-field-name="opts.timefield"
-          query-language="state.query.language"
-          get-doc-link="getDocLink"
-        ></discover-no-results>
-
-        <discover-uninitialized
-          ng-show="resultState === 'uninitialized'"
-          on-refresh="fetch"
-        ></discover-uninitialized>
-
-        <!-- loading -->
-        <div ng-show="resultState === 'loading'">
-          <discover-fetch-error
-            ng-show="fetchError"
-            fetch-error="fetchError"
-          ></discover-fetch-error>
-
-          <loading-spinner ng-hide="fetchError" class="dscOverlay"></loading-spinner>
-        </div>
-
-        <div class="dscWrapper__content" ng-show="resultState === 'ready'">
-          <!-- result -->
-          <div class="dscResults">
-            <skip-bottom-button on-click="onSkipBottomButtonClick"></skip-bottom-button>
-
-            <hits-counter
-              hits="hits || 0"
-              show-reset-button="opts.savedSearch.id"
-              on-reset-query="resetQuery"
-            >
-            </hits-counter>
-
-            <section
-              aria-label="{{::'discover.histogramOfFoundDocumentsAriaLabel' | i18n: {defaultMessage: 'Histogram of found documents'} }}"
-              class="dscTimechart"
-              ng-if="opts.timefield"
-            >
-              <timechart-header
-                from="toMoment(timeRange.from)"
-                to="toMoment(timeRange.to)"
-                options="intervalOptions"
-                on-change-interval="changeInterval"
-                state-interval="state.interval"
-                show-scaled-info="bucketInterval.scaled"
-                bucket-interval-description="bucketInterval.description"
-                bucket-interval-scale="bucketInterval.scale"
-              >
-              </timechart-header>
-
-              <discover-histogram
-                class="dscHistogram"
-                ng-show="vis && rows.length !== 0"
-                chart-data="histogramData"
-                timefilter-update-handler="timefilterUpdateHandler"
-                watch-depth="reference"
-                data-test-subj="discoverChart"
-              ></discover-histogram>
-            </section>
-
-            <section
-              class="dscTable"
-              fixed-scroll
-              aria-labelledby="documentsAriaLabel"
-            >
-              <h2 class="euiScreenReaderOnly"
-                id="documentsAriaLabel"
-                i18n-id="discover.documentsAriaLabel"
-                i18n-default-message="Documents"
-              ></h2>
-              <doc-table
-                hits="rows"
-                index-pattern="indexPattern"
-                sorting="state.sort"
-                columns="state.columns"
-                infinite-scroll="true"
-                filter="filterQuery"
-                data-shared-item
-                data-title="{{opts.savedSearch.lastSavedTitle}}"
-                data-description="{{opts.savedSearch.description}}"
-                data-test-subj="discoverDocTable"
-                minimum-visible-rows="minimumVisibleRows"
-                render-complete
-                on-add-column="addColumn"
-                on-change-sort-order="setSortOrder"
-                on-move-column="moveColumn"
-                on-remove-column="removeColumn"
-              ></doc-table>
-
-              <a tabindex="0" id="discoverBottomMarker">&#8203;</a>
-
-              <div
-                ng-if="rows.length == opts.sampleSize"
-                class="dscTable__footer"
-                data-test-subj="discoverDocTableFooter"
-              >
-                <span
-                  i18n-id="discover.howToSeeOtherMatchingDocumentsDescription"
-                  i18n-default-message="These are the first {sampleSize} documents matching
-                  your search, refine your search to see others. "
-                  i18n-values="{
-                    sampleSize: opts.sampleSize,
-                  }"
-                ></span>
-                <a
-                  kbn-accessible-click
-                  ng-click="scrollToTop()"
-                  i18n-id="discover.backToTopLinkText"
-                  i18n-default-message="Back to top."
-                ></a>
-              </div>
-            </section>
-          </div>
-        </div>
-      </div>
-    </div>
-  </main>
-</discover-app>
diff --git a/src/plugins/discover/public/application/angular/discover.js b/src/plugins/discover/public/application/angular/discover.js
index b75ac75e5f2ed..7871cc4b16464 100644
--- a/src/plugins/discover/public/application/angular/discover.js
+++ b/src/plugins/discover/public/application/angular/discover.js
@@ -29,12 +29,11 @@ import { getState, splitState } from './discover_state';
 import { RequestAdapter } from '../../../../inspector/public';
 import { SavedObjectSaveModal, showSaveModal } from '../../../../saved_objects/public';
 import { getSortArray, getSortForSearchSource } from './doc_table';
+import { createFixedScroll } from './directives/fixed_scroll';
 import * as columnActions from './doc_table/actions/columns';
-
-import indexTemplate from './discover.html';
+import indexTemplateLegacy from './discover_legacy.html';
 import { showOpenSearchPanel } from '../components/top_nav/show_open_search_panel';
 import { addHelpMenuToAppChrome } from '../components/help_menu/help_menu_util';
-import '../components/fetch_error';
 import { getPainlessError } from './get_painless_error';
 import { discoverResponseHandler } from './response_handler';
 import {
@@ -71,7 +70,6 @@ import {
   indexPatterns as indexPatternsUtils,
   connectToQueryState,
   syncQueryStateWithUrl,
-  search,
 } from '../../../../data/public';
 import { getIndexPatternId } from '../helpers/get_index_pattern_id';
 import { addFatalError } from '../../../../kibana_legacy/public';
@@ -115,7 +113,7 @@ app.config(($routeProvider) => {
   };
   const discoverRoute = {
     ...defaults,
-    template: indexTemplate,
+    template: indexTemplateLegacy,
     reloadOnSearch: false,
     resolve: {
       savedObjects: function ($route, Promise) {
@@ -308,18 +306,10 @@ function discoverController($element, $route, $scope, $timeout, $window, Promise
       mode: 'absolute',
     });
   };
-  $scope.intervalOptions = search.aggs.intervalOptions;
   $scope.minimumVisibleRows = 50;
   $scope.fetchStatus = fetchStatuses.UNINITIALIZED;
   $scope.showSaveQuery = uiCapabilities.discover.saveQuery;
 
-  $scope.$watch(
-    () => uiCapabilities.discover.saveQuery,
-    (newCapability) => {
-      $scope.showSaveQuery = newCapability;
-    }
-  );
-
   let abortController;
   $scope.$on('$destroy', () => {
     if (abortController) abortController.abort();
@@ -471,7 +461,6 @@ function discoverController($element, $route, $scope, $timeout, $window, Promise
     ];
   };
   $scope.topNavMenu = getTopNavLinks();
-  $scope.setHeaderActionMenu = getHeaderActionMenuMounter();
 
   $scope.searchSource
     .setField('index', $scope.indexPattern)
@@ -515,8 +504,6 @@ function discoverController($element, $route, $scope, $timeout, $window, Promise
     ]);
   }
 
-  $scope.screenTitle = savedSearch.title;
-
   const getFieldCounts = async () => {
     // the field counts aren't set until we have the data back,
     // so we wait for the fetch to be done before proceeding
@@ -612,6 +599,9 @@ function discoverController($element, $route, $scope, $timeout, $window, Promise
     timefield: getTimeField(),
     savedSearch: savedSearch,
     indexPatternList: $route.current.locals.savedObjects.ip.list,
+    config: config,
+    fixedScroll: createFixedScroll($scope, $timeout),
+    setHeaderActionMenu: getHeaderActionMenuMounter(),
   };
 
   const shouldSearchOnPageLoad = () => {
@@ -771,6 +761,7 @@ function discoverController($element, $route, $scope, $timeout, $window, Promise
     if (!init.complete) return;
     $scope.fetchCounter++;
     $scope.fetchError = undefined;
+    $scope.minimumVisibleRows = 50;
     if (!validateTimeRange(timefilter.getTime(), toastNotifications)) {
       $scope.resultState = 'none';
       return;
@@ -868,9 +859,6 @@ function discoverController($element, $route, $scope, $timeout, $window, Promise
         tabifiedData,
         getDimensions($scope.vis.data.aggs.aggs, $scope.timeRange)
       );
-      if ($scope.vis.data.aggs.aggs[1]) {
-        $scope.bucketInterval = $scope.vis.data.aggs.aggs[1].buckets.getInterval();
-      }
       $scope.updateTime();
     }
 
diff --git a/src/plugins/discover/public/application/angular/discover_legacy.html b/src/plugins/discover/public/application/angular/discover_legacy.html
new file mode 100644
index 0000000000000..8582f71c0cb88
--- /dev/null
+++ b/src/plugins/discover/public/application/angular/discover_legacy.html
@@ -0,0 +1,36 @@
+<discover-app>
+  <discover-legacy
+    add-column="addColumn"
+    fetch="fetch"
+    fetch-counter="fetchCounter"
+    fetch-error="fetchError"
+    field-counts="fieldCounts"
+    histogram-data="histogramData"
+    hits="hits"
+    index-pattern="indexPattern"
+    minimum-visible-rows="minimumVisibleRows"
+    on-add-filter="filterQuery"
+    on-move-column="moveColumn"
+    on-change-interval="changeInterval"
+    on-remove-column="removeColumn"
+    on-set-columns="setColumns"
+    on-skip-bottom-button-click="onSkipBottomButtonClick"
+    on-sort="setSortOrder"
+    opts="opts"
+    reset-query="resetQuery"
+    result-state="resultState"
+    rows="rows"
+    saved-search="savedSearch"
+    search-source="searchSource"
+    set-index-pattern="setIndexPattern"
+    show-save-query="showSaveQuery"
+    state="state"
+    time-filter-update-handler="timefilterUpdateHandler"
+    time-range="timeRange"
+    top-nav-menu="topNavMenu"
+    update-query="handleRefresh"
+    update-saved-query-id="updateSavedQueryId"
+    vis="vis"
+  >
+  </discover-legacy>
+</discover-app>
diff --git a/src/plugins/discover/public/application/angular/discover_state.ts b/src/plugins/discover/public/application/angular/discover_state.ts
index ac0dc054485f0..5ddb6a92b5fd4 100644
--- a/src/plugins/discover/public/application/angular/discover_state.ts
+++ b/src/plugins/discover/public/application/angular/discover_state.ts
@@ -55,6 +55,10 @@ export interface AppState {
    * Array of the used sorting [[field,direction],...]
    */
   sort?: string[][];
+  /**
+   * id of the used saved query
+   */
+  savedQuery?: string;
 }
 
 interface GetStateParams {
diff --git a/src/plugins/discover/public/application/angular/doc_table/create_doc_table_react.tsx b/src/plugins/discover/public/application/angular/doc_table/create_doc_table_react.tsx
new file mode 100644
index 0000000000000..ad2b674af014c
--- /dev/null
+++ b/src/plugins/discover/public/application/angular/doc_table/create_doc_table_react.tsx
@@ -0,0 +1,131 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import angular, { auto, ICompileService, IScope } from 'angular';
+import { render } from 'react-dom';
+import React, { useRef, useEffect } from 'react';
+import { getServices, IIndexPattern } from '../../../kibana_services';
+import { IndexPatternField } from '../../../../../data/common/index_patterns';
+export type AngularScope = IScope;
+
+export interface AngularDirective {
+  template: string;
+}
+
+/**
+ * Compiles and injects the give angular template into the given dom node
+ * returns a function to cleanup the injected angular element
+ */
+export async function injectAngularElement(
+  domNode: Element,
+  template: string,
+  scopeProps: any,
+  getInjector: () => Promise<auto.IInjectorService>
+): Promise<() => void> {
+  const $injector = await getInjector();
+  const rootScope: AngularScope = $injector.get('$rootScope');
+  const $compile: ICompileService = $injector.get('$compile');
+  const newScope = Object.assign(rootScope.$new(), scopeProps);
+
+  const $target = angular.element(domNode);
+  const $element = angular.element(template);
+
+  newScope.$apply(() => {
+    const linkFn = $compile($element);
+    $target.empty().append($element);
+    linkFn(newScope);
+  });
+
+  return () => {
+    newScope.$destroy();
+  };
+}
+
+/**
+ * Converts a given legacy angular directive to a render function
+ * for usage in a react component. Note that the rendering is async
+ */
+export function convertDirectiveToRenderFn(
+  directive: AngularDirective,
+  getInjector: () => Promise<auto.IInjectorService>
+) {
+  return (domNode: Element, props: any) => {
+    let rejected = false;
+
+    const cleanupFnPromise = injectAngularElement(domNode, directive.template, props, getInjector);
+    cleanupFnPromise.catch(() => {
+      rejected = true;
+      render(<div>error</div>, domNode);
+    });
+
+    return () => {
+      if (!rejected) {
+        // for cleanup
+        // http://roubenmeschian.com/rubo/?p=51
+        cleanupFnPromise.then((cleanup) => cleanup());
+      }
+    };
+  };
+}
+
+export interface DocTableLegacyProps {
+  columns: string[];
+  searchDescription?: string;
+  searchTitle?: string;
+  onFilter: (field: IndexPatternField | string, value: string, type: '+' | '-') => void;
+  rows: Array<Record<string, unknown>>;
+  indexPattern: IIndexPattern;
+  minimumVisibleRows: number;
+  onAddColumn: (column: string) => void;
+  onSort: (sort: string[][]) => void;
+  onMoveColumn: (columns: string, newIdx: number) => void;
+  onRemoveColumn: (column: string) => void;
+  sort?: string[][];
+}
+
+export function DocTableLegacy(renderProps: DocTableLegacyProps) {
+  const renderFn = convertDirectiveToRenderFn(
+    {
+      template: `<doc-table
+                columns="columns"
+                data-description="{{searchDescription}}"
+                data-shared-item
+                data-test-subj="discoverDocTable"
+                data-title="{{searchTitle}}"
+                filter="onFilter"
+                hits="rows"
+                index-pattern="indexPattern"
+                infinite-scroll="true"
+                minimum-visible-rows="minimumVisibleRows"
+                on-add-column="onAddColumn"
+                on-change-sort-order="onSort"
+                on-move-column="onMoveColumn"
+                on-remove-column="onRemoveColumn"
+                render-complete
+                sorting="sort"></doc_table>`,
+    },
+    () => getServices().getEmbeddableInjector()
+  );
+  const ref = useRef<HTMLDivElement>(null);
+  useEffect(() => {
+    if (ref && ref.current) {
+      return renderFn(ref.current, renderProps);
+    }
+  }, [renderFn, renderProps]);
+  return <div ref={ref} />;
+}
diff --git a/src/plugins/discover/public/application/angular/doc_table/doc_table.ts b/src/plugins/discover/public/application/angular/doc_table/doc_table.ts
index f972c158ff3dd..735ee9f555740 100644
--- a/src/plugins/discover/public/application/angular/doc_table/doc_table.ts
+++ b/src/plugins/discover/public/application/angular/doc_table/doc_table.ts
@@ -50,10 +50,6 @@ export function createDocTableDirective(pagerFactory: any, $filter: any) {
       inspectorAdapters: '=?',
     },
     link: ($scope: LazyScope, $el: JQuery) => {
-      $scope.$watch('minimumVisibleRows', (minimumVisibleRows: number) => {
-        $scope.limit = Math.max(minimumVisibleRows || 50, $scope.limit || 50);
-      });
-
       $scope.persist = {
         sorting: $scope.sorting,
         columns: $scope.columns,
@@ -77,7 +73,7 @@ export function createDocTableDirective(pagerFactory: any, $filter: any) {
         if (!hits) return;
 
         // Reset infinite scroll limit
-        $scope.limit = 50;
+        $scope.limit = $scope.minimumVisibleRows || 50;
 
         if (hits.length === 0) {
           dispatchRenderComplete($el[0]);
diff --git a/src/plugins/discover/public/application/components/create_discover_legacy_directive.ts b/src/plugins/discover/public/application/components/create_discover_legacy_directive.ts
new file mode 100644
index 0000000000000..a3502cbb211fa
--- /dev/null
+++ b/src/plugins/discover/public/application/components/create_discover_legacy_directive.ts
@@ -0,0 +1,56 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { DiscoverLegacy } from './discover_legacy';
+
+export function createDiscoverLegacyDirective(reactDirective: any) {
+  return reactDirective(DiscoverLegacy, [
+    ['addColumn', { watchDepth: 'reference' }],
+    ['fetch', { watchDepth: 'reference' }],
+    ['fetchCounter', { watchDepth: 'reference' }],
+    ['fetchError', { watchDepth: 'reference' }],
+    ['fieldCounts', { watchDepth: 'reference' }],
+    ['histogramData', { watchDepth: 'reference' }],
+    ['hits', { watchDepth: 'reference' }],
+    ['indexPattern', { watchDepth: 'reference' }],
+    ['minimumVisibleRows', { watchDepth: 'reference' }],
+    ['onAddFilter', { watchDepth: 'reference' }],
+    ['onChangeInterval', { watchDepth: 'reference' }],
+    ['onMoveColumn', { watchDepth: 'reference' }],
+    ['onRemoveColumn', { watchDepth: 'reference' }],
+    ['onSetColumns', { watchDepth: 'reference' }],
+    ['onSkipBottomButtonClick', { watchDepth: 'reference' }],
+    ['onSort', { watchDepth: 'reference' }],
+    ['opts', { watchDepth: 'reference' }],
+    ['resetQuery', { watchDepth: 'reference' }],
+    ['resultState', { watchDepth: 'reference' }],
+    ['rows', { watchDepth: 'reference' }],
+    ['savedSearch', { watchDepth: 'reference' }],
+    ['searchSource', { watchDepth: 'reference' }],
+    ['setIndexPattern', { watchDepth: 'reference' }],
+    ['showSaveQuery', { watchDepth: 'reference' }],
+    ['state', { watchDepth: 'reference' }],
+    ['timefilterUpdateHandler', { watchDepth: 'reference' }],
+    ['timeRange', { watchDepth: 'reference' }],
+    ['topNavMenu', { watchDepth: 'reference' }],
+    ['updateQuery', { watchDepth: 'reference' }],
+    ['updateSavedQueryId', { watchDepth: 'reference' }],
+    ['vis', { watchDepth: 'reference' }],
+  ]);
+}
diff --git a/src/plugins/discover/public/application/components/discover_legacy.tsx b/src/plugins/discover/public/application/components/discover_legacy.tsx
new file mode 100644
index 0000000000000..1a98843649259
--- /dev/null
+++ b/src/plugins/discover/public/application/components/discover_legacy.tsx
@@ -0,0 +1,324 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import React, { useState, useCallback, useEffect } from 'react';
+import classNames from 'classnames';
+import { EuiButtonEmpty, EuiButtonIcon } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage, I18nProvider } from '@kbn/i18n/react';
+import { IUiSettingsClient, MountPoint } from 'kibana/public';
+import { HitsCounter } from './hits_counter';
+import { TimechartHeader } from './timechart_header';
+import { DiscoverSidebar } from './sidebar';
+import { getServices, IIndexPattern } from '../../kibana_services';
+// @ts-ignore
+import { DiscoverNoResults } from '../angular/directives/no_results';
+import { DiscoverUninitialized } from '../angular/directives/uninitialized';
+import { DiscoverHistogram } from '../angular/directives/histogram';
+import { LoadingSpinner } from './loading_spinner/loading_spinner';
+import { DiscoverFetchError, FetchError } from './fetch_error/fetch_error';
+import { DocTableLegacy } from '../angular/doc_table/create_doc_table_react';
+import { SkipBottomButton } from './skip_bottom_button';
+import {
+  IndexPatternField,
+  search,
+  ISearchSource,
+  TimeRange,
+  Query,
+  IndexPatternAttributes,
+} from '../../../../data/public';
+import { Chart } from '../angular/helpers/point_series';
+import { AppState } from '../angular/discover_state';
+import { SavedSearch } from '../../saved_searches';
+
+import { SavedObject } from '../../../../../core/types';
+import { Vis } from '../../../../visualizations/public';
+import { TopNavMenuData } from '../../../../navigation/public';
+
+export interface DiscoverLegacyProps {
+  addColumn: (column: string) => void;
+  fetch: () => void;
+  fetchCounter: number;
+  fetchError: FetchError;
+  fieldCounts: Record<string, number>;
+  histogramData: Chart;
+  hits: number;
+  indexPattern: IIndexPattern;
+  minimumVisibleRows: number;
+  onAddFilter: (field: IndexPatternField | string, value: string, type: '+' | '-') => void;
+  onChangeInterval: (interval: string) => void;
+  onMoveColumn: (columns: string, newIdx: number) => void;
+  onRemoveColumn: (column: string) => void;
+  onSetColumns: (columns: string[]) => void;
+  onSkipBottomButtonClick: () => void;
+  onSort: (sort: string[][]) => void;
+  opts: {
+    savedSearch: SavedSearch;
+    config: IUiSettingsClient;
+    indexPatternList: Array<SavedObject<IndexPatternAttributes>>;
+    timefield: string;
+    sampleSize: number;
+    fixedScroll: (el: HTMLElement) => void;
+    setHeaderActionMenu: (menuMount: MountPoint | undefined) => void;
+  };
+  resetQuery: () => void;
+  resultState: string;
+  rows: Array<Record<string, unknown>>;
+  searchSource: ISearchSource;
+  setIndexPattern: (id: string) => void;
+  showSaveQuery: boolean;
+  state: AppState;
+  timefilterUpdateHandler: (ranges: { from: number; to: number }) => void;
+  timeRange?: { from: string; to: string };
+  topNavMenu: TopNavMenuData[];
+  updateQuery: (payload: { dateRange: TimeRange; query?: Query }, isUpdate?: boolean) => void;
+  updateSavedQueryId: (savedQueryId?: string) => void;
+  vis?: Vis;
+}
+
+export function DiscoverLegacy({
+  addColumn,
+  fetch,
+  fetchCounter,
+  fetchError,
+  fieldCounts,
+  histogramData,
+  hits,
+  indexPattern,
+  minimumVisibleRows,
+  onAddFilter,
+  onChangeInterval,
+  onMoveColumn,
+  onRemoveColumn,
+  onSkipBottomButtonClick,
+  onSort,
+  opts,
+  resetQuery,
+  resultState,
+  rows,
+  searchSource,
+  setIndexPattern,
+  showSaveQuery,
+  state,
+  timefilterUpdateHandler,
+  timeRange,
+  topNavMenu,
+  updateQuery,
+  updateSavedQueryId,
+  vis,
+}: DiscoverLegacyProps) {
+  const [isSidebarClosed, setIsSidebarClosed] = useState(false);
+  const { TopNavMenu } = getServices().navigation.ui;
+  const { savedSearch, indexPatternList } = opts;
+  const bucketAggConfig = vis?.data?.aggs?.aggs[1];
+  const bucketInterval =
+    bucketAggConfig && search.aggs.isDateHistogramBucketAggConfig(bucketAggConfig)
+      ? bucketAggConfig.buckets?.getInterval()
+      : undefined;
+  const [fixedScrollEl, setFixedScrollEl] = useState<HTMLElement | undefined>();
+
+  useEffect(() => (fixedScrollEl ? opts.fixedScroll(fixedScrollEl) : undefined), [
+    fixedScrollEl,
+    opts,
+  ]);
+  const fixedScrollRef = useCallback(
+    (node: HTMLElement) => {
+      if (node !== null) {
+        setFixedScrollEl(node);
+      }
+    },
+    [setFixedScrollEl]
+  );
+  const sidebarClassName = classNames({
+    closed: isSidebarClosed,
+  });
+
+  const mainSectionClassName = classNames({
+    'col-md-10': !isSidebarClosed,
+    'col-md-12': isSidebarClosed,
+  });
+
+  return (
+    <I18nProvider>
+      <div className="dscAppContainer" data-fetch-counter={fetchCounter}>
+        <h1 className="euiScreenReaderOnly">{savedSearch.title}</h1>
+        <TopNavMenu
+          appName="discover"
+          config={topNavMenu}
+          indexPatterns={[indexPattern]}
+          onQuerySubmit={updateQuery}
+          onSavedQueryIdChange={updateSavedQueryId}
+          query={state.query}
+          setMenuMountPoint={opts.setHeaderActionMenu}
+          savedQueryId={state.savedQuery}
+          screenTitle={savedSearch.title}
+          showDatePicker={indexPattern.isTimeBased()}
+          showSaveQuery={showSaveQuery}
+          showSearchBar={true}
+          useDefaultBehaviors={true}
+        />
+        <main className="container-fluid">
+          <div className="row">
+            <div
+              className={`col-md-2 dscSidebar__container dscCollapsibleSidebar ${sidebarClassName}`}
+              id="discover-sidebar"
+              data-test-subj="discover-sidebar"
+            >
+              {!isSidebarClosed && (
+                <div className="dscFieldChooser">
+                  <DiscoverSidebar
+                    columns={state.columns || []}
+                    fieldCounts={fieldCounts}
+                    hits={rows}
+                    indexPatternList={indexPatternList}
+                    onAddField={addColumn}
+                    onAddFilter={onAddFilter}
+                    onRemoveField={onRemoveColumn}
+                    selectedIndexPattern={searchSource && searchSource.getField('index')}
+                    setIndexPattern={setIndexPattern}
+                  />
+                </div>
+              )}
+              <EuiButtonIcon
+                iconType={isSidebarClosed ? 'menuRight' : 'menuLeft'}
+                iconSize="m"
+                size="s"
+                onClick={() => setIsSidebarClosed(!isSidebarClosed)}
+                data-test-subj="collapseSideBarButton"
+                aria-controls="discover-sidebar"
+                aria-expanded={isSidebarClosed ? 'false' : 'true'}
+                aria-label="Toggle sidebar"
+                className="dscCollapsibleSidebar__collapseButton"
+              />
+            </div>
+            <div className={`dscWrapper ${mainSectionClassName}`}>
+              {resultState === 'none' && (
+                <DiscoverNoResults
+                  timeFieldName={opts.timefield}
+                  queryLanguage={state.query ? state.query.language : ''}
+                />
+              )}
+              {resultState === 'uninitialized' && <DiscoverUninitialized onRefresh={fetch} />}
+              {/* @TODO: Solved in the Angular way to satisfy functional test - should be improved*/}
+              <span style={{ display: resultState !== 'loading' ? 'none' : '' }}>
+                {fetchError && <DiscoverFetchError fetchError={fetchError} />}
+                <div className="dscOverlay" style={{ display: fetchError ? 'none' : '' }}>
+                  <LoadingSpinner />
+                </div>
+              </span>
+              {resultState === 'ready' && (
+                <div className="dscWrapper__content">
+                  <SkipBottomButton onClick={onSkipBottomButtonClick} />
+                  <HitsCounter
+                    hits={hits > 0 ? hits : 0}
+                    showResetButton={!!(savedSearch && savedSearch.id)}
+                    onResetQuery={resetQuery}
+                  />
+                  {opts.timefield && (
+                    <TimechartHeader
+                      dateFormat={opts.config.get('dateFormat')}
+                      timeRange={timeRange}
+                      options={search.aggs.intervalOptions}
+                      onChangeInterval={onChangeInterval}
+                      stateInterval={state.interval || ''}
+                      bucketInterval={bucketInterval}
+                    />
+                  )}
+
+                  {opts.timefield && (
+                    <section
+                      aria-label={i18n.translate('discover.histogramOfFoundDocumentsAriaLabel', {
+                        defaultMessage: 'Histogram of found documents',
+                      })}
+                      className="dscTimechart"
+                    >
+                      {vis && rows.length !== 0 && (
+                        <div className="dscHistogram" data-test-subj="discoverChart">
+                          <DiscoverHistogram
+                            chartData={histogramData}
+                            timefilterUpdateHandler={timefilterUpdateHandler}
+                          />
+                        </div>
+                      )}
+                    </section>
+                  )}
+
+                  <div className="dscResults">
+                    <section
+                      className="dscTable dscTableFixedScroll"
+                      aria-labelledby="documentsAriaLabel"
+                      ref={fixedScrollRef}
+                    >
+                      <h2 className="euiScreenReaderOnly" id="documentsAriaLabel">
+                        <FormattedMessage
+                          id="discover.documentsAriaLabel"
+                          defaultMessage="Documents"
+                        />
+                      </h2>
+                      {rows && rows.length && (
+                        <div className="dscDiscover">
+                          <DocTableLegacy
+                            columns={state.columns || []}
+                            indexPattern={indexPattern}
+                            minimumVisibleRows={minimumVisibleRows}
+                            rows={rows}
+                            sort={state.sort || []}
+                            searchDescription={opts.savedSearch.description}
+                            searchTitle={opts.savedSearch.lastSavedTitle}
+                            onAddColumn={addColumn}
+                            onFilter={onAddFilter}
+                            onMoveColumn={onMoveColumn}
+                            onRemoveColumn={onRemoveColumn}
+                            onSort={onSort}
+                          />
+                          <a tabIndex={0} id="discoverBottomMarker">
+                            &#8203;
+                          </a>
+                          {rows.length === opts.sampleSize && (
+                            <div
+                              className="dscTable__footer"
+                              data-test-subj="discoverDocTableFooter"
+                            >
+                              <FormattedMessage
+                                id="discover.howToSeeOtherMatchingDocumentsDescription"
+                                defaultMessage="These are the first {sampleSize} documents matching
+                  your search, refine your search to see others."
+                                values={{ sampleSize: opts.sampleSize }}
+                              />
+
+                              <EuiButtonEmpty onClick={() => window.scrollTo(0, 0)}>
+                                <FormattedMessage
+                                  id="discover.backToTopLinkText"
+                                  defaultMessage="Back to top."
+                                />
+                              </EuiButtonEmpty>
+                            </div>
+                          )}
+                        </div>
+                      )}
+                    </section>
+                  </div>
+                </div>
+              )}
+            </div>
+          </div>
+        </main>
+      </div>
+    </I18nProvider>
+  );
+}
diff --git a/src/plugins/discover/public/application/components/fetch_error/fetch_error.tsx b/src/plugins/discover/public/application/components/fetch_error/fetch_error.tsx
index 880a493983adf..dc8f1238eac6f 100644
--- a/src/plugins/discover/public/application/components/fetch_error/fetch_error.tsx
+++ b/src/plugins/discover/public/application/components/fetch_error/fetch_error.tsx
@@ -20,18 +20,20 @@ import './fetch_error.scss';
 import React, { Fragment } from 'react';
 import { FormattedMessage, I18nProvider } from '@kbn/i18n/react';
 import { EuiFlexGroup, EuiFlexItem, EuiCallOut, EuiCodeBlock, EuiSpacer } from '@elastic/eui';
-import { getAngularModule, getServices } from '../../../kibana_services';
+import { getServices } from '../../../kibana_services';
+
+export interface FetchError {
+  lang: string;
+  script: string;
+  message: string;
+  error: string;
+}
 
 interface Props {
-  fetchError: {
-    lang: string;
-    script: string;
-    message: string;
-    error: string;
-  };
+  fetchError: FetchError;
 }
 
-const DiscoverFetchError = ({ fetchError }: Props) => {
+export const DiscoverFetchError = ({ fetchError }: Props) => {
   if (!fetchError) {
     return null;
   }
@@ -92,9 +94,3 @@ const DiscoverFetchError = ({ fetchError }: Props) => {
     </I18nProvider>
   );
 };
-
-export function createFetchErrorDirective(reactDirective: any) {
-  return reactDirective(DiscoverFetchError);
-}
-
-getAngularModule().directive('discoverFetchError', createFetchErrorDirective);
diff --git a/src/plugins/discover/public/application/components/fetch_error/index.js b/src/plugins/discover/public/application/components/fetch_error/index.ts
similarity index 100%
rename from src/plugins/discover/public/application/components/fetch_error/index.js
rename to src/plugins/discover/public/application/components/fetch_error/index.ts
diff --git a/src/plugins/discover/public/application/components/hits_counter/hits_counter_directive.ts b/src/plugins/discover/public/application/components/hits_counter/hits_counter_directive.ts
deleted file mode 100644
index 8d45e28370cad..0000000000000
--- a/src/plugins/discover/public/application/components/hits_counter/hits_counter_directive.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { HitsCounter } from './hits_counter';
-
-export function createHitsCounterDirective(reactDirective: any) {
-  return reactDirective(HitsCounter, [
-    ['hits', { watchDepth: 'reference' }],
-    ['showResetButton', { watchDepth: 'reference' }],
-    ['onResetQuery', { watchDepth: 'reference' }],
-  ]);
-}
diff --git a/src/plugins/discover/public/application/components/hits_counter/index.ts b/src/plugins/discover/public/application/components/hits_counter/index.ts
index 58e7a9eda7f51..0ce95f061df17 100644
--- a/src/plugins/discover/public/application/components/hits_counter/index.ts
+++ b/src/plugins/discover/public/application/components/hits_counter/index.ts
@@ -18,4 +18,3 @@
  */
 
 export { HitsCounter } from './hits_counter';
-export { createHitsCounterDirective } from './hits_counter_directive';
diff --git a/src/plugins/discover/public/application/components/loading_spinner/loading_spinner.tsx b/src/plugins/discover/public/application/components/loading_spinner/loading_spinner.tsx
index 44b922bf0f708..4e1754638d479 100644
--- a/src/plugins/discover/public/application/components/loading_spinner/loading_spinner.tsx
+++ b/src/plugins/discover/public/application/components/loading_spinner/loading_spinner.tsx
@@ -18,24 +18,18 @@
  */
 import React from 'react';
 import { EuiLoadingSpinner, EuiTitle, EuiSpacer } from '@elastic/eui';
-import { FormattedMessage, I18nProvider } from '@kbn/i18n/react';
+import { FormattedMessage } from '@kbn/i18n/react';
 
 export function LoadingSpinner() {
   return (
-    <I18nProvider>
-      <>
-        <EuiTitle size="s" data-test-subj="loadingSpinnerText">
-          <h2>
-            <FormattedMessage id="discover.searchingTitle" defaultMessage="Searching" />
-          </h2>
-        </EuiTitle>
-        <EuiSpacer size="m" />
-        <EuiLoadingSpinner size="l" data-test-subj="loadingSpinner" />
-      </>
-    </I18nProvider>
+    <>
+      <EuiTitle size="s" data-test-subj="loadingSpinnerText">
+        <h2>
+          <FormattedMessage id="discover.searchingTitle" defaultMessage="Searching" />
+        </h2>
+      </EuiTitle>
+      <EuiSpacer size="m" />
+      <EuiLoadingSpinner size="l" data-test-subj="loadingSpinner" />
+    </>
   );
 }
-
-export function createLoadingSpinnerDirective(reactDirective: any) {
-  return reactDirective(LoadingSpinner);
-}
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
index 850624888b24a..2407cff181901 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
@@ -68,7 +68,7 @@ export interface DiscoverSidebarProps {
   /**
    * Currently selected index pattern
    */
-  selectedIndexPattern: IndexPattern;
+  selectedIndexPattern?: IndexPattern;
   /**
    * Callback function to select another index pattern
    */
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_sidebar_directive.ts b/src/plugins/discover/public/application/components/sidebar/discover_sidebar_directive.ts
deleted file mode 100644
index b271c920e5e01..0000000000000
--- a/src/plugins/discover/public/application/components/sidebar/discover_sidebar_directive.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { DiscoverSidebar } from './discover_sidebar';
-
-export function createDiscoverSidebarDirective(reactDirective: any) {
-  return reactDirective(DiscoverSidebar, [
-    ['columns', { watchDepth: 'reference' }],
-    ['fieldCounts', { watchDepth: 'reference' }],
-    ['hits', { watchDepth: 'reference' }],
-    ['indexPatternList', { watchDepth: 'reference' }],
-    ['onAddField', { watchDepth: 'reference' }],
-    ['onAddFilter', { watchDepth: 'reference' }],
-    ['onRemoveField', { watchDepth: 'reference' }],
-    ['selectedIndexPattern', { watchDepth: 'reference' }],
-    ['setIndexPattern', { watchDepth: 'reference' }],
-  ]);
-}
diff --git a/src/plugins/discover/public/application/components/sidebar/index.ts b/src/plugins/discover/public/application/components/sidebar/index.ts
index 1b837840b52f6..aec8dfc86e817 100644
--- a/src/plugins/discover/public/application/components/sidebar/index.ts
+++ b/src/plugins/discover/public/application/components/sidebar/index.ts
@@ -18,4 +18,3 @@
  */
 
 export { DiscoverSidebar } from './discover_sidebar';
-export { createDiscoverSidebarDirective } from './discover_sidebar_directive';
diff --git a/src/plugins/discover/public/application/components/sidebar/lib/get_details.ts b/src/plugins/discover/public/application/components/sidebar/lib/get_details.ts
index 13051f88c9591..22a6e7a628555 100644
--- a/src/plugins/discover/public/application/components/sidebar/lib/get_details.ts
+++ b/src/plugins/discover/public/application/components/sidebar/lib/get_details.ts
@@ -25,8 +25,11 @@ export function getDetails(
   field: IndexPatternField,
   hits: Array<Record<string, unknown>>,
   columns: string[],
-  indexPattern: IndexPattern
+  indexPattern?: IndexPattern
 ) {
+  if (!indexPattern) {
+    return {};
+  }
   const details = {
     ...fieldCalculator.getFieldValueCounts({
       hits,
diff --git a/src/plugins/discover/public/application/components/sidebar/lib/get_index_pattern_field_list.ts b/src/plugins/discover/public/application/components/sidebar/lib/get_index_pattern_field_list.ts
index c96a8f5ce17b9..eff7c2ec3c1c8 100644
--- a/src/plugins/discover/public/application/components/sidebar/lib/get_index_pattern_field_list.ts
+++ b/src/plugins/discover/public/application/components/sidebar/lib/get_index_pattern_field_list.ts
@@ -20,8 +20,8 @@ import { difference } from 'lodash';
 import { IndexPattern, IndexPatternField } from 'src/plugins/data/public';
 
 export function getIndexPatternFieldList(
-  indexPattern: IndexPattern,
-  fieldCounts: Record<string, number>
+  indexPattern?: IndexPattern,
+  fieldCounts?: Record<string, number>
 ) {
   if (!indexPattern || !fieldCounts) return [];
 
diff --git a/src/plugins/discover/public/application/components/skip_bottom_button/index.ts b/src/plugins/discover/public/application/components/skip_bottom_button/index.ts
index 2feaa35e0d61f..b3d93e40be0bd 100644
--- a/src/plugins/discover/public/application/components/skip_bottom_button/index.ts
+++ b/src/plugins/discover/public/application/components/skip_bottom_button/index.ts
@@ -18,4 +18,3 @@
  */
 
 export { SkipBottomButton } from './skip_bottom_button';
-export { createSkipBottomButtonDirective } from './skip_bottom_button_directive';
diff --git a/src/plugins/discover/public/application/components/skip_bottom_button/skip_bottom_button_directive.ts b/src/plugins/discover/public/application/components/skip_bottom_button/skip_bottom_button_directive.ts
deleted file mode 100644
index 27f17b25fd447..0000000000000
--- a/src/plugins/discover/public/application/components/skip_bottom_button/skip_bottom_button_directive.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { SkipBottomButton } from './skip_bottom_button';
-
-export function createSkipBottomButtonDirective(reactDirective: any) {
-  return reactDirective(SkipBottomButton, [['onClick', { watchDepth: 'reference' }]]);
-}
diff --git a/src/plugins/discover/public/application/components/timechart_header/index.ts b/src/plugins/discover/public/application/components/timechart_header/index.ts
index 43473319c318c..34bed2cd72a74 100644
--- a/src/plugins/discover/public/application/components/timechart_header/index.ts
+++ b/src/plugins/discover/public/application/components/timechart_header/index.ts
@@ -18,4 +18,3 @@
  */
 
 export { TimechartHeader } from './timechart_header';
-export { createTimechartHeaderDirective } from './timechart_header_directive';
diff --git a/src/plugins/discover/public/application/components/timechart_header/timechart_header.test.tsx b/src/plugins/discover/public/application/components/timechart_header/timechart_header.test.tsx
index a4c10e749d868..7889b05a88415 100644
--- a/src/plugins/discover/public/application/components/timechart_header/timechart_header.test.tsx
+++ b/src/plugins/discover/public/application/components/timechart_header/timechart_header.test.tsx
@@ -29,8 +29,10 @@ describe('timechart header', function () {
 
   beforeAll(() => {
     props = {
-      from: 'May 14, 2020 @ 11:05:13.590',
-      to: 'May 14, 2020 @ 11:20:13.590',
+      timeRange: {
+        from: 'May 14, 2020 @ 11:05:13.590',
+        to: 'May 14, 2020 @ 11:20:13.590',
+      },
       stateInterval: 's',
       options: [
         {
@@ -47,9 +49,11 @@ describe('timechart header', function () {
         },
       ],
       onChangeInterval: jest.fn(),
-      showScaledInfo: undefined,
-      bucketIntervalDescription: 'second',
-      bucketIntervalScale: undefined,
+      bucketInterval: {
+        scaled: undefined,
+        description: 'second',
+        scale: undefined,
+      },
     };
   });
 
@@ -58,8 +62,8 @@ describe('timechart header', function () {
     expect(component.find(EuiIconTip).length).toBe(0);
   });
 
-  it('TimechartHeader renders an info text by providing the showScaledInfo property', () => {
-    props.showScaledInfo = true;
+  it('TimechartHeader renders an info when bucketInterval.scale is set to true', () => {
+    props.bucketInterval!.scaled = true;
     component = mountWithIntl(<TimechartHeader {...props} />);
     expect(component.find(EuiIconTip).length).toBe(1);
   });
diff --git a/src/plugins/discover/public/application/components/timechart_header/timechart_header.tsx b/src/plugins/discover/public/application/components/timechart_header/timechart_header.tsx
index 8789847058aff..1451106827ee0 100644
--- a/src/plugins/discover/public/application/components/timechart_header/timechart_header.tsx
+++ b/src/plugins/discover/public/application/components/timechart_header/timechart_header.tsx
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import React, { useState, useEffect } from 'react';
+import React, { useState, useEffect, useCallback } from 'react';
 import {
   EuiFlexGroup,
   EuiFlexItem,
@@ -27,16 +27,28 @@ import {
 } from '@elastic/eui';
 import { I18nProvider } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
+import moment from 'moment';
 
 export interface TimechartHeaderProps {
   /**
-   * the query from date string
+   * Format of date to be displayed
    */
-  from: string;
+  dateFormat?: string;
   /**
-   * the query to date string
+   * Interval for the buckets of the recent request
    */
-  to: string;
+  bucketInterval?: {
+    scaled?: boolean;
+    description?: string;
+    scale?: number;
+  };
+  /**
+   * Range of dates to be displayed
+   */
+  timeRange?: {
+    from: string;
+    to: string;
+  };
   /**
    * Interval Options
    */
@@ -49,31 +61,29 @@ export interface TimechartHeaderProps {
    * selected interval
    */
   stateInterval: string;
-  /**
-   * displays the scaled info of the interval
-   */
-  showScaledInfo: boolean | undefined;
-  /**
-   * scaled info description
-   */
-  bucketIntervalDescription: string;
-  /**
-   * bucket interval scale
-   */
-  bucketIntervalScale: number | undefined;
 }
 
 export function TimechartHeader({
-  from,
-  to,
+  bucketInterval,
+  dateFormat,
+  timeRange,
   options,
   onChangeInterval,
   stateInterval,
-  showScaledInfo,
-  bucketIntervalDescription,
-  bucketIntervalScale,
 }: TimechartHeaderProps) {
   const [interval, setInterval] = useState(stateInterval);
+  const toMoment = useCallback(
+    (datetime: string) => {
+      if (!datetime) {
+        return '';
+      }
+      if (!dateFormat) {
+        return datetime;
+      }
+      return moment(datetime).format(dateFormat);
+    },
+    [dateFormat]
+  );
 
   useEffect(() => {
     setInterval(stateInterval);
@@ -84,6 +94,10 @@ export function TimechartHeader({
     onChangeInterval(e.target.value);
   };
 
+  if (!timeRange || !bucketInterval) {
+    return null;
+  }
+
   return (
     <I18nProvider>
       <EuiFlexGroup gutterSize="s" responsive justifyContent="center" alignItems="center">
@@ -95,7 +109,7 @@ export function TimechartHeader({
             delay="long"
           >
             <EuiText data-test-subj="discoverIntervalDateRange" size="s">
-              {`${from} - ${to} ${
+              {`${toMoment(timeRange.from)} - ${toMoment(timeRange.to)} ${
                 interval !== 'auto'
                   ? i18n.translate('discover.timechartHeader.timeIntervalSelect.per', {
                       defaultMessage: 'per',
@@ -125,7 +139,7 @@ export function TimechartHeader({
             value={interval}
             onChange={handleIntervalChange}
             append={
-              showScaledInfo ? (
+              bucketInterval.scaled ? (
                 <EuiIconTip
                   id="discoverIntervalIconTip"
                   content={i18n.translate('discover.bucketIntervalTooltip', {
@@ -133,14 +147,14 @@ export function TimechartHeader({
                       'This interval creates {bucketsDescription} to show in the selected time range, so it has been scaled to {bucketIntervalDescription}.',
                     values: {
                       bucketsDescription:
-                        bucketIntervalScale && bucketIntervalScale > 1
+                        bucketInterval!.scale && bucketInterval!.scale > 1
                           ? i18n.translate('discover.bucketIntervalTooltip.tooLargeBucketsText', {
                               defaultMessage: 'buckets that are too large',
                             })
                           : i18n.translate('discover.bucketIntervalTooltip.tooManyBucketsText', {
                               defaultMessage: 'too many buckets',
                             }),
-                      bucketIntervalDescription,
+                      bucketIntervalDescription: bucketInterval.description,
                     },
                   })}
                   color="warning"
diff --git a/src/plugins/discover/public/application/components/timechart_header/timechart_header_directive.ts b/src/plugins/discover/public/application/components/timechart_header/timechart_header_directive.ts
deleted file mode 100644
index 027236cd46521..0000000000000
--- a/src/plugins/discover/public/application/components/timechart_header/timechart_header_directive.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { TimechartHeader } from './timechart_header';
-
-export function createTimechartHeaderDirective(reactDirective: any) {
-  return reactDirective(TimechartHeader, [
-    ['from', { watchDepth: 'reference' }],
-    ['to', { watchDepth: 'reference' }],
-    ['options', { watchDepth: 'reference' }],
-    ['onChangeInterval', { watchDepth: 'reference' }],
-    ['stateInterval', { watchDepth: 'reference' }],
-    ['showScaledInfo', { watchDepth: 'reference' }],
-    ['bucketIntervalDescription', { watchDepth: 'reference' }],
-    ['bucketIntervalScale', { watchDepth: 'reference' }],
-  ]);
-}
diff --git a/src/plugins/discover/public/build_services.ts b/src/plugins/discover/public/build_services.ts
index 12562d8571a25..fdb14b3f1f63e 100644
--- a/src/plugins/discover/public/build_services.ts
+++ b/src/plugins/discover/public/build_services.ts
@@ -44,6 +44,7 @@ import { createSavedSearchesLoader, SavedSearch } from './saved_searches';
 import { getHistory } from './kibana_services';
 import { KibanaLegacyStart } from '../../kibana_legacy/public';
 import { UrlForwardingStart } from '../../url_forwarding/public';
+import { NavigationPublicPluginStart } from '../../navigation/public';
 
 export interface DiscoverServices {
   addBasePath: (path: string) => string;
@@ -58,6 +59,7 @@ export interface DiscoverServices {
   indexPatterns: IndexPatternsContract;
   inspector: InspectorPublicPluginStart;
   metadata: { branch: string };
+  navigation: NavigationPublicPluginStart;
   share?: SharePluginStart;
   kibanaLegacy: KibanaLegacyStart;
   urlForwarding: UrlForwardingStart;
@@ -65,6 +67,7 @@ export interface DiscoverServices {
   toastNotifications: ToastsStart;
   getSavedSearchById: (id: string) => Promise<SavedSearch>;
   getSavedSearchUrlById: (id: string) => Promise<string>;
+  getEmbeddableInjector: any;
   uiSettings: IUiSettingsClient;
   visualizations: VisualizationsStart;
 }
@@ -72,7 +75,8 @@ export interface DiscoverServices {
 export async function buildServices(
   core: CoreStart,
   plugins: DiscoverStartPlugins,
-  context: PluginInitializerContext
+  context: PluginInitializerContext,
+  getEmbeddableInjector: any
 ): Promise<DiscoverServices> {
   const services: SavedObjectKibanaServices = {
     savedObjectsClient: core.savedObjects.client,
@@ -92,6 +96,7 @@ export async function buildServices(
     docLinks: core.docLinks,
     theme: plugins.charts.theme,
     filterManager: plugins.data.query.filterManager,
+    getEmbeddableInjector,
     getSavedSearchById: async (id: string) => savedObjectService.get(id),
     getSavedSearchUrlById: async (id: string) => savedObjectService.urlFor(id),
     history: getHistory,
@@ -100,6 +105,7 @@ export async function buildServices(
     metadata: {
       branch: context.env.packageInfo.branch,
     },
+    navigation: plugins.navigation,
     share: plugins.share,
     kibanaLegacy: plugins.kibanaLegacy,
     urlForwarding: plugins.urlForwarding,
diff --git a/src/plugins/discover/public/get_inner_angular.ts b/src/plugins/discover/public/get_inner_angular.ts
index 85b0752f13463..1ca0bb20e8723 100644
--- a/src/plugins/discover/public/get_inner_angular.ts
+++ b/src/plugins/discover/public/get_inner_angular.ts
@@ -40,16 +40,10 @@ import { createTableRowDirective } from './application/angular/doc_table/compone
 import { createPagerFactory } from './application/angular/doc_table/lib/pager/pager_factory';
 import { createInfiniteScrollDirective } from './application/angular/doc_table/infinite_scroll';
 import { createDocViewerDirective } from './application/angular/doc_viewer';
-import { CollapsibleSidebarProvider } from './application/angular/directives/collapsible_sidebar/collapsible_sidebar';
-// @ts-ignore
-import { FixedScrollProvider } from './application/angular/directives/fixed_scroll';
-// @ts-ignore
-import { DebounceProviderTimeout } from './application/angular/directives/debounce/debounce';
 import { createRenderCompleteDirective } from './application/angular/directives/render_complete';
 import {
   initAngularBootstrap,
   configureAppAngularModule,
-  KbnAccessibleClickProvider,
   PrivateProvider,
   PromiseServiceCreator,
   registerListenEventListener,
@@ -57,14 +51,10 @@ import {
   createTopNavDirective,
   createTopNavHelper,
 } from '../../kibana_legacy/public';
-import { createDiscoverSidebarDirective } from './application/components/sidebar';
-import { createHitsCounterDirective } from '././application/components/hits_counter';
-import { createLoadingSpinnerDirective } from '././application/components/loading_spinner/loading_spinner';
-import { createTimechartHeaderDirective } from './application/components/timechart_header';
 import { createContextErrorMessageDirective } from './application/components/context_error_message';
 import { DiscoverStartPlugins } from './plugin';
 import { getScopedHistory } from './kibana_services';
-import { createSkipBottomButtonDirective } from './application/components/skip_bottom_button';
+import { createDiscoverLegacyDirective } from './application/components/create_discover_legacy_directive';
 
 /**
  * returns the main inner angular module, it contains all the parts of Angular Discover
@@ -88,11 +78,9 @@ export function getInnerAngularModule(
 export function getInnerAngularModuleEmbeddable(
   name: string,
   core: CoreStart,
-  deps: DiscoverStartPlugins,
-  context: PluginInitializerContext
+  deps: DiscoverStartPlugins
 ) {
-  const module = initializeInnerAngularModule(name, core, deps.navigation, deps.data, true);
-  return module;
+  return initializeInnerAngularModule(name, core, deps.navigation, deps.data, true);
 }
 
 let initialized = false;
@@ -129,8 +117,7 @@ export function initializeInnerAngularModule(
       ])
       .config(watchMultiDecorator)
       .directive('icon', (reactDirective) => reactDirective(EuiIcon))
-      .directive('renderComplete', createRenderCompleteDirective)
-      .service('debounce', ['$timeout', DebounceProviderTimeout]);
+      .directive('renderComplete', createRenderCompleteDirective);
   }
 
   return angular
@@ -149,18 +136,9 @@ export function initializeInnerAngularModule(
     ])
     .config(watchMultiDecorator)
     .run(registerListenEventListener)
-    .directive('icon', (reactDirective) => reactDirective(EuiIcon))
-    .directive('kbnAccessibleClick', KbnAccessibleClickProvider)
-    .directive('collapsibleSidebar', CollapsibleSidebarProvider)
-    .directive('fixedScroll', FixedScrollProvider)
     .directive('renderComplete', createRenderCompleteDirective)
-    .directive('discoverSidebar', createDiscoverSidebarDirective)
-    .directive('skipBottomButton', createSkipBottomButtonDirective)
-    .directive('hitsCounter', createHitsCounterDirective)
-    .directive('loadingSpinner', createLoadingSpinnerDirective)
-    .directive('timechartHeader', createTimechartHeaderDirective)
-    .directive('contextErrorMessage', createContextErrorMessageDirective)
-    .service('debounce', ['$timeout', DebounceProviderTimeout]);
+    .directive('discoverLegacy', createDiscoverLegacyDirective)
+    .directive('contextErrorMessage', createContextErrorMessageDirective);
 }
 
 function createLocalPromiseModule() {
diff --git a/src/plugins/discover/public/plugin.ts b/src/plugins/discover/public/plugin.ts
index dd9b57b568e42..440bd3fdf86d3 100644
--- a/src/plugins/discover/public/plugin.ts
+++ b/src/plugins/discover/public/plugin.ts
@@ -327,7 +327,12 @@ export class DiscoverPlugin
       if (this.servicesInitialized) {
         return { core, plugins };
       }
-      const services = await buildServices(core, plugins, this.initializerContext);
+      const services = await buildServices(
+        core,
+        plugins,
+        this.initializerContext,
+        this.getEmbeddableInjector
+      );
       setServices(services);
       this.servicesInitialized = true;
 
@@ -380,12 +385,7 @@ export class DiscoverPlugin
       const { core, plugins } = await this.initializeServices();
       getServices().kibanaLegacy.loadFontAwesome();
       const { getInnerAngularModuleEmbeddable } = await import('./get_inner_angular');
-      getInnerAngularModuleEmbeddable(
-        embeddableAngularName,
-        core,
-        plugins,
-        this.initializerContext
-      );
+      getInnerAngularModuleEmbeddable(embeddableAngularName, core, plugins);
       const mountpoint = document.createElement('div');
       this.embeddableInjector = angular.bootstrap(mountpoint, [embeddableAngularName]);
     }
diff --git a/src/plugins/discover/public/saved_searches/types.ts b/src/plugins/discover/public/saved_searches/types.ts
index d601d087afcee..13361cb647ddc 100644
--- a/src/plugins/discover/public/saved_searches/types.ts
+++ b/src/plugins/discover/public/saved_searches/types.ts
@@ -28,6 +28,7 @@ export interface SavedSearch {
   columns: string[];
   sort: SortOrder[];
   destroy: () => void;
+  lastSavedTitle?: string;
 }
 export interface SavedSearchLoader {
   get: (id: string) => Promise<SavedSearch>;
diff --git a/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx b/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx
index 7a42ed7fad427..b175066b81c8e 100644
--- a/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx
+++ b/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import React from 'react';
+import React, { useState, useEffect } from 'react';
 import { act } from 'react-dom/test-utils';
 import { mount, ReactWrapper } from 'enzyme';
 import sinon from 'sinon';
@@ -111,6 +111,13 @@ export const createUseRequestHelpers = (): UseRequestHelpers => {
         requestConfig
       );
 
+      // Force a re-render of the component to stress-test the useRequest hook and verify its
+      // state remains unaffected.
+      const [, setState] = useState(false);
+      useEffect(() => {
+        setState(true);
+      }, []);
+
       hookResult.isInitialRequest = isInitialRequest;
       hookResult.isLoading = isLoading;
       hookResult.error = error;
diff --git a/src/plugins/es_ui_shared/public/request/use_request.ts b/src/plugins/es_ui_shared/public/request/use_request.ts
index e04f84a67b8a3..9d40291423cac 100644
--- a/src/plugins/es_ui_shared/public/request/use_request.ts
+++ b/src/plugins/es_ui_shared/public/request/use_request.ts
@@ -49,7 +49,7 @@ export const useRequest = <D = any, E = Error>(
 
   // Consumers can use isInitialRequest to implement a polling UX.
   const requestCountRef = useRef<number>(0);
-  const isInitialRequest = requestCountRef.current === 0;
+  const isInitialRequestRef = useRef<boolean>(true);
   const pollIntervalIdRef = useRef<any>(null);
 
   const clearPollInterval = useCallback(() => {
@@ -98,6 +98,9 @@ export const useRequest = <D = any, E = Error>(
       return;
     }
 
+    // Surface to consumers that at least one request has resolved.
+    isInitialRequestRef.current = false;
+
     setError(responseError);
     // If there's an error, keep the data from the last request in case it's still useful to the user.
     if (!responseError) {
@@ -146,7 +149,7 @@ export const useRequest = <D = any, E = Error>(
   }, [clearPollInterval]);
 
   return {
-    isInitialRequest,
+    isInitialRequest: isInitialRequestRef.current,
     isLoading,
     error,
     data,
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_help/test_script.tsx b/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_help/test_script.tsx
index 77c6698fdc337..d5f04810daf56 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_help/test_script.tsx
+++ b/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_help/test_script.tsx
@@ -81,7 +81,7 @@ export class TestScript extends Component<TestScriptProps, TestScriptState> {
   }
 
   previewScript = async (searchContext?: { query?: Query | undefined }) => {
-    const { indexPattern, lang, name, script, executeScript } = this.props;
+    const { indexPattern, name, script, executeScript } = this.props;
 
     if (!script || script.length === 0) {
       return;
@@ -104,7 +104,6 @@ export class TestScript extends Component<TestScriptProps, TestScriptState> {
 
     const scriptResponse = await executeScript({
       name: name as string,
-      lang,
       script,
       indexPatternTitle: indexPattern.title,
       query,
@@ -122,7 +121,7 @@ export class TestScript extends Component<TestScriptProps, TestScriptState> {
 
     this.setState({
       isLoading: false,
-      previewData: scriptResponse.hits.hits.map((hit: any) => ({
+      previewData: scriptResponse.hits?.hits.map((hit: any) => ({
         _id: hit._id,
         ...hit._source,
         ...hit.fields,
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/field_editor.tsx b/src/plugins/index_pattern_management/public/components/field_editor/field_editor.tsx
index 4857a402cc4b2..2b484d1d837bf 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/field_editor.tsx
+++ b/src/plugins/index_pattern_management/public/components/field_editor/field_editor.tsx
@@ -784,7 +784,6 @@ export class FieldEditor extends PureComponent<FieldEdiorProps, FieldEditorState
 
       const isValid = await isScriptValid({
         name: field.name,
-        lang: field.lang as string,
         script: field.script as string,
         indexPatternTitle: indexPattern.title,
         http: this.context.services.http,
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/lib/validate_script.ts b/src/plugins/index_pattern_management/public/components/field_editor/lib/validate_script.ts
index 518cf1086e1d7..d4aeae82a4727 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/lib/validate_script.ts
+++ b/src/plugins/index_pattern_management/public/components/field_editor/lib/validate_script.ts
@@ -17,72 +17,50 @@
  * under the License.
  */
 
-import { Query } from 'src/plugins/data/public';
 import { HttpStart } from 'src/core/public';
 import { ExecuteScriptParams, ExecuteScriptResult } from '../types';
 
 export const executeScript = async ({
   name,
-  lang,
   script,
   indexPatternTitle,
   query,
   additionalFields = [],
   http,
 }: ExecuteScriptParams): Promise<ExecuteScriptResult> => {
-  // Using _msearch because _search with index name in path dorks everything up
-  const header = {
-    index: indexPatternTitle,
-    ignore_unavailable: true,
-  };
-
-  const search = {
-    query: {
-      match_all: {},
-    } as Query['query'],
-    script_fields: {
-      [name]: {
-        script: {
-          lang,
-          source: script,
-        },
-      },
-    },
-    _source: undefined as string[] | undefined,
-    size: 10,
-    timeout: '30s',
-  };
-
-  if (additionalFields.length > 0) {
-    search._source = additionalFields;
-  }
-
-  if (query) {
-    search.query = query;
-  }
-
-  const body = `${JSON.stringify(header)}\n${JSON.stringify(search)}\n`;
-  const esResp = await http.fetch('/elasticsearch/_msearch', { method: 'POST', body });
-  // unwrap _msearch response
-  return esResp.responses[0];
+  return http
+    .post('/internal/index-pattern-management/preview_scripted_field', {
+      body: JSON.stringify({
+        index: indexPatternTitle,
+        name,
+        script,
+        query,
+        additionalFields,
+      }),
+    })
+    .then((res) => ({
+      status: res.statusCode,
+      hits: res.body.hits,
+    }))
+    .catch((err) => ({
+      status: err.statusCode,
+      error: err.body.attributes.error,
+    }));
 };
 
 export const isScriptValid = async ({
   name,
-  lang,
   script,
   indexPatternTitle,
   http,
 }: {
   name: string;
-  lang: string;
   script: string;
   indexPatternTitle: string;
   http: HttpStart;
 }) => {
   const scriptResponse = await executeScript({
     name,
-    lang,
     script,
     indexPatternTitle,
     http,
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/types.ts b/src/plugins/index_pattern_management/public/components/field_editor/types.ts
index 7519cc05e7fae..d716b9d557282 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/types.ts
+++ b/src/plugins/index_pattern_management/public/components/field_editor/types.ts
@@ -28,7 +28,6 @@ export interface Sample {
 
 export interface ExecuteScriptParams {
   name: string;
-  lang: string;
   script: string;
   indexPatternTitle: string;
   query?: Query['query'];
@@ -38,7 +37,7 @@ export interface ExecuteScriptParams {
 
 export interface ExecuteScriptResult {
   status: number;
-  hits: { hits: any[] };
+  hits?: { hits: any[] };
   error?: any;
 }
 
diff --git a/src/plugins/index_pattern_management/server/plugin.ts b/src/plugins/index_pattern_management/server/plugin.ts
index ecca45cbcc453..2bed6761ef362 100644
--- a/src/plugins/index_pattern_management/server/plugin.ts
+++ b/src/plugins/index_pattern_management/server/plugin.ts
@@ -18,7 +18,8 @@
  */
 
 import { PluginInitializerContext, CoreSetup, Plugin } from 'src/core/server';
-import { schema } from '@kbn/config-schema';
+
+import { registerPreviewScriptedFieldRoute, registerResolveIndexRoute } from './routes';
 
 export class IndexPatternManagementPlugin implements Plugin<void, void> {
   constructor(initializerContext: PluginInitializerContext) {}
@@ -26,42 +27,8 @@ export class IndexPatternManagementPlugin implements Plugin<void, void> {
   public setup(core: CoreSetup) {
     const router = core.http.createRouter();
 
-    router.get(
-      {
-        path: '/internal/index-pattern-management/resolve_index/{query}',
-        validate: {
-          params: schema.object({
-            query: schema.string(),
-          }),
-          query: schema.object({
-            expand_wildcards: schema.maybe(
-              schema.oneOf([
-                schema.literal('all'),
-                schema.literal('open'),
-                schema.literal('closed'),
-                schema.literal('hidden'),
-                schema.literal('none'),
-              ])
-            ),
-          }),
-        },
-      },
-      async (context, req, res) => {
-        const queryString = req.query.expand_wildcards
-          ? { expand_wildcards: req.query.expand_wildcards }
-          : null;
-        const result = await context.core.elasticsearch.legacy.client.callAsCurrentUser(
-          'transport.request',
-          {
-            method: 'GET',
-            path: `/_resolve/index/${encodeURIComponent(req.params.query)}${
-              queryString ? '?' + new URLSearchParams(queryString).toString() : ''
-            }`,
-          }
-        );
-        return res.ok({ body: result });
-      }
-    );
+    registerPreviewScriptedFieldRoute(router);
+    registerResolveIndexRoute(router);
   }
 
   public start() {}
diff --git a/src/legacy/server/status/routes/index.js b/src/plugins/index_pattern_management/server/routes/index.ts
similarity index 87%
rename from src/legacy/server/status/routes/index.js
rename to src/plugins/index_pattern_management/server/routes/index.ts
index 12736a76d4915..14d53f10970d5 100644
--- a/src/legacy/server/status/routes/index.js
+++ b/src/plugins/index_pattern_management/server/routes/index.ts
@@ -17,5 +17,5 @@
  * under the License.
  */
 
-export { registerStatusApi } from './api/register_status';
-export { registerStatsApi } from './api/register_stats';
+export * from './preview_scripted_field';
+export * from './resolve_index';
diff --git a/src/plugins/index_pattern_management/server/routes/preview_scripted_field.test.ts b/src/plugins/index_pattern_management/server/routes/preview_scripted_field.test.ts
new file mode 100644
index 0000000000000..5de6ddf351c02
--- /dev/null
+++ b/src/plugins/index_pattern_management/server/routes/preview_scripted_field.test.ts
@@ -0,0 +1,181 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { CoreSetup, RequestHandlerContext } from 'src/core/server';
+import { coreMock, httpServerMock } from '../../../../../src/core/server/mocks';
+import { registerPreviewScriptedFieldRoute } from './preview_scripted_field';
+
+describe('preview_scripted_field route', () => {
+  let mockCoreSetup: MockedKeys<CoreSetup>;
+
+  beforeEach(() => {
+    mockCoreSetup = coreMock.createSetup();
+  });
+
+  it('handler calls /_search with the given request', async () => {
+    const response = { body: { responses: [{ hits: { _id: 'hi' } }] } };
+    const mockClient = { search: jest.fn().mockResolvedValue(response) };
+    const mockContext = {
+      core: {
+        elasticsearch: { client: { asCurrentUser: mockClient } },
+      },
+    };
+    const mockBody = {
+      index: 'kibana_sample_data_logs',
+      name: 'my_scripted_field',
+      script: `doc['foo'].value`,
+    };
+    const mockQuery = {};
+    const mockRequest = httpServerMock.createKibanaRequest({
+      body: mockBody,
+      query: mockQuery,
+    });
+    const mockResponse = httpServerMock.createResponseFactory();
+
+    registerPreviewScriptedFieldRoute(mockCoreSetup.http.createRouter());
+
+    const mockRouter = mockCoreSetup.http.createRouter.mock.results[0].value;
+    const handler = mockRouter.post.mock.calls[0][1];
+    await handler((mockContext as unknown) as RequestHandlerContext, mockRequest, mockResponse);
+
+    expect(mockClient.search.mock.calls[0][0]).toMatchInlineSnapshot(`
+      Object {
+        "_source": undefined,
+        "body": Object {
+          "query": Object {
+            "match_all": Object {},
+          },
+          "script_fields": Object {
+            "my_scripted_field": Object {
+              "script": Object {
+                "lang": "painless",
+                "source": "doc['foo'].value",
+              },
+            },
+          },
+        },
+        "index": "kibana_sample_data_logs",
+        "size": 10,
+        "timeout": "30s",
+      }
+    `);
+
+    expect(mockResponse.ok).toBeCalled();
+    expect(mockResponse.ok.mock.calls[0][0]).toEqual({ body: response });
+  });
+
+  it('uses optional parameters when they are provided', async () => {
+    const response = { body: { responses: [{ hits: { _id: 'hi' } }] } };
+    const mockClient = { search: jest.fn().mockResolvedValue(response) };
+    const mockContext = {
+      core: {
+        elasticsearch: { client: { asCurrentUser: mockClient } },
+      },
+    };
+    const mockBody = {
+      index: 'kibana_sample_data_logs',
+      name: 'my_scripted_field',
+      script: `doc['foo'].value`,
+      query: {
+        bool: { some: 'query' },
+      },
+      additionalFields: ['a', 'b', 'c'],
+    };
+    const mockQuery = {};
+    const mockRequest = httpServerMock.createKibanaRequest({
+      body: mockBody,
+      query: mockQuery,
+    });
+    const mockResponse = httpServerMock.createResponseFactory();
+
+    registerPreviewScriptedFieldRoute(mockCoreSetup.http.createRouter());
+
+    const mockRouter = mockCoreSetup.http.createRouter.mock.results[0].value;
+    const handler = mockRouter.post.mock.calls[0][1];
+    await handler((mockContext as unknown) as RequestHandlerContext, mockRequest, mockResponse);
+
+    expect(mockClient.search.mock.calls[0][0]).toMatchInlineSnapshot(`
+      Object {
+        "_source": Array [
+          "a",
+          "b",
+          "c",
+        ],
+        "body": Object {
+          "query": Object {
+            "bool": Object {
+              "some": "query",
+            },
+          },
+          "script_fields": Object {
+            "my_scripted_field": Object {
+              "script": Object {
+                "lang": "painless",
+                "source": "doc['foo'].value",
+              },
+            },
+          },
+        },
+        "index": "kibana_sample_data_logs",
+        "size": 10,
+        "timeout": "30s",
+      }
+    `);
+  });
+
+  it('handler throws an error if the search throws an error', async () => {
+    const response = {
+      statusCode: 400,
+      message: 'oops',
+    };
+    const mockClient = { search: jest.fn().mockReturnValue(Promise.reject(response)) };
+    const mockContext = {
+      core: {
+        elasticsearch: { client: { asCurrentUser: mockClient } },
+      },
+    };
+    const mockBody = { searches: [{ header: {}, body: {} }] };
+    const mockQuery = {};
+    const mockRequest = httpServerMock.createKibanaRequest({
+      body: mockBody,
+      query: mockQuery,
+    });
+    const mockResponse = httpServerMock.createResponseFactory();
+
+    registerPreviewScriptedFieldRoute(mockCoreSetup.http.createRouter());
+
+    const mockRouter = mockCoreSetup.http.createRouter.mock.results[0].value;
+    const handler = mockRouter.post.mock.calls[0][1];
+    await handler((mockContext as unknown) as RequestHandlerContext, mockRequest, mockResponse);
+
+    expect(mockClient.search).toBeCalled();
+    expect(mockResponse.customError).toBeCalled();
+
+    const error: any = mockResponse.customError.mock.calls[0][0];
+    expect(error.statusCode).toBe(400);
+    expect(error.body).toMatchInlineSnapshot(`
+      Object {
+        "attributes": Object {
+          "error": "oops",
+        },
+        "message": "oops",
+      }
+    `);
+  });
+});
diff --git a/src/plugins/index_pattern_management/server/routes/preview_scripted_field.ts b/src/plugins/index_pattern_management/server/routes/preview_scripted_field.ts
new file mode 100644
index 0000000000000..849263748aeaa
--- /dev/null
+++ b/src/plugins/index_pattern_management/server/routes/preview_scripted_field.ts
@@ -0,0 +1,74 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { IRouter } from 'src/core/server';
+
+export function registerPreviewScriptedFieldRoute(router: IRouter): void {
+  router.post(
+    {
+      path: '/internal/index-pattern-management/preview_scripted_field',
+      validate: {
+        body: schema.object({
+          index: schema.string(),
+          name: schema.string(),
+          script: schema.string(),
+          query: schema.maybe(schema.object({}, { unknowns: 'allow' })),
+          additionalFields: schema.maybe(schema.arrayOf(schema.string())),
+        }),
+      },
+    },
+    async (context, request, res) => {
+      const client = context.core.elasticsearch.client.asCurrentUser;
+      const { index, name, script, query, additionalFields } = request.body;
+
+      try {
+        const response = await client.search({
+          index,
+          _source: additionalFields && additionalFields.length > 0 ? additionalFields : undefined,
+          size: 10,
+          timeout: '30s',
+          body: {
+            query: query ?? { match_all: {} },
+            script_fields: {
+              [name]: {
+                script: {
+                  lang: 'painless',
+                  source: script,
+                },
+              },
+            },
+          },
+        });
+
+        return res.ok({ body: response });
+      } catch (err) {
+        return res.customError({
+          statusCode: err.statusCode || 500,
+          body: {
+            message: err.message,
+            attributes: {
+              error: err.body?.error || err.message,
+            },
+          },
+        });
+      }
+    }
+  );
+}
diff --git a/src/plugins/index_pattern_management/server/routes/resolve_index.ts b/src/plugins/index_pattern_management/server/routes/resolve_index.ts
new file mode 100644
index 0000000000000..1d3d89a94e391
--- /dev/null
+++ b/src/plugins/index_pattern_management/server/routes/resolve_index.ts
@@ -0,0 +1,60 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { IRouter } from 'src/core/server';
+
+export function registerResolveIndexRoute(router: IRouter): void {
+  router.get(
+    {
+      path: '/internal/index-pattern-management/resolve_index/{query}',
+      validate: {
+        params: schema.object({
+          query: schema.string(),
+        }),
+        query: schema.object({
+          expand_wildcards: schema.maybe(
+            schema.oneOf([
+              schema.literal('all'),
+              schema.literal('open'),
+              schema.literal('closed'),
+              schema.literal('hidden'),
+              schema.literal('none'),
+            ])
+          ),
+        }),
+      },
+    },
+    async (context, req, res) => {
+      const queryString = req.query.expand_wildcards
+        ? { expand_wildcards: req.query.expand_wildcards }
+        : null;
+      const result = await context.core.elasticsearch.legacy.client.callAsCurrentUser(
+        'transport.request',
+        {
+          method: 'GET',
+          path: `/_resolve/index/${encodeURIComponent(req.params.query)}${
+            queryString ? '?' + new URLSearchParams(queryString).toString() : ''
+          }`,
+        }
+      );
+      return res.ok({ body: result });
+    }
+  );
+}
diff --git a/src/plugins/kibana_usage_collection/server/collectors/application_usage/README.md b/src/plugins/kibana_usage_collection/server/collectors/application_usage/README.md
index 1ffd01fc6fde7..cb80538fd1718 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/application_usage/README.md
+++ b/src/plugins/kibana_usage_collection/server/collectors/application_usage/README.md
@@ -28,10 +28,10 @@ This collection occurs by default for every application registered via the menti
 
 ## Developer notes
 
-In order to keep the count of the events, this collector uses 2 Saved Objects:
+In order to keep the count of the events, this collector uses 3 Saved Objects:
 
-1. `application_usage_transactional`: It stores each individually reported event (up to 90 days old). Grouped by `timestamp` and `appId`.
-2. `application_usage_totals`: It stores the sum of all the events older than 90 days old per `appId`.
+1. `application_usage_transactional`: It stores each individually reported event. Grouped by `timestamp` and `appId`. The reason for having these documents instead of editing `application_usage_daily` documents on very report is to provide faster response to the requests to `/api/ui_metric/report` (creating new documents instead of finding and editing existing ones) and to avoid conflicts when multiple users reach to the API concurrently.
+2. `application_usage_daily`: Periodically, documents from `application_usage_transactional` are aggregated to daily summaries and deleted. Also grouped by `timestamp` and `appId`.
+3. `application_usage_totals`: It stores the sum of all the events older than 90 days old, grouped by `appId`.
 
-Both of them use the shared fields `appId: 'keyword'`, `numberOfClicks: 'long'` and `minutesOnScreen: 'float'`. `application_usage_transactional` also stores `timestamp: { type: 'date' }`.
-but they are currently not added in the mappings because we don't use them for search purposes, and we need to be thoughtful with the number of mapped fields in the SavedObjects index ([#43673](https://github.com/elastic/kibana/issues/43673)).
+All the types use the shared fields `appId: 'keyword'`, `numberOfClicks: 'long'` and `minutesOnScreen: 'float'`, but they are currently not added in the mappings because we don't use them for search purposes, and we need to be thoughtful with the number of mapped fields in the SavedObjects index ([#43673](https://github.com/elastic/kibana/issues/43673)). `application_usage_transactional` and `application_usage_daily` also store `timestamp: { type: 'date' }`.
diff --git a/src/plugins/kibana_usage_collection/server/collectors/application_usage/index.test.ts b/src/plugins/kibana_usage_collection/server/collectors/application_usage/index.test.ts
deleted file mode 100644
index 5658b38120596..0000000000000
--- a/src/plugins/kibana_usage_collection/server/collectors/application_usage/index.test.ts
+++ /dev/null
@@ -1,151 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { savedObjectsRepositoryMock } from '../../../../../core/server/mocks';
-import {
-  CollectorOptions,
-  createUsageCollectionSetupMock,
-} from '../../../../usage_collection/server/usage_collection.mock';
-
-import { registerApplicationUsageCollector } from './';
-import {
-  ROLL_INDICES_INTERVAL,
-  SAVED_OBJECTS_TOTAL_TYPE,
-  SAVED_OBJECTS_TRANSACTIONAL_TYPE,
-} from './telemetry_application_usage_collector';
-
-describe('telemetry_application_usage', () => {
-  jest.useFakeTimers();
-
-  let collector: CollectorOptions;
-
-  const usageCollectionMock = createUsageCollectionSetupMock();
-  usageCollectionMock.makeUsageCollector.mockImplementation((config) => {
-    collector = config;
-    return createUsageCollectionSetupMock().makeUsageCollector(config);
-  });
-
-  const getUsageCollector = jest.fn();
-  const registerType = jest.fn();
-  const callCluster = jest.fn();
-
-  beforeAll(() =>
-    registerApplicationUsageCollector(usageCollectionMock, registerType, getUsageCollector)
-  );
-  afterAll(() => jest.clearAllTimers());
-
-  test('registered collector is set', () => {
-    expect(collector).not.toBeUndefined();
-  });
-
-  test('if no savedObjectClient initialised, return undefined', async () => {
-    expect(await collector.fetch(callCluster)).toBeUndefined();
-    jest.runTimersToTime(ROLL_INDICES_INTERVAL);
-  });
-
-  test('when savedObjectClient is initialised, return something', async () => {
-    const savedObjectClient = savedObjectsRepositoryMock.create();
-    savedObjectClient.find.mockImplementation(
-      async () =>
-        ({
-          saved_objects: [],
-          total: 0,
-        } as any)
-    );
-    getUsageCollector.mockImplementation(() => savedObjectClient);
-
-    jest.runTimersToTime(ROLL_INDICES_INTERVAL); // Force rollTotals to run
-
-    expect(await collector.fetch(callCluster)).toStrictEqual({});
-    expect(savedObjectClient.bulkCreate).not.toHaveBeenCalled();
-  });
-
-  test('paging in findAll works', async () => {
-    const savedObjectClient = savedObjectsRepositoryMock.create();
-    let total = 201;
-    savedObjectClient.find.mockImplementation(async (opts) => {
-      if (opts.type === SAVED_OBJECTS_TOTAL_TYPE) {
-        return {
-          saved_objects: [
-            {
-              id: 'appId',
-              attributes: {
-                appId: 'appId',
-                minutesOnScreen: 10,
-                numberOfClicks: 10,
-              },
-            },
-          ],
-          total: 1,
-        } as any;
-      }
-      if ((opts.page || 1) > 2) {
-        return { saved_objects: [], total };
-      }
-      const doc = {
-        id: 'test-id',
-        attributes: {
-          appId: 'appId',
-          timestamp: new Date().toISOString(),
-          minutesOnScreen: 1,
-          numberOfClicks: 1,
-        },
-      };
-      const savedObjects = new Array(opts.perPage).fill(doc);
-      total = savedObjects.length * 2 + 1;
-      return { saved_objects: savedObjects, total };
-    });
-
-    getUsageCollector.mockImplementation(() => savedObjectClient);
-
-    jest.runTimersToTime(ROLL_INDICES_INTERVAL); // Force rollTotals to run
-
-    expect(await collector.fetch(callCluster)).toStrictEqual({
-      appId: {
-        clicks_total: total - 1 + 10,
-        clicks_7_days: total - 1,
-        clicks_30_days: total - 1,
-        clicks_90_days: total - 1,
-        minutes_on_screen_total: total - 1 + 10,
-        minutes_on_screen_7_days: total - 1,
-        minutes_on_screen_30_days: total - 1,
-        minutes_on_screen_90_days: total - 1,
-      },
-    });
-    expect(savedObjectClient.bulkCreate).toHaveBeenCalledWith(
-      [
-        {
-          id: 'appId',
-          type: SAVED_OBJECTS_TOTAL_TYPE,
-          attributes: {
-            appId: 'appId',
-            minutesOnScreen: total - 1 + 10,
-            numberOfClicks: total - 1 + 10,
-          },
-        },
-      ],
-      { overwrite: true }
-    );
-    expect(savedObjectClient.delete).toHaveBeenCalledTimes(total - 1);
-    expect(savedObjectClient.delete).toHaveBeenCalledWith(
-      SAVED_OBJECTS_TRANSACTIONAL_TYPE,
-      'test-id'
-    );
-  });
-});
diff --git a/src/plugins/kibana_usage_collection/server/collectors/application_usage/rollups.test.ts b/src/plugins/kibana_usage_collection/server/collectors/application_usage/rollups.test.ts
new file mode 100644
index 0000000000000..f8bc17fc40df0
--- /dev/null
+++ b/src/plugins/kibana_usage_collection/server/collectors/application_usage/rollups.test.ts
@@ -0,0 +1,299 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { rollDailyData, rollTotals } from './rollups';
+import { savedObjectsRepositoryMock, loggingSystemMock } from '../../../../../core/server/mocks';
+import { SavedObjectsErrorHelpers } from '../../../../../core/server';
+import {
+  SAVED_OBJECTS_DAILY_TYPE,
+  SAVED_OBJECTS_TOTAL_TYPE,
+  SAVED_OBJECTS_TRANSACTIONAL_TYPE,
+} from './saved_objects_types';
+
+describe('rollDailyData', () => {
+  const logger = loggingSystemMock.createLogger();
+
+  test('returns undefined if no savedObjectsClient initialised yet', async () => {
+    await expect(rollDailyData(logger, undefined)).resolves.toBe(undefined);
+  });
+
+  test('handle empty results', async () => {
+    const savedObjectClient = savedObjectsRepositoryMock.create();
+    savedObjectClient.find.mockImplementation(async ({ type, page = 1, perPage = 10 }) => {
+      switch (type) {
+        case SAVED_OBJECTS_TRANSACTIONAL_TYPE:
+          return { saved_objects: [], total: 0, page, per_page: perPage };
+        default:
+          throw new Error(`Unexpected type [${type}]`);
+      }
+    });
+    await expect(rollDailyData(logger, savedObjectClient)).resolves.toBe(undefined);
+    expect(savedObjectClient.get).not.toBeCalled();
+    expect(savedObjectClient.bulkCreate).not.toBeCalled();
+    expect(savedObjectClient.delete).not.toBeCalled();
+  });
+
+  test('migrate some docs', async () => {
+    const savedObjectClient = savedObjectsRepositoryMock.create();
+    let timesCalled = 0;
+    savedObjectClient.find.mockImplementation(async ({ type, page = 1, perPage = 10 }) => {
+      switch (type) {
+        case SAVED_OBJECTS_TRANSACTIONAL_TYPE:
+          if (timesCalled++ > 0) {
+            return { saved_objects: [], total: 0, page, per_page: perPage };
+          }
+          return {
+            saved_objects: [
+              {
+                id: 'test-id-1',
+                type,
+                score: 0,
+                references: [],
+                attributes: {
+                  appId: 'appId',
+                  timestamp: '2020-01-01T10:31:00.000Z',
+                  minutesOnScreen: 0.5,
+                  numberOfClicks: 1,
+                },
+              },
+              {
+                id: 'test-id-2',
+                type,
+                score: 0,
+                references: [],
+                attributes: {
+                  appId: 'appId',
+                  timestamp: '2020-01-01T11:31:00.000Z',
+                  minutesOnScreen: 1.5,
+                  numberOfClicks: 2,
+                },
+              },
+            ],
+            total: 2,
+            page,
+            per_page: perPage,
+          };
+        default:
+          throw new Error(`Unexpected type [${type}]`);
+      }
+    });
+
+    savedObjectClient.get.mockImplementation(async (type, id) => {
+      throw SavedObjectsErrorHelpers.createGenericNotFoundError(type, id);
+    });
+
+    await expect(rollDailyData(logger, savedObjectClient)).resolves.toBe(undefined);
+    expect(savedObjectClient.get).toHaveBeenCalledTimes(1);
+    expect(savedObjectClient.get).toHaveBeenCalledWith(
+      SAVED_OBJECTS_DAILY_TYPE,
+      'appId:2020-01-01'
+    );
+    expect(savedObjectClient.bulkCreate).toHaveBeenCalledTimes(1);
+    expect(savedObjectClient.bulkCreate).toHaveBeenCalledWith(
+      [
+        {
+          type: SAVED_OBJECTS_DAILY_TYPE,
+          id: 'appId:2020-01-01',
+          attributes: {
+            appId: 'appId',
+            timestamp: '2020-01-01T00:00:00.000Z',
+            minutesOnScreen: 2.0,
+            numberOfClicks: 3,
+          },
+        },
+      ],
+      { overwrite: true }
+    );
+    expect(savedObjectClient.delete).toHaveBeenCalledTimes(2);
+    expect(savedObjectClient.delete).toHaveBeenCalledWith(
+      SAVED_OBJECTS_TRANSACTIONAL_TYPE,
+      'test-id-1'
+    );
+    expect(savedObjectClient.delete).toHaveBeenCalledWith(
+      SAVED_OBJECTS_TRANSACTIONAL_TYPE,
+      'test-id-2'
+    );
+  });
+
+  test('error getting the daily document', async () => {
+    const savedObjectClient = savedObjectsRepositoryMock.create();
+    let timesCalled = 0;
+    savedObjectClient.find.mockImplementation(async ({ type, page = 1, perPage = 10 }) => {
+      switch (type) {
+        case SAVED_OBJECTS_TRANSACTIONAL_TYPE:
+          if (timesCalled++ > 0) {
+            return { saved_objects: [], total: 0, page, per_page: perPage };
+          }
+          return {
+            saved_objects: [
+              {
+                id: 'test-id-1',
+                type,
+                score: 0,
+                references: [],
+                attributes: {
+                  appId: 'appId',
+                  timestamp: '2020-01-01T10:31:00.000Z',
+                  minutesOnScreen: 0.5,
+                  numberOfClicks: 1,
+                },
+              },
+            ],
+            total: 1,
+            page,
+            per_page: perPage,
+          };
+        default:
+          throw new Error(`Unexpected type [${type}]`);
+      }
+    });
+
+    savedObjectClient.get.mockImplementation(async (type, id) => {
+      throw new Error('Something went terribly wrong');
+    });
+
+    await expect(rollDailyData(logger, savedObjectClient)).resolves.toBe(undefined);
+    expect(savedObjectClient.get).toHaveBeenCalledTimes(1);
+    expect(savedObjectClient.get).toHaveBeenCalledWith(
+      SAVED_OBJECTS_DAILY_TYPE,
+      'appId:2020-01-01'
+    );
+    expect(savedObjectClient.bulkCreate).toHaveBeenCalledTimes(0);
+    expect(savedObjectClient.delete).toHaveBeenCalledTimes(0);
+  });
+});
+
+describe('rollTotals', () => {
+  const logger = loggingSystemMock.createLogger();
+
+  test('returns undefined if no savedObjectsClient initialised yet', async () => {
+    await expect(rollTotals(logger, undefined)).resolves.toBe(undefined);
+  });
+
+  test('handle empty results', async () => {
+    const savedObjectClient = savedObjectsRepositoryMock.create();
+    savedObjectClient.find.mockImplementation(async ({ type, page = 1, perPage = 10 }) => {
+      switch (type) {
+        case SAVED_OBJECTS_DAILY_TYPE:
+        case SAVED_OBJECTS_TOTAL_TYPE:
+          return { saved_objects: [], total: 0, page, per_page: perPage };
+        default:
+          throw new Error(`Unexpected type [${type}]`);
+      }
+    });
+    await expect(rollTotals(logger, savedObjectClient)).resolves.toBe(undefined);
+    expect(savedObjectClient.bulkCreate).toHaveBeenCalledTimes(0);
+    expect(savedObjectClient.delete).toHaveBeenCalledTimes(0);
+  });
+
+  test('migrate some documents', async () => {
+    const savedObjectClient = savedObjectsRepositoryMock.create();
+    savedObjectClient.find.mockImplementation(async ({ type, page = 1, perPage = 10 }) => {
+      switch (type) {
+        case SAVED_OBJECTS_DAILY_TYPE:
+          return {
+            saved_objects: [
+              {
+                id: 'appId-2:2020-01-01',
+                type,
+                score: 0,
+                references: [],
+                attributes: {
+                  appId: 'appId-2',
+                  timestamp: '2020-01-01T10:31:00.000Z',
+                  minutesOnScreen: 0.5,
+                  numberOfClicks: 1,
+                },
+              },
+              {
+                id: 'appId-1:2020-01-01',
+                type,
+                score: 0,
+                references: [],
+                attributes: {
+                  appId: 'appId-1',
+                  timestamp: '2020-01-01T11:31:00.000Z',
+                  minutesOnScreen: 1.5,
+                  numberOfClicks: 2,
+                },
+              },
+            ],
+            total: 2,
+            page,
+            per_page: perPage,
+          };
+        case SAVED_OBJECTS_TOTAL_TYPE:
+          return {
+            saved_objects: [
+              {
+                id: 'appId-1',
+                type,
+                score: 0,
+                references: [],
+                attributes: {
+                  appId: 'appId-1',
+                  minutesOnScreen: 0.5,
+                  numberOfClicks: 1,
+                },
+              },
+            ],
+            total: 1,
+            page,
+            per_page: perPage,
+          };
+        default:
+          throw new Error(`Unexpected type [${type}]`);
+      }
+    });
+    await expect(rollTotals(logger, savedObjectClient)).resolves.toBe(undefined);
+    expect(savedObjectClient.bulkCreate).toHaveBeenCalledTimes(1);
+    expect(savedObjectClient.bulkCreate).toHaveBeenCalledWith(
+      [
+        {
+          type: SAVED_OBJECTS_TOTAL_TYPE,
+          id: 'appId-1',
+          attributes: {
+            appId: 'appId-1',
+            minutesOnScreen: 2.0,
+            numberOfClicks: 3,
+          },
+        },
+        {
+          type: SAVED_OBJECTS_TOTAL_TYPE,
+          id: 'appId-2',
+          attributes: {
+            appId: 'appId-2',
+            minutesOnScreen: 0.5,
+            numberOfClicks: 1,
+          },
+        },
+      ],
+      { overwrite: true }
+    );
+    expect(savedObjectClient.delete).toHaveBeenCalledTimes(2);
+    expect(savedObjectClient.delete).toHaveBeenCalledWith(
+      SAVED_OBJECTS_DAILY_TYPE,
+      'appId-2:2020-01-01'
+    );
+    expect(savedObjectClient.delete).toHaveBeenCalledWith(
+      SAVED_OBJECTS_DAILY_TYPE,
+      'appId-1:2020-01-01'
+    );
+  });
+});
diff --git a/src/plugins/kibana_usage_collection/server/collectors/application_usage/rollups.ts b/src/plugins/kibana_usage_collection/server/collectors/application_usage/rollups.ts
new file mode 100644
index 0000000000000..3020147e95d98
--- /dev/null
+++ b/src/plugins/kibana_usage_collection/server/collectors/application_usage/rollups.ts
@@ -0,0 +1,202 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ISavedObjectsRepository, SavedObject, Logger } from 'kibana/server';
+import moment from 'moment';
+import {
+  ApplicationUsageDaily,
+  ApplicationUsageTotal,
+  ApplicationUsageTransactional,
+  SAVED_OBJECTS_DAILY_TYPE,
+  SAVED_OBJECTS_TOTAL_TYPE,
+  SAVED_OBJECTS_TRANSACTIONAL_TYPE,
+} from './saved_objects_types';
+import { SavedObjectsErrorHelpers } from '../../../../../../src/core/server';
+
+/**
+ * For Rolling the daily data, we only care about the stored attributes and the version (to avoid overwriting via concurrent requests)
+ */
+type ApplicationUsageDailyWithVersion = Pick<
+  SavedObject<ApplicationUsageDaily>,
+  'version' | 'attributes'
+>;
+
+/**
+ * Aggregates all the transactional events into daily aggregates
+ * @param logger
+ * @param savedObjectsClient
+ */
+export async function rollDailyData(logger: Logger, savedObjectsClient?: ISavedObjectsRepository) {
+  if (!savedObjectsClient) {
+    return;
+  }
+
+  try {
+    let toCreate: Map<string, ApplicationUsageDailyWithVersion>;
+    do {
+      toCreate = new Map();
+      const { saved_objects: rawApplicationUsageTransactional } = await savedObjectsClient.find<
+        ApplicationUsageTransactional
+      >({
+        type: SAVED_OBJECTS_TRANSACTIONAL_TYPE,
+        perPage: 1000, // Process 1000 at a time as a compromise of speed and overload
+      });
+
+      for (const doc of rawApplicationUsageTransactional) {
+        const {
+          attributes: { appId, minutesOnScreen, numberOfClicks, timestamp },
+        } = doc;
+        const dayId = moment(timestamp).format('YYYY-MM-DD');
+        const dailyId = `${appId}:${dayId}`;
+        const existingDoc =
+          toCreate.get(dailyId) || (await getDailyDoc(savedObjectsClient, dailyId, appId, dayId));
+        toCreate.set(dailyId, {
+          ...existingDoc,
+          attributes: {
+            ...existingDoc.attributes,
+            minutesOnScreen: existingDoc.attributes.minutesOnScreen + minutesOnScreen,
+            numberOfClicks: existingDoc.attributes.numberOfClicks + numberOfClicks,
+          },
+        });
+      }
+      if (toCreate.size > 0) {
+        await savedObjectsClient.bulkCreate(
+          [...toCreate.entries()].map(([id, { attributes, version }]) => ({
+            type: SAVED_OBJECTS_DAILY_TYPE,
+            id,
+            attributes,
+            version, // Providing version to ensure via conflict matching that only 1 Kibana instance (or interval) is taking care of the updates
+          })),
+          { overwrite: true }
+        );
+        await Promise.all(
+          rawApplicationUsageTransactional.map(
+            ({ id }) => savedObjectsClient.delete(SAVED_OBJECTS_TRANSACTIONAL_TYPE, id) // There is no bulkDelete :(
+          )
+        );
+      }
+    } while (toCreate.size > 0);
+  } catch (err) {
+    logger.warn(`Failed to rollup transactional to daily entries`);
+    logger.warn(err);
+  }
+}
+
+/**
+ * Gets daily doc from the SavedObjects repository. Creates a new one if not found
+ * @param savedObjectsClient
+ * @param id The ID of the document to retrieve (typically, `${appId}:${dayId}`)
+ * @param appId The application ID
+ * @param dayId The date of the document in the format YYYY-MM-DD
+ */
+async function getDailyDoc(
+  savedObjectsClient: ISavedObjectsRepository,
+  id: string,
+  appId: string,
+  dayId: string
+): Promise<ApplicationUsageDailyWithVersion> {
+  try {
+    return await savedObjectsClient.get<ApplicationUsageDaily>(SAVED_OBJECTS_DAILY_TYPE, id);
+  } catch (err) {
+    if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
+      return {
+        attributes: {
+          appId,
+          // Concatenating the day in YYYY-MM-DD form to T00:00:00Z to reduce the TZ effects
+          timestamp: moment(`${moment(dayId).format('YYYY-MM-DD')}T00:00:00Z`).toISOString(),
+          minutesOnScreen: 0,
+          numberOfClicks: 0,
+        },
+      };
+    }
+    throw err;
+  }
+}
+
+/**
+ * Moves all the daily documents into aggregated "total" documents as we don't care about any granularity after 90 days
+ * @param logger
+ * @param savedObjectsClient
+ */
+export async function rollTotals(logger: Logger, savedObjectsClient?: ISavedObjectsRepository) {
+  if (!savedObjectsClient) {
+    return;
+  }
+
+  try {
+    const [
+      { saved_objects: rawApplicationUsageTotals },
+      { saved_objects: rawApplicationUsageDaily },
+    ] = await Promise.all([
+      savedObjectsClient.find<ApplicationUsageTotal>({
+        perPage: 10000,
+        type: SAVED_OBJECTS_TOTAL_TYPE,
+      }),
+      savedObjectsClient.find<ApplicationUsageDaily>({
+        perPage: 10000,
+        type: SAVED_OBJECTS_DAILY_TYPE,
+        filter: `${SAVED_OBJECTS_DAILY_TYPE}.attributes.timestamp < now-90d`,
+      }),
+    ]);
+
+    const existingTotals = rawApplicationUsageTotals.reduce(
+      (acc, { attributes: { appId, numberOfClicks, minutesOnScreen } }) => {
+        return {
+          ...acc,
+          // No need to sum because there should be 1 document per appId only
+          [appId]: { appId, numberOfClicks, minutesOnScreen },
+        };
+      },
+      {} as Record<string, { appId: string; minutesOnScreen: number; numberOfClicks: number }>
+    );
+
+    const totals = rawApplicationUsageDaily.reduce((acc, { attributes }) => {
+      const { appId, numberOfClicks, minutesOnScreen } = attributes;
+
+      const existing = acc[appId] || { minutesOnScreen: 0, numberOfClicks: 0 };
+
+      return {
+        ...acc,
+        [appId]: {
+          appId,
+          numberOfClicks: numberOfClicks + existing.numberOfClicks,
+          minutesOnScreen: minutesOnScreen + existing.minutesOnScreen,
+        },
+      };
+    }, existingTotals);
+
+    await Promise.all([
+      Object.entries(totals).length &&
+        savedObjectsClient.bulkCreate<ApplicationUsageTotal>(
+          Object.entries(totals).map(([id, entry]) => ({
+            type: SAVED_OBJECTS_TOTAL_TYPE,
+            id,
+            attributes: entry,
+          })),
+          { overwrite: true }
+        ),
+      ...rawApplicationUsageDaily.map(
+        ({ id }) => savedObjectsClient.delete(SAVED_OBJECTS_DAILY_TYPE, id) // There is no bulkDelete :(
+      ),
+    ]);
+  } catch (err) {
+    logger.warn(`Failed to rollup daily entries to totals`);
+    logger.warn(err);
+  }
+}
diff --git a/src/plugins/kibana_usage_collection/server/collectors/application_usage/saved_objects_types.ts b/src/plugins/kibana_usage_collection/server/collectors/application_usage/saved_objects_types.ts
index 551c6e230972e..861dc98c0c465 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/application_usage/saved_objects_types.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/application_usage/saved_objects_types.ts
@@ -19,19 +19,34 @@
 
 import { SavedObjectAttributes, SavedObjectsServiceSetup } from 'kibana/server';
 
+/**
+ * Used for accumulating the totals of all the stats older than 90d
+ */
 export interface ApplicationUsageTotal extends SavedObjectAttributes {
   appId: string;
   minutesOnScreen: number;
   numberOfClicks: number;
 }
+export const SAVED_OBJECTS_TOTAL_TYPE = 'application_usage_totals';
 
+/**
+ * Used for storing each of the reports received from the users' browsers
+ */
 export interface ApplicationUsageTransactional extends ApplicationUsageTotal {
   timestamp: string;
 }
+export const SAVED_OBJECTS_TRANSACTIONAL_TYPE = 'application_usage_transactional';
+
+/**
+ * Used to aggregate the transactional events into daily summaries so we can purge the granular events
+ */
+export type ApplicationUsageDaily = ApplicationUsageTransactional;
+export const SAVED_OBJECTS_DAILY_TYPE = 'application_usage_daily';
 
 export function registerMappings(registerType: SavedObjectsServiceSetup['registerType']) {
+  // Type for storing ApplicationUsageTotal
   registerType({
-    name: 'application_usage_totals',
+    name: SAVED_OBJECTS_TOTAL_TYPE,
     hidden: false,
     namespaceType: 'agnostic',
     mappings: {
@@ -42,15 +57,28 @@ export function registerMappings(registerType: SavedObjectsServiceSetup['registe
     },
   });
 
+  // Type for storing ApplicationUsageDaily
   registerType({
-    name: 'application_usage_transactional',
+    name: SAVED_OBJECTS_DAILY_TYPE,
     hidden: false,
     namespaceType: 'agnostic',
     mappings: {
       dynamic: false,
       properties: {
+        // This type requires `timestamp` to be indexed so we can use it when rolling up totals (timestamp < now-90d)
         timestamp: { type: 'date' },
       },
     },
   });
+
+  // Type for storing ApplicationUsageTransactional (declaring empty mappings because we don't use the internal fields for query/aggregations)
+  registerType({
+    name: SAVED_OBJECTS_TRANSACTIONAL_TYPE,
+    hidden: false,
+    namespaceType: 'agnostic',
+    mappings: {
+      dynamic: false,
+      properties: {},
+    },
+  });
 }
diff --git a/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.test.ts b/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.test.ts
new file mode 100644
index 0000000000000..709736a37d802
--- /dev/null
+++ b/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.test.ts
@@ -0,0 +1,213 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { savedObjectsRepositoryMock, loggingSystemMock } from '../../../../../core/server/mocks';
+import {
+  CollectorOptions,
+  createUsageCollectionSetupMock,
+} from '../../../../usage_collection/server/usage_collection.mock';
+
+import {
+  ROLL_INDICES_START,
+  ROLL_TOTAL_INDICES_INTERVAL,
+  registerApplicationUsageCollector,
+} from './telemetry_application_usage_collector';
+import {
+  SAVED_OBJECTS_DAILY_TYPE,
+  SAVED_OBJECTS_TOTAL_TYPE,
+  SAVED_OBJECTS_TRANSACTIONAL_TYPE,
+} from './saved_objects_types';
+
+describe('telemetry_application_usage', () => {
+  jest.useFakeTimers();
+
+  const logger = loggingSystemMock.createLogger();
+
+  let collector: CollectorOptions;
+
+  const usageCollectionMock = createUsageCollectionSetupMock();
+  usageCollectionMock.makeUsageCollector.mockImplementation((config) => {
+    collector = config;
+    return createUsageCollectionSetupMock().makeUsageCollector(config);
+  });
+
+  const getUsageCollector = jest.fn();
+  const registerType = jest.fn();
+  const callCluster = jest.fn();
+
+  beforeAll(() =>
+    registerApplicationUsageCollector(logger, usageCollectionMock, registerType, getUsageCollector)
+  );
+  afterAll(() => jest.clearAllTimers());
+
+  test('registered collector is set', () => {
+    expect(collector).not.toBeUndefined();
+  });
+
+  test('if no savedObjectClient initialised, return undefined', async () => {
+    expect(collector.isReady()).toBe(false);
+    expect(await collector.fetch(callCluster)).toBeUndefined();
+    jest.runTimersToTime(ROLL_INDICES_START);
+  });
+
+  test('when savedObjectClient is initialised, return something', async () => {
+    const savedObjectClient = savedObjectsRepositoryMock.create();
+    savedObjectClient.find.mockImplementation(
+      async () =>
+        ({
+          saved_objects: [],
+          total: 0,
+        } as any)
+    );
+    getUsageCollector.mockImplementation(() => savedObjectClient);
+
+    jest.runTimersToTime(ROLL_TOTAL_INDICES_INTERVAL); // Force rollTotals to run
+
+    expect(collector.isReady()).toBe(true);
+    expect(await collector.fetch(callCluster)).toStrictEqual({});
+    expect(savedObjectClient.bulkCreate).not.toHaveBeenCalled();
+  });
+
+  test('it only gets 10k even when there are more documents (ES limitation)', async () => {
+    const savedObjectClient = savedObjectsRepositoryMock.create();
+    const total = 10000;
+    savedObjectClient.find.mockImplementation(async (opts) => {
+      switch (opts.type) {
+        case SAVED_OBJECTS_TOTAL_TYPE:
+          return {
+            saved_objects: [
+              {
+                id: 'appId',
+                attributes: {
+                  appId: 'appId',
+                  minutesOnScreen: 10,
+                  numberOfClicks: 10,
+                },
+              },
+            ],
+            total: 1,
+          } as any;
+        case SAVED_OBJECTS_TRANSACTIONAL_TYPE:
+          const doc = {
+            id: 'test-id',
+            attributes: {
+              appId: 'appId',
+              timestamp: new Date().toISOString(),
+              minutesOnScreen: 0.5,
+              numberOfClicks: 1,
+            },
+          };
+          const savedObjects = new Array(total).fill(doc);
+          return { saved_objects: savedObjects, total: total + 1 };
+        case SAVED_OBJECTS_DAILY_TYPE:
+          return {
+            saved_objects: [
+              {
+                id: 'appId:YYYY-MM-DD',
+                attributes: {
+                  appId: 'appId',
+                  timestamp: new Date().toISOString(),
+                  minutesOnScreen: 0.5,
+                  numberOfClicks: 1,
+                },
+              },
+            ],
+            total: 1,
+          };
+      }
+    });
+
+    getUsageCollector.mockImplementation(() => savedObjectClient);
+
+    jest.runTimersToTime(ROLL_TOTAL_INDICES_INTERVAL); // Force rollTotals to run
+
+    expect(await collector.fetch(callCluster)).toStrictEqual({
+      appId: {
+        clicks_total: total + 1 + 10,
+        clicks_7_days: total + 1,
+        clicks_30_days: total + 1,
+        clicks_90_days: total + 1,
+        minutes_on_screen_total: (total + 1) * 0.5 + 10,
+        minutes_on_screen_7_days: (total + 1) * 0.5,
+        minutes_on_screen_30_days: (total + 1) * 0.5,
+        minutes_on_screen_90_days: (total + 1) * 0.5,
+      },
+    });
+    expect(savedObjectClient.bulkCreate).toHaveBeenCalledWith(
+      [
+        {
+          id: 'appId',
+          type: SAVED_OBJECTS_TOTAL_TYPE,
+          attributes: {
+            appId: 'appId',
+            minutesOnScreen: 10.5,
+            numberOfClicks: 11,
+          },
+        },
+      ],
+      { overwrite: true }
+    );
+    expect(savedObjectClient.delete).toHaveBeenCalledTimes(1);
+    expect(savedObjectClient.delete).toHaveBeenCalledWith(
+      SAVED_OBJECTS_DAILY_TYPE,
+      'appId:YYYY-MM-DD'
+    );
+  });
+
+  test('old transactional data not migrated yet', async () => {
+    const savedObjectClient = savedObjectsRepositoryMock.create();
+    savedObjectClient.find.mockImplementation(async (opts) => {
+      switch (opts.type) {
+        case SAVED_OBJECTS_TOTAL_TYPE:
+        case SAVED_OBJECTS_DAILY_TYPE:
+          return { saved_objects: [], total: 0 } as any;
+        case SAVED_OBJECTS_TRANSACTIONAL_TYPE:
+          return {
+            saved_objects: [
+              {
+                id: 'test-id',
+                attributes: {
+                  appId: 'appId',
+                  timestamp: new Date(0).toISOString(),
+                  minutesOnScreen: 0.5,
+                  numberOfClicks: 1,
+                },
+              },
+            ],
+            total: 1,
+          };
+      }
+    });
+
+    getUsageCollector.mockImplementation(() => savedObjectClient);
+
+    expect(await collector.fetch(callCluster)).toStrictEqual({
+      appId: {
+        clicks_total: 1,
+        clicks_7_days: 0,
+        clicks_30_days: 0,
+        clicks_90_days: 0,
+        minutes_on_screen_total: 0.5,
+        minutes_on_screen_7_days: 0,
+        minutes_on_screen_30_days: 0,
+        minutes_on_screen_90_days: 0,
+      },
+    });
+  });
+});
diff --git a/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.ts
index 69137681e0597..36c89d0a0b4a8 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.ts
@@ -18,29 +18,42 @@
  */
 
 import moment from 'moment';
-import { ISavedObjectsRepository, SavedObjectsServiceSetup } from 'kibana/server';
+import { timer } from 'rxjs';
+import { ISavedObjectsRepository, Logger, SavedObjectsServiceSetup } from 'kibana/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { findAll } from '../find_all';
 import {
+  ApplicationUsageDaily,
   ApplicationUsageTotal,
   ApplicationUsageTransactional,
   registerMappings,
+  SAVED_OBJECTS_DAILY_TYPE,
+  SAVED_OBJECTS_TOTAL_TYPE,
+  SAVED_OBJECTS_TRANSACTIONAL_TYPE,
 } from './saved_objects_types';
 import { applicationUsageSchema } from './schema';
+import { rollDailyData, rollTotals } from './rollups';
 
 /**
- * Roll indices every 24h
+ * Roll total indices every 24h
  */
-export const ROLL_INDICES_INTERVAL = 24 * 60 * 60 * 1000;
+export const ROLL_TOTAL_INDICES_INTERVAL = 24 * 60 * 60 * 1000;
+
+/**
+ * Roll daily indices every 30 minutes.
+ * This means that, assuming a user can visit all the 44 apps we can possibly report
+ * in the 3 minutes interval the browser reports to the server, up to 22 users can have the same
+ * behaviour and we wouldn't need to paginate in the transactional documents (less than 10k docs).
+ *
+ * Based on a more normal expected use case, the users could visit up to 5 apps in those 3 minutes,
+ * allowing up to 200 users before reaching the limit.
+ */
+export const ROLL_DAILY_INDICES_INTERVAL = 30 * 60 * 1000;
 
 /**
  * Start rolling indices after 5 minutes up
  */
 export const ROLL_INDICES_START = 5 * 60 * 1000;
 
-export const SAVED_OBJECTS_TOTAL_TYPE = 'application_usage_totals';
-export const SAVED_OBJECTS_TRANSACTIONAL_TYPE = 'application_usage_transactional';
-
 export interface ApplicationUsageTelemetryReport {
   [appId: string]: {
     clicks_total: number;
@@ -55,6 +68,7 @@ export interface ApplicationUsageTelemetryReport {
 }
 
 export function registerApplicationUsageCollector(
+  logger: Logger,
   usageCollection: UsageCollectionSetup,
   registerType: SavedObjectsServiceSetup['registerType'],
   getSavedObjectsClient: () => ISavedObjectsRepository | undefined
@@ -71,10 +85,22 @@ export function registerApplicationUsageCollector(
         if (typeof savedObjectsClient === 'undefined') {
           return;
         }
-        const [rawApplicationUsageTotals, rawApplicationUsageTransactional] = await Promise.all([
-          findAll<ApplicationUsageTotal>(savedObjectsClient, { type: SAVED_OBJECTS_TOTAL_TYPE }),
-          findAll<ApplicationUsageTransactional>(savedObjectsClient, {
+        const [
+          { saved_objects: rawApplicationUsageTotals },
+          { saved_objects: rawApplicationUsageDaily },
+          { saved_objects: rawApplicationUsageTransactional },
+        ] = await Promise.all([
+          savedObjectsClient.find<ApplicationUsageTotal>({
+            type: SAVED_OBJECTS_TOTAL_TYPE,
+            perPage: 10000, // We only have 44 apps for now. This limit is OK.
+          }),
+          savedObjectsClient.find<ApplicationUsageDaily>({
+            type: SAVED_OBJECTS_DAILY_TYPE,
+            perPage: 10000, // We can have up to 44 apps * 91 days = 4004 docs. This limit is OK
+          }),
+          savedObjectsClient.find<ApplicationUsageTransactional>({
             type: SAVED_OBJECTS_TRANSACTIONAL_TYPE,
+            perPage: 10000, // If we have more than those, we won't report the rest (they'll be rolled up to the daily soon enough to become a problem)
           }),
         ]);
 
@@ -101,51 +127,51 @@ export function registerApplicationUsageCollector(
         const nowMinus30 = moment().subtract(30, 'days');
         const nowMinus90 = moment().subtract(90, 'days');
 
-        const applicationUsage = rawApplicationUsageTransactional.reduce(
-          (acc, { attributes: { appId, minutesOnScreen, numberOfClicks, timestamp } }) => {
-            const existing = acc[appId] || {
-              clicks_total: 0,
-              clicks_7_days: 0,
-              clicks_30_days: 0,
-              clicks_90_days: 0,
-              minutes_on_screen_total: 0,
-              minutes_on_screen_7_days: 0,
-              minutes_on_screen_30_days: 0,
-              minutes_on_screen_90_days: 0,
-            };
-
-            const timeOfEntry = moment(timestamp as string);
-            const isInLast7Days = timeOfEntry.isSameOrAfter(nowMinus7);
-            const isInLast30Days = timeOfEntry.isSameOrAfter(nowMinus30);
-            const isInLast90Days = timeOfEntry.isSameOrAfter(nowMinus90);
-
-            const last7Days = {
-              clicks_7_days: existing.clicks_7_days + numberOfClicks,
-              minutes_on_screen_7_days: existing.minutes_on_screen_7_days + minutesOnScreen,
-            };
-            const last30Days = {
-              clicks_30_days: existing.clicks_30_days + numberOfClicks,
-              minutes_on_screen_30_days: existing.minutes_on_screen_30_days + minutesOnScreen,
-            };
-            const last90Days = {
-              clicks_90_days: existing.clicks_90_days + numberOfClicks,
-              minutes_on_screen_90_days: existing.minutes_on_screen_90_days + minutesOnScreen,
-            };
-
-            return {
-              ...acc,
-              [appId]: {
-                ...existing,
-                clicks_total: existing.clicks_total + numberOfClicks,
-                minutes_on_screen_total: existing.minutes_on_screen_total + minutesOnScreen,
-                ...(isInLast7Days ? last7Days : {}),
-                ...(isInLast30Days ? last30Days : {}),
-                ...(isInLast90Days ? last90Days : {}),
-              },
-            };
-          },
-          applicationUsageFromTotals
-        );
+        const applicationUsage = [
+          ...rawApplicationUsageDaily,
+          ...rawApplicationUsageTransactional,
+        ].reduce((acc, { attributes: { appId, minutesOnScreen, numberOfClicks, timestamp } }) => {
+          const existing = acc[appId] || {
+            clicks_total: 0,
+            clicks_7_days: 0,
+            clicks_30_days: 0,
+            clicks_90_days: 0,
+            minutes_on_screen_total: 0,
+            minutes_on_screen_7_days: 0,
+            minutes_on_screen_30_days: 0,
+            minutes_on_screen_90_days: 0,
+          };
+
+          const timeOfEntry = moment(timestamp);
+          const isInLast7Days = timeOfEntry.isSameOrAfter(nowMinus7);
+          const isInLast30Days = timeOfEntry.isSameOrAfter(nowMinus30);
+          const isInLast90Days = timeOfEntry.isSameOrAfter(nowMinus90);
+
+          const last7Days = {
+            clicks_7_days: existing.clicks_7_days + numberOfClicks,
+            minutes_on_screen_7_days: existing.minutes_on_screen_7_days + minutesOnScreen,
+          };
+          const last30Days = {
+            clicks_30_days: existing.clicks_30_days + numberOfClicks,
+            minutes_on_screen_30_days: existing.minutes_on_screen_30_days + minutesOnScreen,
+          };
+          const last90Days = {
+            clicks_90_days: existing.clicks_90_days + numberOfClicks,
+            minutes_on_screen_90_days: existing.minutes_on_screen_90_days + minutesOnScreen,
+          };
+
+          return {
+            ...acc,
+            [appId]: {
+              ...existing,
+              clicks_total: existing.clicks_total + numberOfClicks,
+              minutes_on_screen_total: existing.minutes_on_screen_total + minutesOnScreen,
+              ...(isInLast7Days ? last7Days : {}),
+              ...(isInLast30Days ? last30Days : {}),
+              ...(isInLast90Days ? last90Days : {}),
+            },
+          };
+        }, applicationUsageFromTotals);
 
         return applicationUsage;
       },
@@ -154,65 +180,10 @@ export function registerApplicationUsageCollector(
 
   usageCollection.registerCollector(collector);
 
-  setInterval(() => rollTotals(getSavedObjectsClient()), ROLL_INDICES_INTERVAL);
-  setTimeout(() => rollTotals(getSavedObjectsClient()), ROLL_INDICES_START);
-}
-
-async function rollTotals(savedObjectsClient?: ISavedObjectsRepository) {
-  if (!savedObjectsClient) {
-    return;
-  }
-
-  try {
-    const [rawApplicationUsageTotals, rawApplicationUsageTransactional] = await Promise.all([
-      findAll<ApplicationUsageTotal>(savedObjectsClient, { type: SAVED_OBJECTS_TOTAL_TYPE }),
-      findAll<ApplicationUsageTransactional>(savedObjectsClient, {
-        type: SAVED_OBJECTS_TRANSACTIONAL_TYPE,
-        filter: `${SAVED_OBJECTS_TRANSACTIONAL_TYPE}.attributes.timestamp < now-90d`,
-      }),
-    ]);
-
-    const existingTotals = rawApplicationUsageTotals.reduce(
-      (acc, { attributes: { appId, numberOfClicks, minutesOnScreen } }) => {
-        return {
-          ...acc,
-          // No need to sum because there should be 1 document per appId only
-          [appId]: { appId, numberOfClicks, minutesOnScreen },
-        };
-      },
-      {} as Record<string, { appId: string; minutesOnScreen: number; numberOfClicks: number }>
-    );
-
-    const totals = rawApplicationUsageTransactional.reduce((acc, { attributes, id }) => {
-      const { appId, numberOfClicks, minutesOnScreen } = attributes;
-
-      const existing = acc[appId] || { minutesOnScreen: 0, numberOfClicks: 0 };
-
-      return {
-        ...acc,
-        [appId]: {
-          appId,
-          numberOfClicks: numberOfClicks + existing.numberOfClicks,
-          minutesOnScreen: minutesOnScreen + existing.minutesOnScreen,
-        },
-      };
-    }, existingTotals);
-
-    await Promise.all([
-      Object.entries(totals).length &&
-        savedObjectsClient.bulkCreate<ApplicationUsageTotal>(
-          Object.entries(totals).map(([id, entry]) => ({
-            type: SAVED_OBJECTS_TOTAL_TYPE,
-            id,
-            attributes: entry,
-          })),
-          { overwrite: true }
-        ),
-      ...rawApplicationUsageTransactional.map(
-        ({ id }) => savedObjectsClient.delete(SAVED_OBJECTS_TRANSACTIONAL_TYPE, id) // There is no bulkDelete :(
-      ),
-    ]);
-  } catch (err) {
-    // Silent failure
-  }
+  timer(ROLL_INDICES_START, ROLL_DAILY_INDICES_INTERVAL).subscribe(() =>
+    rollDailyData(logger, getSavedObjectsClient())
+  );
+  timer(ROLL_INDICES_START, ROLL_TOTAL_INDICES_INTERVAL).subscribe(() =>
+    rollTotals(logger, getSavedObjectsClient())
+  );
 }
diff --git a/src/plugins/kibana_usage_collection/server/collectors/find_all.test.ts b/src/plugins/kibana_usage_collection/server/collectors/find_all.test.ts
deleted file mode 100644
index d917cd2454e81..0000000000000
--- a/src/plugins/kibana_usage_collection/server/collectors/find_all.test.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { savedObjectsRepositoryMock } from '../../../../core/server/mocks';
-
-import { findAll } from './find_all';
-
-describe('telemetry_application_usage', () => {
-  test('when savedObjectClient is initialised, return something', async () => {
-    const savedObjectClient = savedObjectsRepositoryMock.create();
-    savedObjectClient.find.mockImplementation(
-      async () =>
-        ({
-          saved_objects: [],
-          total: 0,
-        } as any)
-    );
-
-    expect(await findAll(savedObjectClient, { type: 'test-type' })).toStrictEqual([]);
-  });
-
-  test('paging in findAll works', async () => {
-    const savedObjectClient = savedObjectsRepositoryMock.create();
-    let total = 201;
-    const doc = { id: 'test-id', attributes: { test: 1 } };
-    savedObjectClient.find.mockImplementation(async (opts) => {
-      if ((opts.page || 1) > 2) {
-        return { saved_objects: [], total } as any;
-      }
-      const savedObjects = new Array(opts.perPage).fill(doc);
-      total = savedObjects.length * 2 + 1;
-      return { saved_objects: savedObjects, total };
-    });
-
-    expect(await findAll(savedObjectClient, { type: 'test-type' })).toStrictEqual(
-      new Array(total - 1).fill(doc)
-    );
-  });
-});
diff --git a/src/plugins/kibana_usage_collection/server/collectors/find_all.ts b/src/plugins/kibana_usage_collection/server/collectors/find_all.ts
deleted file mode 100644
index 5bb4f20b5c5b1..0000000000000
--- a/src/plugins/kibana_usage_collection/server/collectors/find_all.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import {
-  SavedObjectAttributes,
-  ISavedObjectsRepository,
-  SavedObjectsFindOptions,
-  SavedObject,
-} from 'kibana/server';
-
-export async function findAll<T extends SavedObjectAttributes>(
-  savedObjectsClient: ISavedObjectsRepository,
-  opts: SavedObjectsFindOptions
-): Promise<Array<SavedObject<T>>> {
-  const { page = 1, perPage = 10000, ...options } = opts;
-  const { saved_objects: savedObjects, total } = await savedObjectsClient.find<T>({
-    ...options,
-    page,
-    perPage,
-  });
-  if (page * perPage >= total) {
-    return savedObjects;
-  }
-  return [...savedObjects, ...(await findAll<T>(savedObjectsClient, { ...opts, page: page + 1 }))];
-}
diff --git a/src/plugins/kibana_usage_collection/server/collectors/ui_metric/telemetry_ui_metric_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
index 46768813b1970..9c02a9cbf3204 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
@@ -23,7 +23,6 @@ import {
   SavedObjectsServiceSetup,
 } from 'kibana/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { findAll } from '../find_all';
 
 interface UIMetricsSavedObjects extends SavedObjectAttributes {
   count: number;
@@ -55,9 +54,10 @@ export function registerUiMetricUsageCollector(
         return;
       }
 
-      const rawUiMetrics = await findAll<UIMetricsSavedObjects>(savedObjectsClient, {
+      const { saved_objects: rawUiMetrics } = await savedObjectsClient.find<UIMetricsSavedObjects>({
         type: 'ui-metric',
         fields: ['count'],
+        perPage: 10000,
       });
 
       const uiMetricsByAppName = rawUiMetrics.reduce((accum, rawUiMetric) => {
diff --git a/src/plugins/kibana_usage_collection/server/plugin.ts b/src/plugins/kibana_usage_collection/server/plugin.ts
index d4295c770803e..260acd19ab516 100644
--- a/src/plugins/kibana_usage_collection/server/plugin.ts
+++ b/src/plugins/kibana_usage_collection/server/plugin.ts
@@ -30,6 +30,7 @@ import {
   CoreStart,
   SavedObjectsServiceSetup,
   OpsMetrics,
+  Logger,
 } from '../../../core/server';
 import {
   registerApplicationUsageCollector,
@@ -47,12 +48,14 @@ interface KibanaUsageCollectionPluginsDepsSetup {
 type SavedObjectsRegisterType = SavedObjectsServiceSetup['registerType'];
 
 export class KibanaUsageCollectionPlugin implements Plugin {
+  private readonly logger: Logger;
   private readonly legacyConfig$: Observable<SharedGlobalConfig>;
   private savedObjectsClient?: ISavedObjectsRepository;
   private uiSettingsClient?: IUiSettingsClient;
   private metric$: Subject<OpsMetrics>;
 
   constructor(initializerContext: PluginInitializerContext) {
+    this.logger = initializerContext.logger.get();
     this.legacyConfig$ = initializerContext.config.legacy.globalConfig$;
     this.metric$ = new Subject<OpsMetrics>();
   }
@@ -88,7 +91,12 @@ export class KibanaUsageCollectionPlugin implements Plugin {
     registerKibanaUsageCollector(usageCollection, this.legacyConfig$);
     registerManagementUsageCollector(usageCollection, getUiSettingsClient);
     registerUiMetricUsageCollector(usageCollection, registerType, getSavedObjectsClient);
-    registerApplicationUsageCollector(usageCollection, registerType, getSavedObjectsClient);
+    registerApplicationUsageCollector(
+      this.logger.get('application-usage'),
+      usageCollection,
+      registerType,
+      getSavedObjectsClient
+    );
     registerCspCollector(usageCollection, coreSetup.http);
   }
 }
diff --git a/src/plugins/legacy_export/server/plugin.ts b/src/plugins/legacy_export/server/plugin.ts
index 22c7c1a05dddb..9e1e631903240 100644
--- a/src/plugins/legacy_export/server/plugin.ts
+++ b/src/plugins/legacy_export/server/plugin.ts
@@ -18,18 +18,23 @@
  */
 
 import { Plugin, CoreSetup, PluginInitializerContext } from 'kibana/server';
+import { first } from 'rxjs/operators';
 import { registerRoutes } from './routes';
 
 export class LegacyExportPlugin implements Plugin<{}, {}> {
-  private readonly kibanaVersion: string;
+  constructor(private readonly initContext: PluginInitializerContext) {}
 
-  constructor(context: PluginInitializerContext) {
-    this.kibanaVersion = context.env.packageInfo.version;
-  }
+  public async setup({ http }: CoreSetup) {
+    const globalConfig = await this.initContext.config.legacy.globalConfig$
+      .pipe(first())
+      .toPromise();
 
-  public setup({ http }: CoreSetup) {
     const router = http.createRouter();
-    registerRoutes(router, this.kibanaVersion);
+    registerRoutes(
+      router,
+      this.initContext.env.packageInfo.version,
+      globalConfig.savedObjects.maxImportPayloadBytes.getValueInBytes()
+    );
 
     return {};
   }
diff --git a/src/plugins/legacy_export/server/routes/import.ts b/src/plugins/legacy_export/server/routes/import.ts
index cf6f28683be17..8d33983ad7e3c 100644
--- a/src/plugins/legacy_export/server/routes/import.ts
+++ b/src/plugins/legacy_export/server/routes/import.ts
@@ -21,7 +21,7 @@ import { schema } from '@kbn/config-schema';
 import { IRouter, SavedObject } from 'src/core/server';
 import { importDashboards } from '../lib';
 
-export const registerImportRoute = (router: IRouter) => {
+export const registerImportRoute = (router: IRouter, maxImportPayloadBytes: number) => {
   router.post(
     {
       path: '/api/kibana/dashboards/import',
@@ -39,6 +39,9 @@ export const registerImportRoute = (router: IRouter) => {
       },
       options: {
         tags: ['api'],
+        body: {
+          maxBytes: maxImportPayloadBytes,
+        },
       },
     },
     async (ctx, req, res) => {
diff --git a/src/plugins/legacy_export/server/routes/index.ts b/src/plugins/legacy_export/server/routes/index.ts
index 7b9de7f016b6b..cac405ce9bdf9 100644
--- a/src/plugins/legacy_export/server/routes/index.ts
+++ b/src/plugins/legacy_export/server/routes/index.ts
@@ -21,7 +21,11 @@ import { IRouter } from 'src/core/server';
 import { registerImportRoute } from './import';
 import { registerExportRoute } from './export';
 
-export const registerRoutes = (router: IRouter, kibanaVersion: string) => {
+export const registerRoutes = (
+  router: IRouter,
+  kibanaVersion: string,
+  maxImportPayloadBytes: number
+) => {
   registerExportRoute(router, kibanaVersion);
-  registerImportRoute(router);
+  registerImportRoute(router, maxImportPayloadBytes);
 };
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/__snapshots__/flyout.test.tsx.snap b/src/plugins/saved_objects_management/public/management_section/objects_table/components/__snapshots__/flyout.test.tsx.snap
index 0a330d074fd42..3a03c5c01b3c2 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/__snapshots__/flyout.test.tsx.snap
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/__snapshots__/flyout.test.tsx.snap
@@ -222,9 +222,11 @@ exports[`Flyout conflicts should allow conflict resolution 2`] = `
           "indexPatterns": Array [
             Object {
               "id": "1",
+              "title": undefined,
             },
             Object {
               "id": "2",
+              "title": undefined,
             },
           ],
           "isLegacyFile": false,
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.test.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.test.tsx
index cc9d2ed160241..72ed69cdca816 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.test.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.test.tsx
@@ -64,7 +64,10 @@ describe('Flyout', () => {
       done: jest.fn(),
       newIndexPatternUrl: '',
       indexPatterns: {
-        getFields: jest.fn().mockImplementation(() => [{ id: '1' }, { id: '2' }]),
+        getCache: jest.fn().mockImplementation(() => [
+          { id: '1', attributes: {} },
+          { id: '2', attributes: {} },
+        ]),
       } as any,
       overlays,
       http,
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx
index 47d82077294cc..3165ea4ca0794 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx
@@ -132,7 +132,10 @@ export class Flyout extends Component<FlyoutProps, FlyoutState> {
   }
 
   fetchIndexPatterns = async () => {
-    const indexPatterns = await this.props.indexPatterns.getFields(['id', 'title']);
+    const indexPatterns = (await this.props.indexPatterns.getCache())?.map((savedObject) => ({
+      id: savedObject.id,
+      title: savedObject.attributes.title,
+    }));
     this.setState({ indexPatterns } as any);
   };
 
diff --git a/src/plugins/telemetry/server/routes/telemetry_opt_in.ts b/src/plugins/telemetry/server/routes/telemetry_opt_in.ts
index aa1de4b2443a4..dd6953ebcda99 100644
--- a/src/plugins/telemetry/server/routes/telemetry_opt_in.ts
+++ b/src/plugins/telemetry/server/routes/telemetry_opt_in.ts
@@ -26,6 +26,7 @@ import {
   StatsGetterConfig,
   TelemetryCollectionManagerPluginSetup,
 } from 'src/plugins/telemetry_collection_manager/server';
+import { SavedObjectsErrorHelpers } from '../../../../core/server';
 import { getTelemetryAllowChangingOptInStatus } from '../../common/telemetry_config';
 import { sendTelemetryOptInStatus } from './telemetry_opt_in_stats';
 
@@ -109,7 +110,13 @@ export function registerTelemetryOptInRoutes({
         });
       }
 
-      await updateTelemetrySavedObject(context.core.savedObjects.client, attributes);
+      try {
+        await updateTelemetrySavedObject(context.core.savedObjects.client, attributes);
+      } catch (e) {
+        if (SavedObjectsErrorHelpers.isForbiddenError(e)) {
+          return res.forbidden();
+        }
+      }
       return res.ok({ body: optInStatus });
     }
   );
diff --git a/src/plugins/ui_actions/public/triggers/value_click_trigger.ts b/src/plugins/ui_actions/public/triggers/value_click_trigger.ts
index e63ff28f42d96..f1aff6322522a 100644
--- a/src/plugins/ui_actions/public/triggers/value_click_trigger.ts
+++ b/src/plugins/ui_actions/public/triggers/value_click_trigger.ts
@@ -27,6 +27,6 @@ export const valueClickTrigger: Trigger<'VALUE_CLICK_TRIGGER'> = {
     defaultMessage: 'Single click',
   }),
   description: i18n.translate('uiActions.triggers.valueClickDescription', {
-    defaultMessage: 'A single point on the visualization',
+    defaultMessage: 'A data point click on the visualization',
   }),
 };
diff --git a/src/plugins/usage_collection/server/plugin.ts b/src/plugins/usage_collection/server/plugin.ts
index 00584e1fd5d86..74e70d5ea9d35 100644
--- a/src/plugins/usage_collection/server/plugin.ts
+++ b/src/plugins/usage_collection/server/plugin.ts
@@ -49,8 +49,25 @@ export class UsageCollectionPlugin implements Plugin<CollectorSet> {
       maximumWaitTimeForAllCollectorsInS: config.maximumWaitTimeForAllCollectorsInS,
     });
 
+    const globalConfig = await this.initializerContext.config.legacy.globalConfig$
+      .pipe(first())
+      .toPromise();
+
     const router = core.http.createRouter();
-    setupRoutes(router, () => this.savedObjects);
+    setupRoutes({
+      router,
+      getSavedObjects: () => this.savedObjects,
+      collectorSet,
+      config: {
+        allowAnonymous: core.status.isStatusPageAnonymous(),
+        kibanaIndex: globalConfig.kibana.index,
+        kibanaVersion: this.initializerContext.env.packageInfo.version,
+        server: core.http.getServerInfo(),
+        uuid: this.initializerContext.env.instanceUuid,
+      },
+      metrics: core.metrics,
+      overallStatus$: core.status.overall$,
+    });
 
     return collectorSet;
   }
diff --git a/src/plugins/usage_collection/server/routes/index.ts b/src/plugins/usage_collection/server/routes/index.ts
index e6beef3fbdc59..b367ddc184be7 100644
--- a/src/plugins/usage_collection/server/routes/index.ts
+++ b/src/plugins/usage_collection/server/routes/index.ts
@@ -17,12 +17,39 @@
  * under the License.
  */
 
-import { IRouter, ISavedObjectsRepository } from 'kibana/server';
+import {
+  IRouter,
+  ISavedObjectsRepository,
+  MetricsServiceSetup,
+  ServiceStatus,
+} from 'kibana/server';
+import { Observable } from 'rxjs';
+import { CollectorSet } from '../collector';
 import { registerUiMetricRoute } from './report_metrics';
+import { registerStatsRoute } from './stats';
 
-export function setupRoutes(
-  router: IRouter,
-  getSavedObjects: () => ISavedObjectsRepository | undefined
-) {
+export function setupRoutes({
+  router,
+  getSavedObjects,
+  ...rest
+}: {
+  router: IRouter;
+  getSavedObjects: () => ISavedObjectsRepository | undefined;
+  config: {
+    allowAnonymous: boolean;
+    kibanaIndex: string;
+    kibanaVersion: string;
+    uuid: string;
+    server: {
+      name: string;
+      hostname: string;
+      port: number;
+    };
+  };
+  collectorSet: CollectorSet;
+  metrics: MetricsServiceSetup;
+  overallStatus$: Observable<ServiceStatus>;
+}) {
   registerUiMetricRoute(router, getSavedObjects);
+  registerStatsRoute({ router, ...rest });
 }
diff --git a/src/plugins/usage_collection/server/routes/integration_tests/stats.test.ts b/src/plugins/usage_collection/server/routes/integration_tests/stats.test.ts
new file mode 100644
index 0000000000000..2b39eb626e419
--- /dev/null
+++ b/src/plugins/usage_collection/server/routes/integration_tests/stats.test.ts
@@ -0,0 +1,104 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { BehaviorSubject } from 'rxjs';
+import { UnwrapPromise } from '@kbn/utility-types';
+
+import {
+  MetricsServiceSetup,
+  ServiceStatus,
+  ServiceStatusLevels,
+} from '../../../../../core/server';
+import {
+  contextServiceMock,
+  loggingSystemMock,
+  metricsServiceMock,
+} from '../../../../../core/server/mocks';
+import { createHttpServer } from '../../../../../core/server/test_utils';
+import { registerStatsRoute } from '../stats';
+import supertest from 'supertest';
+import { CollectorSet } from '../../collector';
+
+type HttpService = ReturnType<typeof createHttpServer>;
+type HttpSetup = UnwrapPromise<ReturnType<HttpService['setup']>>;
+
+describe('/api/stats', () => {
+  let server: HttpService;
+  let httpSetup: HttpSetup;
+  let overallStatus$: BehaviorSubject<ServiceStatus>;
+  let metrics: MetricsServiceSetup;
+
+  beforeEach(async () => {
+    server = createHttpServer();
+    httpSetup = await server.setup({
+      context: contextServiceMock.createSetupContract(),
+    });
+    overallStatus$ = new BehaviorSubject<ServiceStatus>({
+      level: ServiceStatusLevels.available,
+      summary: 'everything is working',
+    });
+    metrics = metricsServiceMock.createSetupContract();
+
+    const router = httpSetup.createRouter('');
+    registerStatsRoute({
+      router,
+      collectorSet: new CollectorSet({
+        logger: loggingSystemMock.create().asLoggerFactory().get(),
+      }),
+      config: {
+        allowAnonymous: true,
+        kibanaIndex: '.kibana-test',
+        kibanaVersion: '8.8.8-SNAPSHOT',
+        server: {
+          name: 'mykibana',
+          hostname: 'mykibana.com',
+          port: 1234,
+        },
+        uuid: 'xxx-xxxxx',
+      },
+      metrics,
+      overallStatus$,
+    });
+
+    await server.start();
+  });
+
+  afterEach(async () => {
+    await server.stop();
+  });
+
+  it('successfully returns data', async () => {
+    const response = await supertest(httpSetup.server.listener).get('/api/stats').expect(200);
+    expect(response.body).toMatchObject({
+      kibana: {
+        uuid: 'xxx-xxxxx',
+        name: 'mykibana',
+        index: '.kibana-test',
+        host: 'mykibana.com',
+        locale: 'en',
+        transport_address: `mykibana.com:1234`,
+        version: '8.8.8',
+        snapshot: true,
+        status: 'green',
+      },
+      last_updated: expect.any(String),
+      collection_interval_ms: expect.any(Number),
+    });
+  });
+});
diff --git a/src/plugins/usage_collection/server/routes/stats.ts b/src/plugins/usage_collection/server/routes/stats.ts
new file mode 100644
index 0000000000000..7c64c9f180319
--- /dev/null
+++ b/src/plugins/usage_collection/server/routes/stats.ts
@@ -0,0 +1,190 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { i18n } from '@kbn/i18n';
+import defaultsDeep from 'lodash/defaultsDeep';
+import { Observable } from 'rxjs';
+import { first } from 'rxjs/operators';
+
+import {
+  IRouter,
+  LegacyAPICaller,
+  MetricsServiceSetup,
+  ServiceStatus,
+  ServiceStatusLevels,
+} from '../../../../core/server';
+import { CollectorSet } from '../collector';
+
+const STATS_NOT_READY_MESSAGE = i18n.translate('usageCollection.stats.notReadyMessage', {
+  defaultMessage: 'Stats are not ready yet. Please try again later.',
+});
+
+const SNAPSHOT_REGEX = /-snapshot/i;
+
+export function registerStatsRoute({
+  router,
+  config,
+  collectorSet,
+  metrics,
+  overallStatus$,
+}: {
+  router: IRouter;
+  config: {
+    allowAnonymous: boolean;
+    kibanaIndex: string;
+    kibanaVersion: string;
+    uuid: string;
+    server: {
+      name: string;
+      hostname: string;
+      port: number;
+    };
+  };
+  collectorSet: CollectorSet;
+  metrics: MetricsServiceSetup;
+  overallStatus$: Observable<ServiceStatus>;
+}) {
+  const getUsage = async (callCluster: LegacyAPICaller): Promise<any> => {
+    const usage = await collectorSet.bulkFetchUsage(callCluster);
+    return collectorSet.toObject(usage);
+  };
+
+  const getClusterUuid = async (callCluster: LegacyAPICaller): Promise<string> => {
+    const { cluster_uuid: uuid } = await callCluster('info', { filterPath: 'cluster_uuid' });
+    return uuid;
+  };
+
+  router.get(
+    {
+      path: '/api/stats',
+      options: {
+        authRequired: !config.allowAnonymous,
+        tags: ['api'], // ensures that unauthenticated calls receive a 401 rather than a 302 redirect to login page
+      },
+      validate: {
+        query: schema.object({
+          extended: schema.oneOf([schema.literal(''), schema.boolean()], { defaultValue: false }),
+          legacy: schema.oneOf([schema.literal(''), schema.boolean()], { defaultValue: false }),
+          exclude_usage: schema.oneOf([schema.literal(''), schema.boolean()], {
+            defaultValue: false,
+          }),
+        }),
+      },
+    },
+    async (context, req, res) => {
+      const isExtended = req.query.extended === '' || req.query.extended;
+      const isLegacy = req.query.legacy === '' || req.query.legacy;
+      const shouldGetUsage = req.query.exclude_usage === false;
+
+      let extended;
+      if (isExtended) {
+        const callCluster = context.core.elasticsearch.legacy.client.callAsCurrentUser;
+        const collectorsReady = await collectorSet.areAllCollectorsReady();
+
+        if (shouldGetUsage && !collectorsReady) {
+          return res.customError({ statusCode: 503, body: { message: STATS_NOT_READY_MESSAGE } });
+        }
+
+        const usagePromise = shouldGetUsage ? getUsage(callCluster) : Promise.resolve({});
+        const [usage, clusterUuid] = await Promise.all([usagePromise, getClusterUuid(callCluster)]);
+
+        let modifiedUsage = usage;
+        if (isLegacy) {
+          // In an effort to make telemetry more easily augmented, we need to ensure
+          // we can passthrough the data without every part of the process needing
+          // to know about the change; however, to support legacy use cases where this
+          // wasn't true, we need to be backwards compatible with how the legacy data
+          // looked and support those use cases here.
+          modifiedUsage = Object.keys(usage).reduce((accum, usageKey) => {
+            if (usageKey === 'kibana') {
+              accum = {
+                ...accum,
+                ...usage[usageKey],
+              };
+            } else if (usageKey === 'reporting') {
+              accum = {
+                ...accum,
+                xpack: {
+                  ...accum.xpack,
+                  reporting: usage[usageKey],
+                },
+              };
+            } else {
+              // I don't think we need to it this for the above conditions, but do it for most as it will
+              // match the behavior done in monitoring/bulk_uploader
+              defaultsDeep(accum, { [usageKey]: usage[usageKey] });
+            }
+
+            return accum;
+          }, {} as any);
+
+          extended = {
+            usage: modifiedUsage,
+            clusterUuid,
+          };
+        } else {
+          extended = collectorSet.toApiFieldNames({
+            usage: modifiedUsage,
+            clusterUuid,
+          });
+        }
+      }
+
+      // Guranteed to resolve immediately due to replay effect on getOpsMetrics$
+      // eslint-disable-next-line @typescript-eslint/naming-convention
+      const { collected_at, ...lastMetrics } = await metrics
+        .getOpsMetrics$()
+        .pipe(first())
+        .toPromise();
+
+      const overallStatus = await overallStatus$.pipe(first()).toPromise();
+      const kibanaStats = collectorSet.toApiFieldNames({
+        ...lastMetrics,
+        kibana: {
+          uuid: config.uuid,
+          name: config.server.name,
+          index: config.kibanaIndex,
+          host: config.server.hostname,
+          locale: i18n.getLocale(),
+          transport_address: `${config.server.hostname}:${config.server.port}`,
+          version: config.kibanaVersion.replace(SNAPSHOT_REGEX, ''),
+          snapshot: SNAPSHOT_REGEX.test(config.kibanaVersion),
+          status: ServiceStatusToLegacyState[overallStatus.level.toString()],
+        },
+        last_updated: collected_at.toISOString(),
+        collection_interval_in_millis: metrics.collectionInterval,
+      });
+
+      return res.ok({
+        body: {
+          ...kibanaStats,
+          ...extended,
+        },
+      });
+    }
+  );
+}
+
+const ServiceStatusToLegacyState: Record<string, string> = {
+  [ServiceStatusLevels.critical.toString()]: 'red',
+  [ServiceStatusLevels.unavailable.toString()]: 'red',
+  [ServiceStatusLevels.degraded.toString()]: 'yellow',
+  [ServiceStatusLevels.available.toString()]: 'green',
+};
diff --git a/src/plugins/vis_type_timeseries/server/index.ts b/src/plugins/vis_type_timeseries/server/index.ts
index f460257caf5e3..333ed0ff64fdb 100644
--- a/src/plugins/vis_type_timeseries/server/index.ts
+++ b/src/plugins/vis_type_timeseries/server/index.ts
@@ -21,7 +21,7 @@ import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/serve
 import { VisTypeTimeseriesConfig, config as configSchema } from './config';
 import { VisTypeTimeseriesPlugin } from './plugin';
 
-export { VisTypeTimeseriesSetup, Framework } from './plugin';
+export { VisTypeTimeseriesSetup } from './plugin';
 
 export const config: PluginConfigDescriptor<VisTypeTimeseriesConfig> = {
   deprecations: ({ unused, renameFromRoot }) => [
@@ -39,10 +39,10 @@ export const config: PluginConfigDescriptor<VisTypeTimeseriesConfig> = {
 
 export { ValidationTelemetryServiceSetup } from './validation_telemetry';
 
-// @ts-ignore
-export { AbstractSearchStrategy } from './lib/search_strategies/strategies/abstract_search_strategy';
-// @ts-ignore
-export { AbstractSearchRequest } from './lib/search_strategies/search_requests/abstract_request';
+export {
+  AbstractSearchStrategy,
+  ReqFacade,
+} from './lib/search_strategies/strategies/abstract_search_strategy';
 // @ts-ignore
 export { DefaultSearchCapabilities } from './lib/search_strategies/default_search_capabilities';
 
diff --git a/src/plugins/vis_type_timeseries/server/lib/get_fields.ts b/src/plugins/vis_type_timeseries/server/lib/get_fields.ts
index 0f0d99bff6f1c..777de89672bbe 100644
--- a/src/plugins/vis_type_timeseries/server/lib/get_fields.ts
+++ b/src/plugins/vis_type_timeseries/server/lib/get_fields.ts
@@ -38,6 +38,7 @@ export async function getFields(
   // level object passed from here. The layers should be refactored fully at some point, but for now
   // this works and we are still using the New Platform services for these vis data portions.
   const reqFacade: ReqFacade = {
+    requestContext,
     ...request,
     framework,
     payload: {},
@@ -48,22 +49,6 @@ export async function getFields(
     },
     getUiSettingsService: () => requestContext.core.uiSettings.client,
     getSavedObjectsClient: () => requestContext.core.savedObjects.client,
-    server: {
-      plugins: {
-        elasticsearch: {
-          getCluster: () => {
-            return {
-              callWithRequest: async (req: any, endpoint: string, params: any) => {
-                return await requestContext.core.elasticsearch.legacy.client.callAsCurrentUser(
-                  endpoint,
-                  params
-                );
-              },
-            };
-          },
-        },
-      },
-    },
     getEsShardTimeout: async () => {
       return await framework.globalConfig$
         .pipe(
diff --git a/src/plugins/vis_type_timeseries/server/lib/get_vis_data.ts b/src/plugins/vis_type_timeseries/server/lib/get_vis_data.ts
index f697e754a2e00..5eef2b53e2431 100644
--- a/src/plugins/vis_type_timeseries/server/lib/get_vis_data.ts
+++ b/src/plugins/vis_type_timeseries/server/lib/get_vis_data.ts
@@ -21,7 +21,7 @@ import { FakeRequest, RequestHandlerContext } from 'kibana/server';
 import _ from 'lodash';
 import { first, map } from 'rxjs/operators';
 import { getPanelData } from './vis_data/get_panel_data';
-import { Framework } from '../index';
+import { Framework } from '../plugin';
 import { ReqFacade } from './search_strategies/strategies/abstract_search_strategy';
 
 interface GetVisDataResponse {
@@ -65,28 +65,13 @@ export function getVisData(
   // level object passed from here. The layers should be refactored fully at some point, but for now
   // this works and we are still using the New Platform services for these vis data portions.
   const reqFacade: ReqFacade = {
+    requestContext,
     ...request,
     framework,
     pre: {},
     payload: request.body,
     getUiSettingsService: () => requestContext.core.uiSettings.client,
     getSavedObjectsClient: () => requestContext.core.savedObjects.client,
-    server: {
-      plugins: {
-        elasticsearch: {
-          getCluster: () => {
-            return {
-              callWithRequest: async (req: any, endpoint: string, params: any) => {
-                return await requestContext.core.elasticsearch.legacy.client.callAsCurrentUser(
-                  endpoint,
-                  params
-                );
-              },
-            };
-          },
-        },
-      },
-    },
     getEsShardTimeout: async () => {
       return await framework.globalConfig$
         .pipe(
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/abstract_request.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/abstract_request.js
deleted file mode 100644
index abd2a4c65d35c..0000000000000
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/abstract_request.js
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-export class AbstractSearchRequest {
-  constructor(req, callWithRequest) {
-    this.req = req;
-    this.callWithRequest = callWithRequest;
-  }
-
-  search() {
-    throw new Error('AbstractSearchRequest: search method should be defined');
-  }
-}
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/abstract_request.test.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/abstract_request.test.js
deleted file mode 100644
index 6f71aa63728d5..0000000000000
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/abstract_request.test.js
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { AbstractSearchRequest } from './abstract_request';
-
-describe('AbstractSearchRequest', () => {
-  let searchRequest;
-  let req;
-  let callWithRequest;
-
-  beforeEach(() => {
-    req = {};
-    callWithRequest = jest.fn();
-    searchRequest = new AbstractSearchRequest(req, callWithRequest);
-  });
-
-  test('should init an AbstractSearchRequest instance', () => {
-    expect(searchRequest.req).toBe(req);
-    expect(searchRequest.callWithRequest).toBe(callWithRequest);
-    expect(searchRequest.search).toBeDefined();
-  });
-
-  test('should throw an error trying to search', () => {
-    try {
-      searchRequest.search();
-    } catch (error) {
-      expect(error instanceof Error).toBe(true);
-      expect(error.message).toEqual('AbstractSearchRequest: search method should be defined');
-    }
-  });
-});
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/multi_search_request.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/multi_search_request.js
deleted file mode 100644
index 9ada39e359589..0000000000000
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/multi_search_request.js
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { AbstractSearchRequest } from './abstract_request';
-import { UI_SETTINGS } from '../../../../../data/server';
-
-const SEARCH_METHOD = 'msearch';
-
-export class MultiSearchRequest extends AbstractSearchRequest {
-  async search(searches) {
-    const includeFrozen = await this.req
-      .getUiSettingsService()
-      .get(UI_SETTINGS.SEARCH_INCLUDE_FROZEN);
-    const multiSearchBody = searches.reduce(
-      (acc, { body, index }) => [
-        ...acc,
-        {
-          index,
-          ignoreUnavailable: true,
-        },
-        body,
-      ],
-      []
-    );
-
-    const { responses } = await this.callWithRequest(this.req, SEARCH_METHOD, {
-      body: multiSearchBody,
-      rest_total_hits_as_int: true,
-      ignore_throttled: !includeFrozen,
-    });
-
-    return responses;
-  }
-}
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/multi_search_request.test.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/multi_search_request.test.js
deleted file mode 100644
index c113db76332b7..0000000000000
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/multi_search_request.test.js
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { MultiSearchRequest } from './multi_search_request';
-import { UI_SETTINGS } from '../../../../../data/server';
-
-describe('MultiSearchRequest', () => {
-  let searchRequest;
-  let req;
-  let callWithRequest;
-  let getServiceMock;
-  let includeFrozen;
-
-  beforeEach(() => {
-    includeFrozen = false;
-    getServiceMock = jest.fn().mockResolvedValue(includeFrozen);
-    req = {
-      getUiSettingsService: jest.fn().mockReturnValue({ get: getServiceMock }),
-    };
-    callWithRequest = jest.fn().mockReturnValue({ responses: [] });
-    searchRequest = new MultiSearchRequest(req, callWithRequest);
-  });
-
-  test('should init an MultiSearchRequest instance', () => {
-    expect(searchRequest.req).toBe(req);
-    expect(searchRequest.callWithRequest).toBe(callWithRequest);
-    expect(searchRequest.search).toBeDefined();
-  });
-
-  test('should get the response from elastic msearch', async () => {
-    const searches = [
-      { body: 'body1', index: 'index' },
-      { body: 'body2', index: 'index' },
-    ];
-
-    const responses = await searchRequest.search(searches);
-
-    expect(responses).toEqual([]);
-    expect(req.getUiSettingsService).toHaveBeenCalled();
-    expect(getServiceMock).toHaveBeenCalledWith(UI_SETTINGS.SEARCH_INCLUDE_FROZEN);
-    expect(callWithRequest).toHaveBeenCalledWith(req, 'msearch', {
-      body: [
-        { ignoreUnavailable: true, index: 'index' },
-        'body1',
-        { ignoreUnavailable: true, index: 'index' },
-        'body2',
-      ],
-      rest_total_hits_as_int: true,
-      ignore_throttled: !includeFrozen,
-    });
-  });
-});
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/search_request.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/search_request.js
deleted file mode 100644
index e6e3bcb527286..0000000000000
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/search_request.js
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { AbstractSearchRequest } from './abstract_request';
-
-import { MultiSearchRequest } from './multi_search_request';
-import { SingleSearchRequest } from './single_search_request';
-
-export class SearchRequest extends AbstractSearchRequest {
-  getSearchRequestType(searches) {
-    const isMultiSearch = Array.isArray(searches) && searches.length > 1;
-    const SearchRequest = isMultiSearch ? MultiSearchRequest : SingleSearchRequest;
-
-    return new SearchRequest(this.req, this.callWithRequest);
-  }
-
-  async search(options) {
-    const concreteSearchRequest = this.getSearchRequestType(options);
-
-    return concreteSearchRequest.search(options);
-  }
-}
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/search_request.test.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/search_request.test.js
deleted file mode 100644
index 3d35a4aa37c5a..0000000000000
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/search_request.test.js
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { SearchRequest } from './search_request';
-import { MultiSearchRequest } from './multi_search_request';
-import { SingleSearchRequest } from './single_search_request';
-
-describe('SearchRequest', () => {
-  let searchRequest;
-  let req;
-  let callWithRequest;
-  let getServiceMock;
-  let includeFrozen;
-
-  beforeEach(() => {
-    includeFrozen = false;
-    getServiceMock = jest.fn().mockResolvedValue(includeFrozen);
-    req = {
-      getUiSettingsService: jest.fn().mockReturnValue({ get: getServiceMock }),
-    };
-    callWithRequest = jest.fn().mockReturnValue({ responses: [] });
-    searchRequest = new SearchRequest(req, callWithRequest);
-  });
-
-  test('should init an AbstractSearchRequest instance', () => {
-    expect(searchRequest.req).toBe(req);
-    expect(searchRequest.callWithRequest).toBe(callWithRequest);
-    expect(searchRequest.search).toBeDefined();
-  });
-
-  test('should return search value', async () => {
-    const concreteSearchRequest = {
-      search: jest.fn().mockReturnValue('concreteSearchRequest'),
-    };
-    const options = {};
-    searchRequest.getSearchRequestType = jest.fn().mockReturnValue(concreteSearchRequest);
-
-    const result = await searchRequest.search(options);
-
-    expect(result).toBe('concreteSearchRequest');
-  });
-
-  test('should return a MultiSearchRequest for multi searches', () => {
-    const searches = [
-      { index: 'index', body: 'body' },
-      { index: 'index', body: 'body' },
-    ];
-
-    const result = searchRequest.getSearchRequestType(searches);
-
-    expect(result instanceof MultiSearchRequest).toBe(true);
-  });
-
-  test('should return a SingleSearchRequest for single search', () => {
-    const searches = [{ index: 'index', body: 'body' }];
-
-    const result = searchRequest.getSearchRequestType(searches);
-
-    expect(result instanceof SingleSearchRequest).toBe(true);
-  });
-});
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/single_search_request.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/single_search_request.js
deleted file mode 100644
index 7d8b60a7e4595..0000000000000
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/single_search_request.js
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { AbstractSearchRequest } from './abstract_request';
-import { UI_SETTINGS } from '../../../../../data/server';
-
-const SEARCH_METHOD = 'search';
-
-export class SingleSearchRequest extends AbstractSearchRequest {
-  async search([{ body, index }]) {
-    const includeFrozen = await this.req
-      .getUiSettingsService()
-      .get(UI_SETTINGS.SEARCH_INCLUDE_FROZEN);
-    const resp = await this.callWithRequest(this.req, SEARCH_METHOD, {
-      ignore_throttled: !includeFrozen,
-      body,
-      index,
-    });
-
-    return [resp];
-  }
-}
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/single_search_request.test.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/single_search_request.test.js
deleted file mode 100644
index b899814f2fe13..0000000000000
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_requests/single_search_request.test.js
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { SingleSearchRequest } from './single_search_request';
-import { UI_SETTINGS } from '../../../../../data/server';
-
-describe('SingleSearchRequest', () => {
-  let searchRequest;
-  let req;
-  let callWithRequest;
-  let getServiceMock;
-  let includeFrozen;
-
-  beforeEach(() => {
-    includeFrozen = false;
-    getServiceMock = jest.fn().mockResolvedValue(includeFrozen);
-    req = {
-      getUiSettingsService: jest.fn().mockReturnValue({ get: getServiceMock }),
-    };
-    callWithRequest = jest.fn().mockReturnValue({});
-    searchRequest = new SingleSearchRequest(req, callWithRequest);
-  });
-
-  test('should init an SingleSearchRequest instance', () => {
-    expect(searchRequest.req).toBe(req);
-    expect(searchRequest.callWithRequest).toBe(callWithRequest);
-    expect(searchRequest.search).toBeDefined();
-  });
-
-  test('should get the response from elastic search', async () => {
-    const searches = [{ body: 'body', index: 'index' }];
-
-    const responses = await searchRequest.search(searches);
-
-    expect(responses).toEqual([{}]);
-    expect(req.getUiSettingsService).toHaveBeenCalled();
-    expect(getServiceMock).toHaveBeenCalledWith(UI_SETTINGS.SEARCH_INCLUDE_FROZEN);
-    expect(callWithRequest).toHaveBeenCalledWith(req, 'search', {
-      body: 'body',
-      index: 'index',
-      ignore_throttled: !includeFrozen,
-    });
-  });
-});
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_strategies_registry.test.ts b/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_strategies_registry.test.ts
index ecd09653b3b48..66ea4f017dd90 100644
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_strategies_registry.test.ts
+++ b/src/plugins/vis_type_timeseries/server/lib/search_strategies/search_strategies_registry.test.ts
@@ -65,7 +65,7 @@ describe('SearchStrategyRegister', () => {
   });
 
   test('should add a strategy if it is an instance of AbstractSearchStrategy', () => {
-    const anotherSearchStrategy = new MockSearchStrategy({}, {} as any, {});
+    const anotherSearchStrategy = new MockSearchStrategy('es');
     const addedStrategies = registry.addStrategy(anotherSearchStrategy);
 
     expect(addedStrategies.length).toEqual(2);
@@ -75,7 +75,7 @@ describe('SearchStrategyRegister', () => {
   test('should return a MockSearchStrategy instance', async () => {
     const req = {};
     const indexPattern = '*';
-    const anotherSearchStrategy = new MockSearchStrategy({}, {} as any, {});
+    const anotherSearchStrategy = new MockSearchStrategy('es');
     registry.addStrategy(anotherSearchStrategy);
 
     const { searchStrategy, capabilities } = (await registry.getViableStrategy(req, indexPattern))!;
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.test.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.test.js
index 1fbaffd794c89..6773ee482b098 100644
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.test.js
+++ b/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.test.js
@@ -18,24 +18,13 @@
  */
 import { AbstractSearchStrategy } from './abstract_search_strategy';
 
-class SearchRequest {
-  constructor(req, callWithRequest) {
-    this.req = req;
-    this.callWithRequest = callWithRequest;
-  }
-}
-
 describe('AbstractSearchStrategy', () => {
   let abstractSearchStrategy;
-  let server;
-  let callWithRequestFactory;
   let req;
   let mockedFields;
   let indexPattern;
 
   beforeEach(() => {
-    server = {};
-    callWithRequestFactory = jest.fn().mockReturnValue('callWithRequest');
     mockedFields = {};
     req = {
       pre: {
@@ -45,16 +34,11 @@ describe('AbstractSearchStrategy', () => {
       },
     };
 
-    abstractSearchStrategy = new AbstractSearchStrategy(
-      server,
-      callWithRequestFactory,
-      SearchRequest
-    );
+    abstractSearchStrategy = new AbstractSearchStrategy('es');
   });
 
   test('should init an AbstractSearchStrategy instance', () => {
-    expect(abstractSearchStrategy.getCallWithRequestInstance).toBeDefined();
-    expect(abstractSearchStrategy.getSearchRequest).toBeDefined();
+    expect(abstractSearchStrategy.search).toBeDefined();
     expect(abstractSearchStrategy.getFieldsForWildcard).toBeDefined();
     expect(abstractSearchStrategy.checkForViability).toBeDefined();
   });
@@ -68,17 +52,46 @@ describe('AbstractSearchStrategy', () => {
     });
   });
 
-  test('should invoke callWithRequestFactory with req param passed', () => {
-    abstractSearchStrategy.getCallWithRequestInstance(req);
+  test('should return response', async () => {
+    const searches = [{ body: 'body', index: 'index' }];
+    const searchFn = jest.fn().mockReturnValue(Promise.resolve({}));
 
-    expect(callWithRequestFactory).toHaveBeenCalledWith(server, req);
-  });
-
-  test('should return a search request', () => {
-    const searchRequest = abstractSearchStrategy.getSearchRequest(req);
+    const responses = await abstractSearchStrategy.search(
+      {
+        requestContext: {},
+        framework: {
+          core: {
+            getStartServices: jest.fn().mockReturnValue(
+              Promise.resolve([
+                {},
+                {
+                  data: {
+                    search: {
+                      search: searchFn,
+                    },
+                  },
+                },
+              ])
+            ),
+          },
+        },
+      },
+      searches
+    );
 
-    expect(searchRequest instanceof SearchRequest).toBe(true);
-    expect(searchRequest.callWithRequest).toBe('callWithRequest');
-    expect(searchRequest.req).toBe(req);
+    expect(responses).toEqual([{}]);
+    expect(searchFn).toHaveBeenCalledWith(
+      {},
+      {
+        params: {
+          body: 'body',
+          index: 'index',
+        },
+        indexType: undefined,
+      },
+      {
+        strategy: 'es',
+      }
+    );
   });
 });
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.ts b/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.ts
index 0b1c6e6e20414..92b7e6976962e 100644
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.ts
+++ b/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.ts
@@ -18,7 +18,7 @@
  */
 
 import {
-  LegacyAPICaller,
+  RequestHandlerContext,
   FakeRequest,
   IUiSettingsClient,
   SavedObjectsClientContract,
@@ -33,6 +33,7 @@ import { IndexPatternsFetcher } from '../../../../../data/server';
  * This will be replaced by standard KibanaRequest and RequestContext objects in a later version.
  */
 export type ReqFacade = FakeRequest & {
+  requestContext: RequestHandlerContext;
   framework: Framework;
   payload: unknown;
   pre: {
@@ -40,34 +41,42 @@ export type ReqFacade = FakeRequest & {
   };
   getUiSettingsService: () => IUiSettingsClient;
   getSavedObjectsClient: () => SavedObjectsClientContract;
-  server: {
-    plugins: {
-      elasticsearch: {
-        getCluster: () => {
-          callWithRequest: (req: ReqFacade, endpoint: string, params: any) => Promise<any>;
-        };
-      };
-    };
-  };
   getEsShardTimeout: () => Promise<number>;
 };
 
 export class AbstractSearchStrategy {
-  public getCallWithRequestInstance: (req: ReqFacade) => LegacyAPICaller;
-  public getSearchRequest: (req: ReqFacade) => any;
-
-  constructor(
-    server: any,
-    callWithRequestFactory: (server: any, req: ReqFacade) => LegacyAPICaller,
-    SearchRequest: any
-  ) {
-    this.getCallWithRequestInstance = (req) => callWithRequestFactory(server, req);
+  public searchStrategyName!: string;
+  public indexType?: string;
+  public additionalParams: any;
 
-    this.getSearchRequest = (req) => {
-      const callWithRequest = this.getCallWithRequestInstance(req);
+  constructor(name: string, type?: string, additionalParams: any = {}) {
+    this.searchStrategyName = name;
+    this.indexType = type;
+    this.additionalParams = additionalParams;
+  }
 
-      return new SearchRequest(req, callWithRequest);
-    };
+  async search(req: ReqFacade, bodies: any[], options = {}) {
+    const [, deps] = await req.framework.core.getStartServices();
+    const requests: any[] = [];
+    bodies.forEach((body) => {
+      requests.push(
+        deps.data.search.search(
+          req.requestContext,
+          {
+            params: {
+              ...body,
+              ...this.additionalParams,
+            },
+            indexType: this.indexType,
+          },
+          {
+            ...options,
+            strategy: this.searchStrategyName,
+          }
+        )
+      );
+    });
+    return Promise.all(requests);
   }
 
   async getFieldsForWildcard(req: ReqFacade, indexPattern: string, capabilities: any) {
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/default_search_strategy.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/default_search_strategy.js
index 63f2911ce1118..7c3609ae3c405 100644
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/default_search_strategy.js
+++ b/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/default_search_strategy.js
@@ -16,21 +16,16 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+
+import { ES_SEARCH_STRATEGY } from '../../../../../data/server';
 import { AbstractSearchStrategy } from './abstract_search_strategy';
-import { SearchRequest } from '../search_requests/search_request';
 import { DefaultSearchCapabilities } from '../default_search_capabilities';
 
-const callWithRequestFactory = (server, request) => {
-  const { callWithRequest } = request.server.plugins.elasticsearch.getCluster('data');
-
-  return callWithRequest;
-};
-
 export class DefaultSearchStrategy extends AbstractSearchStrategy {
   name = 'default';
 
-  constructor(server) {
-    super(server, callWithRequestFactory, SearchRequest);
+  constructor() {
+    super(ES_SEARCH_STRATEGY);
   }
 
   checkForViability(req) {
diff --git a/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/default_search_strategy.test.js b/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/default_search_strategy.test.js
index 2e3a459bf06fd..a9994ba3e1f75 100644
--- a/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/default_search_strategy.test.js
+++ b/src/plugins/vis_type_timeseries/server/lib/search_strategies/strategies/default_search_strategy.test.js
@@ -20,42 +20,20 @@ import { DefaultSearchStrategy } from './default_search_strategy';
 
 describe('DefaultSearchStrategy', () => {
   let defaultSearchStrategy;
-  let server;
-  let callWithRequest;
   let req;
 
   beforeEach(() => {
-    server = {};
-    callWithRequest = jest.fn();
-    req = {
-      server: {
-        plugins: {
-          elasticsearch: {
-            getCluster: jest.fn().mockReturnValue({
-              callWithRequest,
-            }),
-          },
-        },
-      },
-    };
-    defaultSearchStrategy = new DefaultSearchStrategy(server);
+    req = {};
+    defaultSearchStrategy = new DefaultSearchStrategy();
   });
 
   test('should init an DefaultSearchStrategy instance', () => {
     expect(defaultSearchStrategy.name).toBe('default');
     expect(defaultSearchStrategy.checkForViability).toBeDefined();
-    expect(defaultSearchStrategy.getCallWithRequestInstance).toBeDefined();
-    expect(defaultSearchStrategy.getSearchRequest).toBeDefined();
+    expect(defaultSearchStrategy.search).toBeDefined();
     expect(defaultSearchStrategy.getFieldsForWildcard).toBeDefined();
   });
 
-  test('should invoke callWithRequestFactory with passed params', () => {
-    const value = defaultSearchStrategy.getCallWithRequestInstance(req);
-
-    expect(value).toBe(callWithRequest);
-    expect(req.server.plugins.elasticsearch.getCluster).toHaveBeenCalledWith('data');
-  });
-
   test('should check a strategy for viability', () => {
     const value = defaultSearchStrategy.checkForViability(req);
 
diff --git a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_annotations.js b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_annotations.js
index b015aaf0ef8db..d8a230dfeef4e 100644
--- a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_annotations.js
+++ b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_annotations.js
@@ -39,7 +39,6 @@ export async function getAnnotations({
   capabilities,
   series,
 }) {
-  const searchRequest = searchStrategy.getSearchRequest(req);
   const annotations = panel.annotations.filter(validAnnotation);
   const lastSeriesTimestamp = getLastSeriesTimestamp(series);
   const handleAnnotationResponseBy = handleAnnotationResponse(lastSeriesTimestamp);
@@ -47,6 +46,7 @@ export async function getAnnotations({
   const bodiesPromises = annotations.map((annotation) =>
     getAnnotationRequestParams(req, panel, annotation, esQueryConfig, capabilities)
   );
+
   const searches = (await Promise.all(bodiesPromises)).reduce(
     (acc, items) => acc.concat(items),
     []
@@ -55,10 +55,10 @@ export async function getAnnotations({
   if (!searches.length) return { responses: [] };
 
   try {
-    const data = await searchRequest.search(searches);
+    const data = await searchStrategy.search(req.framework.core, req.requestContext, searches);
 
     return annotations.reduce((acc, annotation, index) => {
-      acc[annotation.id] = handleAnnotationResponseBy(data[index], annotation);
+      acc[annotation.id] = handleAnnotationResponseBy(data[index].rawResponse, annotation);
 
       return acc;
     }, {});
diff --git a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_series_data.js b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_series_data.js
index ee48816c6a8af..1eace13c2e336 100644
--- a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_series_data.js
+++ b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_series_data.js
@@ -28,7 +28,6 @@ export async function getSeriesData(req, panel) {
     searchStrategy,
     capabilities,
   } = await req.framework.searchStrategyRegistry.getViableStrategyForPanel(req, panel);
-  const searchRequest = searchStrategy.getSearchRequest(req);
   const esQueryConfig = await getEsQueryConfig(req);
   const meta = {
     type: panel.type,
@@ -45,8 +44,13 @@ export async function getSeriesData(req, panel) {
       []
     );
 
-    const data = await searchRequest.search(searches);
-    const series = data.map(handleResponseBody(panel));
+    const data = await searchStrategy.search(req, searches);
+
+    const handleResponseBodyFn = handleResponseBody(panel);
+
+    const series = data.map((resp) =>
+      handleResponseBodyFn(resp.rawResponse ? resp.rawResponse : resp)
+    );
     let annotations = null;
 
     if (panel.annotations && panel.annotations.length) {
diff --git a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_table_data.js b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_table_data.js
index 1d1c245907959..3791eb229db5b 100644
--- a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_table_data.js
+++ b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_table_data.js
@@ -30,7 +30,6 @@ export async function getTableData(req, panel) {
     searchStrategy,
     capabilities,
   } = await req.framework.searchStrategyRegistry.getViableStrategy(req, panelIndexPattern);
-  const searchRequest = searchStrategy.getSearchRequest(req);
   const esQueryConfig = await getEsQueryConfig(req);
   const { indexPatternObject } = await getIndexPatternObject(req, panelIndexPattern);
 
@@ -41,13 +40,18 @@ export async function getTableData(req, panel) {
 
   try {
     const body = buildRequestBody(req, panel, esQueryConfig, indexPatternObject, capabilities);
-    const [resp] = await searchRequest.search([
+    const [resp] = await searchStrategy.search(req, [
       {
         body,
         index: panelIndexPattern,
       },
     ]);
-    const buckets = get(resp, 'aggregations.pivot.buckets', []);
+
+    const buckets = get(
+      resp.rawResponse ? resp.rawResponse : resp,
+      'aggregations.pivot.buckets',
+      []
+    );
 
     return {
       ...meta,
diff --git a/src/plugins/vis_type_timeseries/server/plugin.ts b/src/plugins/vis_type_timeseries/server/plugin.ts
index d863937a4e3dc..678ba2b371978 100644
--- a/src/plugins/vis_type_timeseries/server/plugin.ts
+++ b/src/plugins/vis_type_timeseries/server/plugin.ts
@@ -33,6 +33,7 @@ import { VisTypeTimeseriesConfig } from './config';
 import { getVisData, GetVisData, GetVisDataOptions } from './lib/get_vis_data';
 import { ValidationTelemetryService } from './validation_telemetry';
 import { UsageCollectionSetup } from '../../usage_collection/server';
+import { PluginStart } from '../../data/server';
 import { visDataRoutes } from './routes/vis';
 // @ts-ignore
 import { fieldsRoutes } from './routes/fields';
@@ -47,6 +48,10 @@ interface VisTypeTimeseriesPluginSetupDependencies {
   usageCollection?: UsageCollectionSetup;
 }
 
+interface VisTypeTimeseriesPluginStartDependencies {
+  data: PluginStart;
+}
+
 export interface VisTypeTimeseriesSetup {
   getVisData: (
     requestContext: RequestHandlerContext,
@@ -57,7 +62,7 @@ export interface VisTypeTimeseriesSetup {
 }
 
 export interface Framework {
-  core: CoreSetup;
+  core: CoreSetup<VisTypeTimeseriesPluginStartDependencies>;
   plugins: any;
   config$: Observable<VisTypeTimeseriesConfig>;
   globalConfig$: PluginInitializerContext['config']['legacy']['globalConfig$'];
@@ -74,7 +79,10 @@ export class VisTypeTimeseriesPlugin implements Plugin<VisTypeTimeseriesSetup> {
     this.validationTelementryService = new ValidationTelemetryService();
   }
 
-  public setup(core: CoreSetup, plugins: VisTypeTimeseriesPluginSetupDependencies) {
+  public setup(
+    core: CoreSetup<VisTypeTimeseriesPluginStartDependencies>,
+    plugins: VisTypeTimeseriesPluginSetupDependencies
+  ) {
     const logger = this.initializerContext.logger.get('visTypeTimeseries');
     core.uiSettings.register(uiSettings);
     const config$ = this.initializerContext.config.create<VisTypeTimeseriesConfig>();
diff --git a/src/plugins/vis_type_timeseries/server/routes/vis.ts b/src/plugins/vis_type_timeseries/server/routes/vis.ts
index 48efd4398e4d4..1ca8b57ab230f 100644
--- a/src/plugins/vis_type_timeseries/server/routes/vis.ts
+++ b/src/plugins/vis_type_timeseries/server/routes/vis.ts
@@ -21,7 +21,8 @@ import { IRouter, KibanaRequest } from 'kibana/server';
 import { schema } from '@kbn/config-schema';
 import { getVisData, GetVisDataOptions } from '../lib/get_vis_data';
 import { visPayloadSchema } from '../../common/vis_schema';
-import { Framework, ValidationTelemetryServiceSetup } from '../index';
+import { ValidationTelemetryServiceSetup } from '../index';
+import { Framework } from '../plugin';
 
 const escapeHatch = schema.object({}, { unknowns: 'allow' });
 
diff --git a/src/plugins/visualizations/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap b/src/plugins/visualizations/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap
index 3c4c983efa9fa..0925d1c7cc0c9 100644
--- a/src/plugins/visualizations/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap
+++ b/src/plugins/visualizations/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap
@@ -196,7 +196,7 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                             >
                               <input
                                 aria-label="Filter for a visualization type"
-                                class="euiFieldSearch euiFieldSearch--fullWidth"
+                                class="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch-isClearable"
                                 data-test-subj="filterVisType"
                                 placeholder="Filter"
                                 type="search"
@@ -517,7 +517,7 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                                             <EuiValidatableControl>
                                               <input
                                                 aria-label="Filter for a visualization type"
-                                                className="euiFieldSearch euiFieldSearch--fullWidth"
+                                                className="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch-isClearable"
                                                 data-test-subj="filterVisType"
                                                 onChange={[Function]}
                                                 onKeyUp={[Function]}
@@ -1109,7 +1109,7 @@ exports[`NewVisModal should render as expected 1`] = `
                             >
                               <input
                                 aria-label="Filter for a visualization type"
-                                class="euiFieldSearch euiFieldSearch--fullWidth"
+                                class="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch-isClearable"
                                 data-test-subj="filterVisType"
                                 placeholder="Filter"
                                 type="search"
@@ -1408,7 +1408,7 @@ exports[`NewVisModal should render as expected 1`] = `
                                             <EuiValidatableControl>
                                               <input
                                                 aria-label="Filter for a visualization type"
-                                                className="euiFieldSearch euiFieldSearch--fullWidth"
+                                                className="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch-isClearable"
                                                 data-test-subj="filterVisType"
                                                 onChange={[Function]}
                                                 onKeyUp={[Function]}
diff --git a/test/api_integration/apis/elasticsearch/index.js b/test/api_integration/apis/elasticsearch/index.js
deleted file mode 100644
index 5a3dc47aab9bb..0000000000000
--- a/test/api_integration/apis/elasticsearch/index.js
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export default function ({ getService }) {
-  const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
-
-  describe('elasticsearch', () => {
-    before(() => esArchiver.load('elasticsearch'));
-    after(() => esArchiver.unload('elasticsearch'));
-
-    it('allows search to specific index', async () =>
-      await supertest.post('/elasticsearch/elasticsearch/_search').expect(200));
-
-    it('allows msearch', async () =>
-      await supertest
-        .post('/elasticsearch/_msearch')
-        .set('content-type', 'application/x-ndjson')
-        .send(
-          '{"index":"logstash-2015.04.21","ignore_unavailable":true}\n{"size":500,"sort":{"@timestamp":"desc"},"query":{"bool":{"must":[{"query_string":{"analyze_wildcard":true,"query":"*"}},{"bool":{"must":[{"range":{"@timestamp":{"gte":1429577068175,"lte":1429577968175}}}],"must_not":[]}}],"must_not":[]}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}}},"aggs":{"2":{"date_histogram":{"field":"@timestamp","interval":"30s","min_doc_count":0,"extended_bounds":{"min":1429577068175,"max":1429577968175}}}},"stored_fields":["*"],"_source": true,"script_fields":{},"docvalue_fields":["timestamp_offset","@timestamp","utc_time"]}\n'
-        )
-        .expect(200));
-  });
-}
diff --git a/test/api_integration/apis/index.js b/test/api_integration/apis/index.js
index bfbf873cf0616..d07c099634005 100644
--- a/test/api_integration/apis/index.js
+++ b/test/api_integration/apis/index.js
@@ -20,7 +20,6 @@
 export default function ({ loadTestFile }) {
   describe('apis', () => {
     loadTestFile(require.resolve('./core'));
-    loadTestFile(require.resolve('./elasticsearch'));
     loadTestFile(require.resolve('./general'));
     loadTestFile(require.resolve('./home'));
     loadTestFile(require.resolve('./index_patterns'));
diff --git a/test/api_integration/apis/telemetry/telemetry_local.js b/test/api_integration/apis/telemetry/telemetry_local.js
index d2d61705b763d..9a5467e622ff3 100644
--- a/test/api_integration/apis/telemetry/telemetry_local.js
+++ b/test/api_integration/apis/telemetry/telemetry_local.js
@@ -154,5 +154,113 @@ export default function ({ getService }) {
 
       expect(expected.every((m) => actual.includes(m))).to.be.ok();
     });
+
+    describe('application usage limits', () => {
+      const timeRange = {
+        min: '2018-07-23T22:07:00Z',
+        max: '2018-07-23T22:13:00Z',
+      };
+
+      function createSavedObject() {
+        return supertest
+          .post('/api/saved_objects/application_usage_transactional')
+          .send({
+            attributes: {
+              appId: 'test-app',
+              minutesOnScreen: 10.99,
+              numberOfClicks: 10,
+              timestamp: new Date().toISOString(),
+            },
+          })
+          .expect(200)
+          .then((resp) => resp.body.id);
+      }
+
+      describe('basic behaviour', () => {
+        let savedObjectId;
+        before('create 1 entry', async () => {
+          return createSavedObject().then((id) => (savedObjectId = id));
+        });
+        after('cleanup', () => {
+          return supertest
+            .delete(`/api/saved_objects/application_usage_transactional/${savedObjectId}`)
+            .expect(200);
+        });
+
+        it('should return application_usage data', async () => {
+          const { body } = await supertest
+            .post('/api/telemetry/v2/clusters/_stats')
+            .set('kbn-xsrf', 'xxx')
+            .send({ timeRange, unencrypted: true })
+            .expect(200);
+
+          expect(body.length).to.be(1);
+          const stats = body[0];
+          expect(stats.stack_stats.kibana.plugins.application_usage).to.eql({
+            'test-app': {
+              clicks_total: 10,
+              clicks_7_days: 10,
+              clicks_30_days: 10,
+              clicks_90_days: 10,
+              minutes_on_screen_total: 10.99,
+              minutes_on_screen_7_days: 10.99,
+              minutes_on_screen_30_days: 10.99,
+              minutes_on_screen_90_days: 10.99,
+            },
+          });
+        });
+      });
+
+      describe('10k + 1', () => {
+        const savedObjectIds = [];
+        before('create 10k + 1 entries for application usage', async () => {
+          await supertest
+            .post('/api/saved_objects/_bulk_create')
+            .send(
+              new Array(10001).fill(0).map(() => ({
+                type: 'application_usage_transactional',
+                attributes: {
+                  appId: 'test-app',
+                  minutesOnScreen: 1,
+                  numberOfClicks: 1,
+                  timestamp: new Date().toISOString(),
+                },
+              }))
+            )
+            .expect(200)
+            .then((resp) => resp.body.saved_objects.forEach(({ id }) => savedObjectIds.push(id)));
+        });
+        after('clean them all', async () => {
+          // The SavedObjects API does not allow bulk deleting, and deleting one by one takes ages and the tests timeout
+          await es.deleteByQuery({
+            index: '.kibana',
+            body: { query: { term: { type: 'application_usage_transactional' } } },
+          });
+        });
+
+        it("should only use the first 10k docs for the application_usage data (they'll be rolled up in a later process)", async () => {
+          const { body } = await supertest
+            .post('/api/telemetry/v2/clusters/_stats')
+            .set('kbn-xsrf', 'xxx')
+            .send({ timeRange, unencrypted: true })
+            .expect(200);
+
+          expect(body.length).to.be(1);
+          const stats = body[0];
+          expect(stats.stack_stats.kibana.plugins.application_usage).to.eql({
+            'test-app': {
+              clicks_total: 10000,
+              clicks_7_days: 10000,
+              clicks_30_days: 10000,
+              clicks_90_days: 10000,
+              minutes_on_screen_total: 10000,
+              minutes_on_screen_7_days: 10000,
+              minutes_on_screen_30_days: 10000,
+              minutes_on_screen_90_days: 10000,
+            },
+          });
+        });
+      });
+    });
   });
 }
diff --git a/test/common/services/security/security.ts b/test/common/services/security/security.ts
index fae4c9198cab6..d94822611f80b 100644
--- a/test/common/services/security/security.ts
+++ b/test/common/services/security/security.ts
@@ -21,7 +21,7 @@ import { Role } from './role';
 import { User } from './user';
 import { RoleMappings } from './role_mappings';
 import { FtrProviderContext } from '../../ftr_provider_context';
-import { createTestUserService } from './test_user';
+import { createTestUserService, TestUserSupertestProvider } from './test_user';
 
 export async function SecurityServiceProvider(context: FtrProviderContext) {
   const { getService } = context;
@@ -31,11 +31,13 @@ export async function SecurityServiceProvider(context: FtrProviderContext) {
   const role = new Role(log, kibanaServer);
   const user = new User(log, kibanaServer);
   const testUser = await createTestUserService(role, user, context);
+  const testUserSupertest = TestUserSupertestProvider(context);
 
   return new (class SecurityService {
     roleMappings = new RoleMappings(log, kibanaServer);
     testUser = testUser;
     role = role;
     user = user;
+    testUserSupertest = testUserSupertest;
   })();
 }
diff --git a/test/common/services/security/test_user.ts b/test/common/services/security/test_user.ts
index 83eac78621a53..7183943591c88 100644
--- a/test/common/services/security/test_user.ts
+++ b/test/common/services/security/test_user.ts
@@ -16,12 +16,18 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+import { format as formatUrl } from 'url';
+import supertestAsPromised from 'supertest-as-promised';
+
 import { Role } from './role';
 import { User } from './user';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { Browser } from '../../../functional/services/common';
 import { TestSubjects } from '../../../functional/services/common';
 
+const TEST_USER_NAME = 'test_user';
+const TEST_USER_PASSWORD = 'changeme';
+
 export async function createTestUserService(
   role: Role,
   user: User,
@@ -50,15 +56,15 @@ export async function createTestUserService(
     }
     try {
       // delete the test_user if present (will it error if the user doesn't exist?)
-      await user.delete('test_user');
+      await user.delete(TEST_USER_NAME);
     } catch (exception) {
       log.debug('no test user to delete');
     }
 
     // create test_user with username and pwd
     log.debug(`default roles = ${config.get('security.defaultRoles')}`);
-    await user.create('test_user', {
-      password: 'changeme',
+    await user.create(TEST_USER_NAME, {
+      password: TEST_USER_PASSWORD,
       roles: config.get('security.defaultRoles'),
       full_name: 'test user',
     });
@@ -74,13 +80,16 @@ export async function createTestUserService(
     async setRoles(roles: string[], shouldRefreshBrowser: boolean = true) {
       if (isEnabled()) {
         log.debug(`set roles = ${roles}`);
-        await user.create('test_user', {
-          password: 'changeme',
+        await user.create(TEST_USER_NAME, {
+          password: TEST_USER_PASSWORD,
           roles,
           full_name: 'test user',
         });
 
         if (browser && testSubjects && shouldRefreshBrowser) {
+          // accept alert if it pops up
+          const alert = await browser.getAlert();
+          await alert?.accept();
           if (await testSubjects.exists('kibanaChrome', { allowHidden: true })) {
             await browser.refresh();
             await testSubjects.find('kibanaChrome', config.get('timeouts.find') * 10);
@@ -90,3 +99,15 @@ export async function createTestUserService(
     }
   })();
 }
+
+export function TestUserSupertestProvider({ getService }: FtrProviderContext) {
+  const config = getService('config');
+  const kibanaServerConfig = config.get('servers.kibana');
+
+  return supertestAsPromised(
+    formatUrl({
+      ...kibanaServerConfig,
+      auth: `${TEST_USER_NAME}:${TEST_USER_PASSWORD}`,
+    })
+  );
+}
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index 31f4e393f019e..459f596b30256 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -496,6 +496,10 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
       const input = await find.byCssSelector('.euiFilePicker__input');
       await input.type(path);
     }
+
+    async scrollKibanaBodyTop() {
+      await browser.setScrollToById('kibana-body', 0, 0);
+    }
   }
 
   return new CommonPage();
diff --git a/test/functional/page_objects/discover_page.ts b/test/functional/page_objects/discover_page.ts
index 5a224d930ee42..7a99509257bf7 100644
--- a/test/functional/page_objects/discover_page.ts
+++ b/test/functional/page_objects/discover_page.ts
@@ -254,7 +254,7 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
     }
 
     public async getSidebarWidth() {
-      const sidebar = await find.byCssSelector('.sidebar-list');
+      const sidebar = await testSubjects.find('discover-sidebar');
       return await sidebar.getAttribute('clientWidth');
     }
 
diff --git a/test/functional/page_objects/settings_page.ts b/test/functional/page_objects/settings_page.ts
index 43e58a0a2e58d..cf75d5ad7c103 100644
--- a/test/functional/page_objects/settings_page.ts
+++ b/test/functional/page_objects/settings_page.ts
@@ -356,6 +356,7 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
     }
 
     async clickAddNewIndexPatternButton() {
+      await PageObjects.common.scrollKibanaBodyTop();
       await testSubjects.click('createIndexPatternButton');
     }
 
diff --git a/test/functional/services/common/browser.ts b/test/functional/services/common/browser.ts
index 2f8e87c1d58d6..daf1659f0cfe1 100644
--- a/test/functional/services/common/browser.ts
+++ b/test/functional/services/common/browser.ts
@@ -480,6 +480,12 @@ export async function BrowserProvider({ getService }: FtrProviderContext) {
       return this.getScrollTop();
     }
 
+    public async setScrollToById(elementId: string, xCoord: number, yCoord: number) {
+      await driver.executeScript(
+        `document.getElementById("${elementId}").scrollTo(${xCoord},${yCoord})`
+      );
+    }
+
     public async setScrollLeft(scrollSize: number | string) {
       await driver.executeScript('document.body.scrollLeft = ' + scrollSize);
       return this.getScrollLeft();
diff --git a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/package.json b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/package.json
index 7f3744c16397a..ace6a48ed8ff5 100644
--- a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/package.json
+++ b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/package.json
@@ -12,7 +12,7 @@
     "build": "rm -rf './target' && tsc"
   },
   "devDependencies": {
-    "@elastic/eui": "28.2.0",
+    "@elastic/eui": "28.4.0",
     "@kbn/plugin-helpers": "1.0.0",
     "react": "^16.12.0",
     "react-dom": "^16.12.0",
diff --git a/test/plugin_functional/plugins/kbn_sample_panel_action/package.json b/test/plugin_functional/plugins/kbn_sample_panel_action/package.json
index acb0cf67ac5c7..d98fa468bd6d1 100644
--- a/test/plugin_functional/plugins/kbn_sample_panel_action/package.json
+++ b/test/plugin_functional/plugins/kbn_sample_panel_action/package.json
@@ -12,7 +12,7 @@
     "build": "rm -rf './target' && tsc"
   },
   "devDependencies": {
-    "@elastic/eui": "28.2.0",
+    "@elastic/eui": "28.4.0",
     "react": "^16.12.0",
     "typescript": "4.0.2"
   }
diff --git a/test/plugin_functional/plugins/kbn_tp_custom_visualizations/package.json b/test/plugin_functional/plugins/kbn_tp_custom_visualizations/package.json
index ff84c25400af0..3ac03b444deaf 100644
--- a/test/plugin_functional/plugins/kbn_tp_custom_visualizations/package.json
+++ b/test/plugin_functional/plugins/kbn_tp_custom_visualizations/package.json
@@ -12,7 +12,7 @@
     "build": "rm -rf './target' && tsc"
   },
   "devDependencies": {
-    "@elastic/eui": "28.2.0",
+    "@elastic/eui": "28.4.0",
     "@kbn/plugin-helpers": "1.0.0",
     "react": "^16.12.0",
     "typescript": "4.0.2"
diff --git a/test/scripts/jenkins_visual_regression.sh b/test/scripts/jenkins_baseline.sh
similarity index 63%
rename from test/scripts/jenkins_visual_regression.sh
rename to test/scripts/jenkins_baseline.sh
index 17345d4301882..e679ac7f31bd1 100755
--- a/test/scripts/jenkins_visual_regression.sh
+++ b/test/scripts/jenkins_baseline.sh
@@ -9,10 +9,3 @@ linuxBuild="$(find "$KIBANA_DIR/target" -name 'kibana-*-linux-x86_64.tar.gz')"
 installDir="$PARENT_DIR/install/kibana"
 mkdir -p "$installDir"
 tar -xzf "$linuxBuild" -C "$installDir" --strip=1
-
-echo " -> running visual regression tests from kibana directory"
-yarn percy exec -t 10000 -- -- \
-  node scripts/functional_tests \
-    --debug --bail \
-    --kibana-install-dir "$installDir" \
-    --config test/visual_regression/config.ts;
diff --git a/test/scripts/jenkins_xpack_visual_regression.sh b/test/scripts/jenkins_xpack_baseline.sh
similarity index 64%
rename from test/scripts/jenkins_xpack_visual_regression.sh
rename to test/scripts/jenkins_xpack_baseline.sh
index 55d4a524820c5..7577b6927d166 100755
--- a/test/scripts/jenkins_xpack_visual_regression.sh
+++ b/test/scripts/jenkins_xpack_baseline.sh
@@ -14,16 +14,5 @@ tar -xzf "$linuxBuild" -C "$installDir" --strip=1
 mkdir -p "$WORKSPACE/kibana-build-xpack"
 cp -pR install/kibana/. $WORKSPACE/kibana-build-xpack/
 
-# cd "$KIBANA_DIR"
-# source "test/scripts/jenkins_xpack_page_load_metrics.sh"
-
 cd "$KIBANA_DIR"
 source "test/scripts/jenkins_xpack_saved_objects_field_metrics.sh"
-
-echo " -> running visual regression tests from x-pack directory"
-cd "$XPACK_DIR"
-yarn percy exec -t 10000 -- -- \
-  node scripts/functional_tests \
-    --debug --bail \
-    --kibana-install-dir "$installDir" \
-    --config test/visual_regression/config.ts;
diff --git a/vars/kibanaPipeline.groovy b/vars/kibanaPipeline.groovy
index e5b39584a519b..28eb94405abbb 100644
--- a/vars/kibanaPipeline.groovy
+++ b/vars/kibanaPipeline.groovy
@@ -1,4 +1,4 @@
-def withPostBuildReporting(Closure closure) {
+def withPostBuildReporting(Map params, Closure closure) {
   try {
     closure()
   } finally {
@@ -9,8 +9,10 @@ def withPostBuildReporting(Closure closure) {
       print ex
     }
 
-    catchErrors {
-      runErrorReporter([pwd()] + parallelWorkspaces)
+    if (params.runErrorReporter) {
+      catchErrors {
+        runErrorReporter([pwd()] + parallelWorkspaces)
+      }
     }
 
     catchErrors {
diff --git a/vars/workers.groovy b/vars/workers.groovy
index e582e996a78b5..b6ff5b27667dd 100644
--- a/vars/workers.groovy
+++ b/vars/workers.groovy
@@ -118,11 +118,11 @@ def base(Map params, Closure closure) {
 
 // Worker for ci processes. Extends the base worker and adds GCS artifact upload, error reporting, junit processing
 def ci(Map params, Closure closure) {
-  def config = [ramDisk: true, bootstrapped: true] + params
+  def config = [ramDisk: true, bootstrapped: true, runErrorReporter: true] + params
 
   return base(config) {
     kibanaPipeline.withGcsArtifactUpload(config.name) {
-      kibanaPipeline.withPostBuildReporting {
+      kibanaPipeline.withPostBuildReporting(config) {
         closure()
       }
     }
diff --git a/x-pack/dev-tools/jest/create_jest_config.js b/x-pack/dev-tools/jest/create_jest_config.js
index a693e008db6ea..e6f160ce8c654 100644
--- a/x-pack/dev-tools/jest/create_jest_config.js
+++ b/x-pack/dev-tools/jest/create_jest_config.js
@@ -18,7 +18,6 @@ export function createJestConfig({ kibanaDirectory, rootDir, xPackKibanaDirector
       '^src/core/(.*)': `${kibanaDirectory}/src/core/$1`,
       '^src/legacy/(.*)': `${kibanaDirectory}/src/legacy/$1`,
       '^src/plugins/(.*)': `${kibanaDirectory}/src/plugins/$1`,
-      '^plugins/([^/.]*)(.*)': `${kibanaDirectory}/src/legacy/core_plugins/$1/public$2`,
       '^legacy/plugins/xpack_main/(.*);': `${xPackKibanaDirectory}/legacy/plugins/xpack_main/public/$1`,
       '\\.(jpg|jpeg|png|gif|eot|otf|webp|svg|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga)$': fileMockPath,
       '\\.module.(css|scss)$': `${kibanaDirectory}/src/dev/jest/mocks/css_module_mock.js`,
diff --git a/x-pack/index.js b/x-pack/index.js
index 074b8e6859dc2..745b4bd72dde8 100644
--- a/x-pack/index.js
+++ b/x-pack/index.js
@@ -5,9 +5,8 @@
  */
 
 import { xpackMain } from './legacy/plugins/xpack_main';
-import { security } from './legacy/plugins/security';
 import { spaces } from './legacy/plugins/spaces';
 
 module.exports = function (kibana) {
-  return [xpackMain(kibana), spaces(kibana), security(kibana)];
+  return [xpackMain(kibana), spaces(kibana)];
 };
diff --git a/x-pack/legacy/plugins/security/index.ts b/x-pack/legacy/plugins/security/index.ts
deleted file mode 100644
index c3596d3745e57..0000000000000
--- a/x-pack/legacy/plugins/security/index.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { Root } from 'joi';
-import { resolve } from 'path';
-
-export const security = (kibana: Record<string, any>) =>
-  new kibana.Plugin({
-    id: 'security',
-    publicDir: resolve(__dirname, 'public'),
-    require: ['elasticsearch'],
-    configPrefix: 'xpack.security',
-    config: (Joi: Root) =>
-      Joi.object({ enabled: Joi.boolean().default(true) })
-        .unknown()
-        .default(),
-    init() {},
-  });
diff --git a/x-pack/legacy/plugins/spaces/index.ts b/x-pack/legacy/plugins/spaces/index.ts
index 725d022879e0d..aec06a4596203 100644
--- a/x-pack/legacy/plugins/spaces/index.ts
+++ b/x-pack/legacy/plugins/spaces/index.ts
@@ -16,7 +16,7 @@ export const spaces = (kibana: Record<string, any>) =>
     id: 'spaces',
     configPrefix: 'xpack.spaces',
     publicDir: resolve(__dirname, 'public'),
-    require: ['elasticsearch', 'xpack_main'],
+    require: ['xpack_main'],
     config(Joi: any) {
       return Joi.object({
         enabled: Joi.boolean().default(true),
diff --git a/x-pack/legacy/plugins/xpack_main/index.js b/x-pack/legacy/plugins/xpack_main/index.js
index 854fba6624719..a3bd66e744fda 100644
--- a/x-pack/legacy/plugins/xpack_main/index.js
+++ b/x-pack/legacy/plugins/xpack_main/index.js
@@ -5,16 +5,15 @@
  */
 
 import { resolve } from 'path';
-import { mirrorPluginStatus } from '../../server/lib/mirror_plugin_status';
 import { setupXPackMain } from './server/lib/setup_xpack_main';
-import { xpackInfoRoute, settingsRoute } from './server/routes/api/v1';
+import { xpackInfoRoute } from './server/routes/api/v1';
 
 export const xpackMain = (kibana) => {
   return new kibana.Plugin({
     id: 'xpack_main',
     configPrefix: 'xpack.xpack_main',
     publicDir: resolve(__dirname, 'public'),
-    require: ['elasticsearch'],
+    require: [],
 
     config(Joi) {
       return Joi.object({
@@ -23,13 +22,10 @@ export const xpackMain = (kibana) => {
     },
 
     init(server) {
-      mirrorPluginStatus(server.plugins.elasticsearch, this, 'yellow', 'red');
-
       setupXPackMain(server);
 
       // register routes
       xpackInfoRoute(server);
-      settingsRoute(server, this.kbnServer);
     },
   });
 };
diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/setup_xpack_main.js b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/setup_xpack_main.js
index c34e27642d2ce..f49f44bed97a7 100644
--- a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/setup_xpack_main.js
+++ b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/setup_xpack_main.js
@@ -13,33 +13,35 @@ describe('setupXPackMain()', () => {
   const sandbox = sinon.createSandbox();
 
   let mockServer;
+  let mockStatusObservable;
   let mockElasticsearchPlugin;
-  let mockXPackMainPlugin;
 
   beforeEach(() => {
     sandbox.useFakeTimers();
 
     mockElasticsearchPlugin = {
       getCluster: sinon.stub(),
-      status: sinon.stub({
-        on() {},
-      }),
     };
 
-    mockXPackMainPlugin = {
-      status: sinon.stub({
-        green() {},
-        red() {},
-      }),
-    };
+    mockStatusObservable = sinon.stub({ subscribe() {} });
 
     mockServer = sinon.stub({
       plugins: {
         elasticsearch: mockElasticsearchPlugin,
-        xpack_main: mockXPackMainPlugin,
       },
       newPlatform: {
-        setup: { plugins: { features: {}, licensing: { license$: new BehaviorSubject() } } },
+        setup: {
+          core: {
+            status: {
+              core$: {
+                pipe() {
+                  return mockStatusObservable;
+                },
+              },
+            },
+          },
+          plugins: { features: {}, licensing: { license$: new BehaviorSubject() } },
+        },
       },
       events: { on() {} },
       log() {},
@@ -61,55 +63,6 @@ describe('setupXPackMain()', () => {
     setupXPackMain(mockServer);
 
     sinon.assert.calledWithExactly(mockServer.expose, 'info', sinon.match.instanceOf(XPackInfo));
-    sinon.assert.calledWithExactly(mockElasticsearchPlugin.status.on, 'change', sinon.match.func);
-  });
-
-  describe('Elasticsearch plugin state changes cause XPackMain plugin state change.', () => {
-    let xPackInfo;
-    let onElasticsearchPluginStatusChange;
-    beforeEach(() => {
-      setupXPackMain(mockServer);
-
-      onElasticsearchPluginStatusChange = mockElasticsearchPlugin.status.on.withArgs('change')
-        .firstCall.args[1];
-      xPackInfo = mockServer.expose.firstCall.args[1];
-    });
-
-    it('if `XPackInfo` is available status will become `green`.', async () => {
-      sinon.stub(xPackInfo, 'isAvailable').returns(false);
-      // We need this to make sure the code waits for `refreshNow` to complete before it tries
-      // to access its properties.
-      sinon.stub(xPackInfo, 'refreshNow').callsFake(() => {
-        return new Promise((resolve) => {
-          xPackInfo.isAvailable.returns(true);
-          resolve();
-        });
-      });
-
-      await onElasticsearchPluginStatusChange();
-
-      sinon.assert.calledWithExactly(mockXPackMainPlugin.status.green, 'Ready');
-      sinon.assert.notCalled(mockXPackMainPlugin.status.red);
-    });
-
-    it('if `XPackInfo` is not available status will become `red`.', async () => {
-      sinon.stub(xPackInfo, 'isAvailable').returns(true);
-      sinon.stub(xPackInfo, 'unavailableReason').returns('');
-
-      // We need this to make sure the code waits for `refreshNow` to complete before it tries
-      // to access its properties.
-      sinon.stub(xPackInfo, 'refreshNow').callsFake(() => {
-        return new Promise((resolve) => {
-          xPackInfo.isAvailable.returns(false);
-          xPackInfo.unavailableReason.returns('Some weird error.');
-          resolve();
-        });
-      });
-
-      await onElasticsearchPluginStatusChange();
-
-      sinon.assert.calledWithExactly(mockXPackMainPlugin.status.red, 'Some weird error.');
-      sinon.assert.notCalled(mockXPackMainPlugin.status.green);
-    });
+    sinon.assert.calledWithExactly(mockStatusObservable.subscribe, sinon.match.func);
   });
 });
diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/setup_xpack_main.js b/x-pack/legacy/plugins/xpack_main/server/lib/setup_xpack_main.js
index 33b551bbe864f..fd4e3c86d0ca7 100644
--- a/x-pack/legacy/plugins/xpack_main/server/lib/setup_xpack_main.js
+++ b/x-pack/legacy/plugins/xpack_main/server/lib/setup_xpack_main.js
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { pairwise } from 'rxjs/operators';
 import { XPackInfo } from './xpack_info';
 
 /**
@@ -19,23 +20,14 @@ export function setupXPackMain(server) {
 
   server.expose('info', info);
 
-  const setPluginStatus = () => {
-    if (info.isAvailable()) {
-      server.plugins.xpack_main.status.green('Ready');
-    } else {
-      server.plugins.xpack_main.status.red(info.unavailableReason());
-    }
-  };
-
   // trigger an xpack info refresh whenever the elasticsearch plugin status changes
-  server.plugins.elasticsearch.status.on('change', async () => {
-    await info.refreshNow();
-    setPluginStatus();
-  });
-
-  // whenever the license info is updated, regardless of the elasticsearch plugin status
-  // changes, reflect the change in our plugin status. See https://github.com/elastic/kibana/issues/20017
-  info.onLicenseInfoChange(setPluginStatus);
+  server.newPlatform.setup.core.status.core$
+    .pipe(pairwise())
+    .subscribe(async ([coreLast, coreCurrent]) => {
+      if (coreLast.elasticsearch.level !== coreCurrent.elasticsearch.level) {
+        await info.refreshNow();
+      }
+    });
 
   return info;
 }
diff --git a/x-pack/legacy/plugins/xpack_main/server/routes/api/v1/index.js b/x-pack/legacy/plugins/xpack_main/server/routes/api/v1/index.js
index c0e59b4ea4ab2..80baf7bf1a64d 100644
--- a/x-pack/legacy/plugins/xpack_main/server/routes/api/v1/index.js
+++ b/x-pack/legacy/plugins/xpack_main/server/routes/api/v1/index.js
@@ -5,4 +5,3 @@
  */
 
 export { xpackInfoRoute } from './xpack_info';
-export { settingsRoute } from './settings';
diff --git a/x-pack/legacy/plugins/xpack_main/server/routes/api/v1/settings.js b/x-pack/legacy/plugins/xpack_main/server/routes/api/v1/settings.js
deleted file mode 100644
index 34fc4d97c1328..0000000000000
--- a/x-pack/legacy/plugins/xpack_main/server/routes/api/v1/settings.js
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { boomify } from 'boom';
-import { get } from 'lodash';
-import { KIBANA_SETTINGS_TYPE } from '../../../../../../../plugins/monitoring/common/constants';
-
-const getClusterUuid = async (callCluster) => {
-  const { cluster_uuid: uuid } = await callCluster('info', { filterPath: 'cluster_uuid' });
-  return uuid;
-};
-
-export function settingsRoute(server, kbnServer) {
-  server.route({
-    path: '/api/settings',
-    method: 'GET',
-    async handler(req) {
-      const { server } = req;
-      const { callWithRequest } = server.plugins.elasticsearch.getCluster('data');
-      const callCluster = (...args) => callWithRequest(req, ...args); // All queries from HTTP API must use authentication headers from the request
-
-      try {
-        const { usageCollection } = server.newPlatform.setup.plugins;
-        const settingsCollector = usageCollection.getCollectorByType(KIBANA_SETTINGS_TYPE);
-
-        let settings = await settingsCollector.fetch(callCluster);
-        if (!settings) {
-          settings = settingsCollector.getEmailValueStructure(null);
-        }
-        const uuid = await getClusterUuid(callCluster);
-
-        const snapshotRegex = /-snapshot/i;
-        const config = server.config();
-        const status = kbnServer.status.toJSON();
-        const kibana = {
-          uuid: config.get('server.uuid'),
-          name: config.get('server.name'),
-          index: config.get('kibana.index'),
-          host: config.get('server.host'),
-          port: config.get('server.port'),
-          locale: config.get('i18n.locale'),
-          transport_address: `${config.get('server.host')}:${config.get('server.port')}`,
-          version: kbnServer.version.replace(snapshotRegex, ''),
-          snapshot: snapshotRegex.test(kbnServer.version),
-          status: get(status, 'overall.state'),
-        };
-
-        return {
-          cluster_uuid: uuid,
-          settings: {
-            ...settings,
-            kibana,
-          },
-        };
-      } catch (err) {
-        req.log(['error'], err); // FIXME doesn't seem to log anything useful if ES times out
-        if (err.isBoom) {
-          return err;
-        } else {
-          return boomify(err, { statusCode: err.statusCode, message: err.message });
-        }
-      }
-    },
-  });
-}
diff --git a/x-pack/legacy/server/lib/__tests__/mirror_plugin_status.js b/x-pack/legacy/server/lib/__tests__/mirror_plugin_status.js
deleted file mode 100644
index c7cae0785c9eb..0000000000000
--- a/x-pack/legacy/server/lib/__tests__/mirror_plugin_status.js
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import EventEmitter from 'events';
-import expect from '@kbn/expect';
-import { mirrorPluginStatus } from '../mirror_plugin_status';
-
-describe('mirror_plugin_status', () => {
-  class MockPluginStatus extends EventEmitter {
-    constructor() {
-      super();
-      this.state = 'uninitialized';
-    }
-
-    _changeState(newState, newMessage) {
-      if (this.state === newState) {
-        return;
-      }
-      const prevState = this.state;
-      const prevMessage = this.message;
-
-      this.state = newState;
-      this.message = newMessage;
-
-      this.emit(newState, prevState, prevMessage, this.state, this.message);
-      this.emit('change', prevState, prevMessage, this.state, this.message);
-    }
-
-    red(message) {
-      this._changeState('red', message);
-    }
-    yellow(message) {
-      this._changeState('yellow', message);
-    }
-    green(message) {
-      this._changeState('green', message);
-    }
-    uninitialized(message) {
-      this._changeState('uninitialized', message);
-    }
-  }
-
-  class MockPlugin {
-    constructor() {
-      this.status = new MockPluginStatus();
-    }
-  }
-
-  let upstreamPlugin;
-  let downstreamPlugin;
-  let eventNotEmittedTimeout;
-
-  beforeEach(() => {
-    upstreamPlugin = new MockPlugin();
-    downstreamPlugin = new MockPlugin();
-    eventNotEmittedTimeout = setTimeout(() => {
-      throw new Error('Event should have been emitted');
-    }, 100);
-  });
-
-  it('should mirror all downstream plugin statuses to upstream plugin statuses', (done) => {
-    mirrorPluginStatus(upstreamPlugin, downstreamPlugin);
-    downstreamPlugin.status.on('change', () => {
-      clearTimeout(eventNotEmittedTimeout);
-      expect(downstreamPlugin.status.state).to.be('red');
-      expect(downstreamPlugin.status.message).to.be('test message');
-      done();
-    });
-    upstreamPlugin.status.red('test message');
-  });
-
-  describe('should only mirror specific downstream plugin statuses to corresponding upstream plugin statuses: ', () => {
-    beforeEach(() => {
-      mirrorPluginStatus(upstreamPlugin, downstreamPlugin, 'yellow', 'red');
-    });
-
-    it('yellow', (done) => {
-      downstreamPlugin.status.on('change', () => {
-        clearTimeout(eventNotEmittedTimeout);
-        expect(downstreamPlugin.status.state).to.be('yellow');
-        expect(downstreamPlugin.status.message).to.be('test yellow message');
-        done();
-      });
-      upstreamPlugin.status.yellow('test yellow message');
-    });
-
-    it('red', (done) => {
-      downstreamPlugin.status.on('change', () => {
-        clearTimeout(eventNotEmittedTimeout);
-        expect(downstreamPlugin.status.state).to.be('red');
-        expect(downstreamPlugin.status.message).to.be('test red message');
-        done();
-      });
-      upstreamPlugin.status.red('test red message');
-    });
-
-    it('not green', () => {
-      clearTimeout(eventNotEmittedTimeout); // because event should not be emitted in this test
-      downstreamPlugin.status.on('change', () => {
-        throw new Error('Event should NOT have been emitted');
-      });
-      upstreamPlugin.status.green('test green message');
-    });
-  });
-});
diff --git a/x-pack/legacy/server/lib/create_router/call_with_request_factory/index.d.ts b/x-pack/legacy/server/lib/create_router/call_with_request_factory/index.d.ts
index 4ec5bc13eea81..3537d1bf42079 100644
--- a/x-pack/legacy/server/lib/create_router/call_with_request_factory/index.d.ts
+++ b/x-pack/legacy/server/lib/create_router/call_with_request_factory/index.d.ts
@@ -5,9 +5,9 @@
  */
 
 import { Legacy } from 'kibana';
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { LegacyAPICaller } from '../../../../../../src/core/server';
 
-export type CallWithRequest = (...args: any[]) => CallCluster;
+export type CallWithRequest = (...args: any[]) => LegacyAPICaller;
 
 export declare function callWithRequestFactory(
   server: Legacy.Server,
diff --git a/x-pack/legacy/server/lib/mirror_plugin_status.js b/x-pack/legacy/server/lib/mirror_plugin_status.js
deleted file mode 100644
index 7b1ac215f5e4c..0000000000000
--- a/x-pack/legacy/server/lib/mirror_plugin_status.js
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export function mirrorPluginStatus(upstreamPlugin, downstreamPlugin, ...statesToMirror) {
-  upstreamPlugin.status.setMaxListeners(21); // We need more than the default, which is 10
-
-  function mirror(previousState, previousMsg, newState, newMsg) {
-    if (newState) {
-      downstreamPlugin.status[newState](newMsg);
-    }
-  }
-
-  if (statesToMirror.length === 0) {
-    statesToMirror.push('change');
-  }
-
-  statesToMirror.map((state) => upstreamPlugin.status.on(state, mirror));
-  mirror(null, null, upstreamPlugin.status.state, upstreamPlugin.status.message); // initial mirroring
-}
diff --git a/x-pack/legacy/server/lib/register_license_checker/register_license_checker.js b/x-pack/legacy/server/lib/register_license_checker/register_license_checker.js
index eabe375eefd02..57cbe30c25cb2 100644
--- a/x-pack/legacy/server/lib/register_license_checker/register_license_checker.js
+++ b/x-pack/legacy/server/lib/register_license_checker/register_license_checker.js
@@ -4,21 +4,31 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { mirrorPluginStatus } from '../mirror_plugin_status';
+import { pairwise } from 'rxjs/operators';
+
+import { ServiceStatusLevels } from '../../../../../src/core/server';
 import { checkLicense } from '../check_license';
 
 export function registerLicenseChecker(server, pluginId, pluginName, minimumLicenseRequired) {
   const xpackMainPlugin = server.plugins.xpack_main;
-  const thisPlugin = server.plugins[pluginId];
+  const subscription = server.newPlatform.setup.core.status.core$
+    .pipe(pairwise())
+    .subscribe(([coreLast, coreCurrent]) => {
+      if (
+        !subscription.closed &&
+        coreLast.elasticsearch.level !== ServiceStatusLevels.available &&
+        coreCurrent.elasticsearch.level === ServiceStatusLevels.available
+      ) {
+        // Unsubscribe as soon as ES becomes available so this function only runs once
+        subscription.unsubscribe();
 
-  mirrorPluginStatus(xpackMainPlugin, thisPlugin);
-  xpackMainPlugin.status.once('green', () => {
-    // Register a function that is called whenever the xpack info changes,
-    // to re-compute the license check results for this plugin
-    xpackMainPlugin.info
-      .feature(pluginId)
-      .registerLicenseCheckResultsGenerator((xpackLicenseInfo) => {
-        return checkLicense(pluginName, minimumLicenseRequired, xpackLicenseInfo);
-      });
-  });
+        // Register a function that is called whenever the xpack info changes,
+        // to re-compute the license check results for this plugin
+        xpackMainPlugin.info
+          .feature(pluginId)
+          .registerLicenseCheckResultsGenerator((xpackLicenseInfo) => {
+            return checkLicense(pluginName, minimumLicenseRequired, xpackLicenseInfo);
+          });
+      }
+    });
 }
diff --git a/x-pack/package.json b/x-pack/package.json
index 3e1e1173be2d7..de0bf0d922b42 100644
--- a/x-pack/package.json
+++ b/x-pack/package.json
@@ -39,7 +39,7 @@
     "@kbn/storybook": "1.0.0",
     "@kbn/test": "1.0.0",
     "@kbn/utility-types": "1.0.0",
-    "@mapbox/geojson-rewind": "^0.4.1",
+    "@mapbox/geojson-rewind": "^0.5.0",
     "@mapbox/mapbox-gl-draw": "^1.2.0",
     "@mapbox/mapbox-gl-rtl-text": "^0.2.3",
     "@scant/router": "^0.1.0",
@@ -101,7 +101,7 @@
     "@types/mocha": "^7.0.2",
     "@types/nock": "^10.0.3",
     "@types/node": ">=10.17.17 <10.20.0",
-    "@types/node-fetch": "^2.5.0",
+    "@types/node-fetch": "^2.5.7",
     "@types/nodemailer": "^6.2.1",
     "@types/object-hash": "^1.3.0",
     "@types/papaparse": "^5.0.3",
@@ -209,7 +209,6 @@
     "mochawesome-merge": "^4.1.0",
     "mustache": "^2.3.0",
     "mutation-observer": "^1.0.3",
-    "node-fetch": "^2.6.0",
     "null-loader": "^3.0.0",
     "oboe": "^2.1.4",
     "pixelmatch": "^5.1.0",
@@ -275,7 +274,7 @@
     "@babel/runtime": "^7.11.2",
     "@elastic/datemath": "5.0.3",
     "@elastic/ems-client": "7.9.3",
-    "@elastic/eui": "28.2.0",
+    "@elastic/eui": "28.4.0",
     "@elastic/filesaver": "1.1.2",
     "@elastic/node-crypto": "1.2.1",
     "@elastic/numeral": "^2.5.0",
@@ -345,7 +344,7 @@
     "moment-timezone": "^0.5.27",
     "ngreact": "^0.5.1",
     "nock": "12.0.3",
-    "node-fetch": "^2.6.0",
+    "node-fetch": "^2.6.1",
     "nodemailer": "^4.7.0",
     "object-hash": "^1.3.1",
     "object-path-immutable": "^3.1.1",
diff --git a/x-pack/plugins/actions/server/actions_client.test.ts b/x-pack/plugins/actions/server/actions_client.test.ts
index 573fb0e1be580..adef12454f2d5 100644
--- a/x-pack/plugins/actions/server/actions_client.test.ts
+++ b/x-pack/plugins/actions/server/actions_client.test.ts
@@ -893,7 +893,7 @@ describe('update()', () => {
         },
         references: [],
       });
-      unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+      unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
         id: 'my-action',
         type: 'action',
         attributes: {
@@ -946,7 +946,7 @@ describe('update()', () => {
       },
       references: [],
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: 'my-action',
       type: 'action',
       attributes: {
@@ -972,17 +972,21 @@ describe('update()', () => {
       name: 'my name',
       config: {},
     });
-    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
         "action",
-        "my-action",
         Object {
           "actionTypeId": "my-action-type",
           "config": Object {},
           "name": "my name",
           "secrets": Object {},
         },
+        Object {
+          "id": "my-action",
+          "overwrite": true,
+          "references": Array [],
+        },
       ]
     `);
     expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledTimes(1);
@@ -1043,7 +1047,7 @@ describe('update()', () => {
       },
       references: [],
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: 'my-action',
       type: 'action',
       attributes: {
@@ -1081,11 +1085,10 @@ describe('update()', () => {
         c: true,
       },
     });
-    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
         "action",
-        "my-action",
         Object {
           "actionTypeId": "my-action-type",
           "config": Object {
@@ -1096,6 +1099,11 @@ describe('update()', () => {
           "name": "my name",
           "secrets": Object {},
         },
+        Object {
+          "id": "my-action",
+          "overwrite": true,
+          "references": Array [],
+        },
       ]
     `);
   });
@@ -1118,7 +1126,7 @@ describe('update()', () => {
       },
       references: [],
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: 'my-action',
       type: 'action',
       attributes: {
diff --git a/x-pack/plugins/actions/server/actions_client.ts b/x-pack/plugins/actions/server/actions_client.ts
index 06c9555f3a18d..4079a6ddeeb8a 100644
--- a/x-pack/plugins/actions/server/actions_client.ts
+++ b/x-pack/plugins/actions/server/actions_client.ts
@@ -13,6 +13,7 @@ import {
 } from 'src/core/server';
 
 import { i18n } from '@kbn/i18n';
+import { omitBy, isUndefined } from 'lodash';
 import { ActionTypeRegistry } from './action_type_registry';
 import { validateConfig, validateSecrets, ActionExecutorContract } from './lib';
 import {
@@ -30,7 +31,10 @@ import {
 } from './create_execute_function';
 import { ActionsAuthorization } from './authorization/actions_authorization';
 import { ActionType } from '../common';
-import { shouldLegacyRbacApplyBySource } from './authorization/should_legacy_rbac_apply_by_source';
+import {
+  getAuthorizationModeBySource,
+  AuthorizationMode,
+} from './authorization/get_authorization_mode_by_source';
 
 // We are assuming there won't be many actions. This is why we will load
 // all the actions in advance and assume the total count to not go over 10000.
@@ -151,8 +155,10 @@ export class ActionsClient {
         'update'
       );
     }
-    const existingObject = await this.unsecuredSavedObjectsClient.get<RawAction>('action', id);
-    const { actionTypeId } = existingObject.attributes;
+    const { attributes, references, version } = await this.unsecuredSavedObjectsClient.get<
+      RawAction
+    >('action', id);
+    const { actionTypeId } = attributes;
     const { name, config, secrets } = action;
     const actionType = this.actionTypeRegistry.get(actionTypeId);
     const validatedActionTypeConfig = validateConfig(actionType, config);
@@ -160,12 +166,25 @@ export class ActionsClient {
 
     this.actionTypeRegistry.ensureActionTypeEnabled(actionTypeId);
 
-    const result = await this.unsecuredSavedObjectsClient.update<RawAction>('action', id, {
-      actionTypeId,
-      name,
-      config: validatedActionTypeConfig as SavedObjectAttributes,
-      secrets: validatedActionTypeSecrets as SavedObjectAttributes,
-    });
+    const result = await this.unsecuredSavedObjectsClient.create<RawAction>(
+      'action',
+      {
+        ...attributes,
+        actionTypeId,
+        name,
+        config: validatedActionTypeConfig as SavedObjectAttributes,
+        secrets: validatedActionTypeSecrets as SavedObjectAttributes,
+      },
+      omitBy(
+        {
+          id,
+          overwrite: true,
+          references,
+          version,
+        },
+        isUndefined
+      )
+    );
 
     return {
       id,
@@ -301,7 +320,10 @@ export class ActionsClient {
     params,
     source,
   }: Omit<ExecuteOptions, 'request'>): Promise<ActionTypeExecutorResult<unknown>> {
-    if (!(await shouldLegacyRbacApplyBySource(this.unsecuredSavedObjectsClient, source))) {
+    if (
+      (await getAuthorizationModeBySource(this.unsecuredSavedObjectsClient, source)) ===
+      AuthorizationMode.RBAC
+    ) {
       await this.authorization.ensureAuthorized('execute');
     }
     return this.actionExecutor.execute({ actionId, params, source, request: this.request });
@@ -309,7 +331,10 @@ export class ActionsClient {
 
   public async enqueueExecution(options: EnqueueExecutionOptions): Promise<void> {
     const { source } = options;
-    if (!(await shouldLegacyRbacApplyBySource(this.unsecuredSavedObjectsClient, source))) {
+    if (
+      (await getAuthorizationModeBySource(this.unsecuredSavedObjectsClient, source)) ===
+      AuthorizationMode.RBAC
+    ) {
       await this.authorization.ensureAuthorized('execute');
     }
     return this.executionEnqueuer(this.unsecuredSavedObjectsClient, options);
diff --git a/x-pack/plugins/actions/server/authorization/actions_authorization.test.ts b/x-pack/plugins/actions/server/authorization/actions_authorization.test.ts
index 08c4472f8007b..a19a662f8323c 100644
--- a/x-pack/plugins/actions/server/authorization/actions_authorization.test.ts
+++ b/x-pack/plugins/actions/server/authorization/actions_authorization.test.ts
@@ -10,6 +10,7 @@ import { actionsAuthorizationAuditLoggerMock } from './audit_logger.mock';
 import { ActionsAuthorizationAuditLogger, AuthorizationResult } from './audit_logger';
 import { ACTION_SAVED_OBJECT_TYPE, ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE } from '../saved_objects';
 import { AuthenticatedUser } from '../../../security/server';
+import { AuthorizationMode } from './get_authorization_mode_by_source';
 
 const request = {} as KibanaRequest;
 
@@ -195,7 +196,7 @@ describe('ensureAuthorized', () => {
     `);
   });
 
-  test('exempts users from requiring privileges to execute actions when shouldUseLegacyRbac is true', async () => {
+  test('exempts users from requiring privileges to execute actions when authorizationMode is Legacy', async () => {
     const { authorization, authentication } = mockSecurity();
     const checkPrivileges: jest.MockedFunction<ReturnType<
       typeof authorization.checkPrivilegesDynamicallyWithRequest
@@ -206,7 +207,7 @@ describe('ensureAuthorized', () => {
       authorization,
       authentication,
       auditLogger,
-      shouldUseLegacyRbac: true,
+      authorizationMode: AuthorizationMode.Legacy,
     });
 
     authentication.getCurrentUser.mockReturnValueOnce(({
diff --git a/x-pack/plugins/actions/server/authorization/actions_authorization.ts b/x-pack/plugins/actions/server/authorization/actions_authorization.ts
index bd6e355c2cf9d..cad58bed50981 100644
--- a/x-pack/plugins/actions/server/authorization/actions_authorization.ts
+++ b/x-pack/plugins/actions/server/authorization/actions_authorization.ts
@@ -9,6 +9,7 @@ import { KibanaRequest } from 'src/core/server';
 import { SecurityPluginSetup } from '../../../security/server';
 import { ActionsAuthorizationAuditLogger } from './audit_logger';
 import { ACTION_SAVED_OBJECT_TYPE, ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE } from '../saved_objects';
+import { AuthorizationMode } from './get_authorization_mode_by_source';
 
 export interface ConstructorOptions {
   request: KibanaRequest;
@@ -22,7 +23,7 @@ export interface ConstructorOptions {
   // actions to continue to execute - which requires that we exempt auth on
   // `get` for Connectors and `execute` for Action execution when used by
   // these legacy alerts
-  shouldUseLegacyRbac?: boolean;
+  authorizationMode?: AuthorizationMode;
 }
 
 const operationAlias: Record<
@@ -43,20 +44,19 @@ export class ActionsAuthorization {
   private readonly authorization?: SecurityPluginSetup['authz'];
   private readonly authentication?: SecurityPluginSetup['authc'];
   private readonly auditLogger: ActionsAuthorizationAuditLogger;
-  private readonly shouldUseLegacyRbac: boolean;
-
+  private readonly authorizationMode: AuthorizationMode;
   constructor({
     request,
     authorization,
     authentication,
     auditLogger,
-    shouldUseLegacyRbac = false,
+    authorizationMode = AuthorizationMode.RBAC,
   }: ConstructorOptions) {
     this.request = request;
     this.authorization = authorization;
     this.authentication = authentication;
     this.auditLogger = auditLogger;
-    this.shouldUseLegacyRbac = shouldUseLegacyRbac;
+    this.authorizationMode = authorizationMode;
   }
 
   public async ensureAuthorized(operation: string, actionTypeId?: string) {
@@ -87,6 +87,9 @@ export class ActionsAuthorization {
   }
 
   private isOperationExemptDueToLegacyRbac(operation: string) {
-    return this.shouldUseLegacyRbac && LEGACY_RBAC_EXEMPT_OPERATIONS.has(operation);
+    return (
+      this.authorizationMode === AuthorizationMode.Legacy &&
+      LEGACY_RBAC_EXEMPT_OPERATIONS.has(operation)
+    );
   }
 }
diff --git a/x-pack/plugins/actions/server/authorization/should_legacy_rbac_apply_by_source.test.ts b/x-pack/plugins/actions/server/authorization/get_authorization_mode_by_source.test.ts
similarity index 67%
rename from x-pack/plugins/actions/server/authorization/should_legacy_rbac_apply_by_source.test.ts
rename to x-pack/plugins/actions/server/authorization/get_authorization_mode_by_source.test.ts
index 03062994adeb6..4980c476e60ea 100644
--- a/x-pack/plugins/actions/server/authorization/should_legacy_rbac_apply_by_source.test.ts
+++ b/x-pack/plugins/actions/server/authorization/get_authorization_mode_by_source.test.ts
@@ -3,88 +3,93 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { shouldLegacyRbacApplyBySource } from './should_legacy_rbac_apply_by_source';
+import {
+  getAuthorizationModeBySource,
+  AuthorizationMode,
+} from './get_authorization_mode_by_source';
 import { savedObjectsClientMock } from '../../../../../src/core/server/mocks';
 import uuid from 'uuid';
 import { asSavedObjectExecutionSource } from '../lib';
 
 const unsecuredSavedObjectsClient = savedObjectsClientMock.create();
 
-describe(`#shouldLegacyRbacApplyBySource`, () => {
-  test('should return false if no source is provided', async () => {
-    expect(await shouldLegacyRbacApplyBySource(unsecuredSavedObjectsClient)).toEqual(false);
+describe(`#getAuthorizationModeBySource`, () => {
+  test('should return RBAC if no source is provided', async () => {
+    expect(await getAuthorizationModeBySource(unsecuredSavedObjectsClient)).toEqual(
+      AuthorizationMode.RBAC
+    );
   });
 
-  test('should return false if source is not an alert', async () => {
+  test('should return RBAC if source is not an alert', async () => {
     expect(
-      await shouldLegacyRbacApplyBySource(
+      await getAuthorizationModeBySource(
         unsecuredSavedObjectsClient,
         asSavedObjectExecutionSource({
           type: 'action',
           id: uuid.v4(),
         })
       )
-    ).toEqual(false);
+    ).toEqual(AuthorizationMode.RBAC);
   });
 
-  test('should return false if source alert is not marked as legacy', async () => {
+  test('should return RBAC if source alert is not marked as legacy', async () => {
     const id = uuid.v4();
     unsecuredSavedObjectsClient.get.mockResolvedValue(mockAlert({ id }));
     expect(
-      await shouldLegacyRbacApplyBySource(
+      await getAuthorizationModeBySource(
         unsecuredSavedObjectsClient,
         asSavedObjectExecutionSource({
           type: 'alert',
           id,
         })
       )
-    ).toEqual(false);
+    ).toEqual(AuthorizationMode.RBAC);
   });
 
-  test('should return true if source alert is marked as legacy', async () => {
+  test('should return Legacy if source alert is marked as legacy', async () => {
     const id = uuid.v4();
     unsecuredSavedObjectsClient.get.mockResolvedValue(
       mockAlert({ id, attributes: { meta: { versionApiKeyLastmodified: 'pre-7.10.0' } } })
     );
     expect(
-      await shouldLegacyRbacApplyBySource(
+      await getAuthorizationModeBySource(
         unsecuredSavedObjectsClient,
         asSavedObjectExecutionSource({
           type: 'alert',
           id,
         })
       )
-    ).toEqual(true);
+    ).toEqual(AuthorizationMode.Legacy);
   });
 
-  test('should return false if source alert is marked as modern', async () => {
+  test('should return RBAC if source alert is marked as modern', async () => {
     const id = uuid.v4();
     unsecuredSavedObjectsClient.get.mockResolvedValue(
       mockAlert({ id, attributes: { meta: { versionApiKeyLastmodified: '7.10.0' } } })
     );
     expect(
-      await shouldLegacyRbacApplyBySource(
+      await getAuthorizationModeBySource(
         unsecuredSavedObjectsClient,
         asSavedObjectExecutionSource({
           type: 'alert',
           id,
         })
       )
-    ).toEqual(false);
+    ).toEqual(AuthorizationMode.RBAC);
   });
 
-  test('should return false if source alert is marked with a last modified version', async () => {
+  test('should return RBAC if source alert doesnt have a last modified version', async () => {
     const id = uuid.v4();
     unsecuredSavedObjectsClient.get.mockResolvedValue(mockAlert({ id, attributes: { meta: {} } }));
     expect(
-      await shouldLegacyRbacApplyBySource(
+      await getAuthorizationModeBySource(
         unsecuredSavedObjectsClient,
         asSavedObjectExecutionSource({
           type: 'alert',
           id,
         })
       )
-    ).toEqual(false);
+    ).toEqual(AuthorizationMode.RBAC);
   });
 });
 
diff --git a/x-pack/plugins/actions/server/authorization/should_legacy_rbac_apply_by_source.ts b/x-pack/plugins/actions/server/authorization/get_authorization_mode_by_source.ts
similarity index 55%
rename from x-pack/plugins/actions/server/authorization/should_legacy_rbac_apply_by_source.ts
rename to x-pack/plugins/actions/server/authorization/get_authorization_mode_by_source.ts
index 06d5776003ede..85d646c75defa 100644
--- a/x-pack/plugins/actions/server/authorization/should_legacy_rbac_apply_by_source.ts
+++ b/x-pack/plugins/actions/server/authorization/get_authorization_mode_by_source.ts
@@ -10,18 +10,24 @@ import { ALERT_SAVED_OBJECT_TYPE } from '../saved_objects';
 
 const LEGACY_VERSION = 'pre-7.10.0';
 
-export async function shouldLegacyRbacApplyBySource(
+export enum AuthorizationMode {
+  Legacy,
+  RBAC,
+}
+
+export async function getAuthorizationModeBySource(
   unsecuredSavedObjectsClient: SavedObjectsClientContract,
   executionSource?: ActionExecutionSource<unknown>
-): Promise<boolean> {
+): Promise<AuthorizationMode> {
   return isSavedObjectExecutionSource(executionSource) &&
-    executionSource?.source?.type === ALERT_SAVED_OBJECT_TYPE
-    ? (
-        await unsecuredSavedObjectsClient.get<{
-          meta?: {
-            versionApiKeyLastmodified?: string;
-          };
-        }>(ALERT_SAVED_OBJECT_TYPE, executionSource.source.id)
-      ).attributes.meta?.versionApiKeyLastmodified === LEGACY_VERSION
-    : false;
+    executionSource?.source?.type === ALERT_SAVED_OBJECT_TYPE &&
+    (
+      await unsecuredSavedObjectsClient.get<{
+        meta?: {
+          versionApiKeyLastmodified?: string;
+        };
+      }>(ALERT_SAVED_OBJECT_TYPE, executionSource.source.id)
+    ).attributes.meta?.versionApiKeyLastmodified === LEGACY_VERSION
+    ? AuthorizationMode.Legacy
+    : AuthorizationMode.RBAC;
 }
diff --git a/x-pack/plugins/actions/server/lib/action_executor.ts b/x-pack/plugins/actions/server/lib/action_executor.ts
index a607dc0de0bda..73434d5c1eaa2 100644
--- a/x-pack/plugins/actions/server/lib/action_executor.ts
+++ b/x-pack/plugins/actions/server/lib/action_executor.ts
@@ -27,7 +27,7 @@ export interface ActionExecutorContext {
   getServices: GetServicesFunction;
   getActionsClientWithRequest: (
     request: KibanaRequest,
-    executionSource?: ActionExecutionSource<unknown>
+    authorizationContext?: ActionExecutionSource<unknown>
   ) => Promise<PublicMethodsOf<ActionsClient>>;
   encryptedSavedObjectsClient: EncryptedSavedObjectsClient;
   actionTypeRegistry: ActionTypeRegistryContract;
diff --git a/x-pack/plugins/actions/server/plugin.ts b/x-pack/plugins/actions/server/plugin.ts
index 97cefafad4385..dca1114f0ae44 100644
--- a/x-pack/plugins/actions/server/plugin.ts
+++ b/x-pack/plugins/actions/server/plugin.ts
@@ -71,7 +71,10 @@ import { ACTIONS_FEATURE } from './feature';
 import { ActionsAuthorization } from './authorization/actions_authorization';
 import { ActionsAuthorizationAuditLogger } from './authorization/audit_logger';
 import { ActionExecutionSource } from './lib/action_execution_source';
-import { shouldLegacyRbacApplyBySource } from './authorization/should_legacy_rbac_apply_by_source';
+import {
+  getAuthorizationModeBySource,
+  AuthorizationMode,
+} from './authorization/get_authorization_mode_by_source';
 
 const EVENT_LOG_PROVIDER = 'actions';
 export const EVENT_LOG_ACTIONS = {
@@ -281,7 +284,7 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
 
     const getActionsClientWithRequest = async (
       request: KibanaRequest,
-      source?: ActionExecutionSource<unknown>
+      authorizationContext?: ActionExecutionSource<unknown>
     ) => {
       if (isESOUsingEphemeralEncryptionKey === true) {
         throw new Error(
@@ -303,7 +306,7 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
         request,
         authorization: instantiateAuthorization(
           request,
-          await shouldLegacyRbacApplyBySource(unsecuredSavedObjectsClient, source)
+          await getAuthorizationModeBySource(unsecuredSavedObjectsClient, authorizationContext)
         ),
         actionExecutor: actionExecutor!,
         executionEnqueuer: createExecutionEnqueuerFunction({
@@ -316,7 +319,8 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
     };
 
     // Ensure the public API cannot be used to circumvent authorization
-    // using our legacy exemption mechanism
+    // using our legacy exemption mechanism by passing in a legacy SO
+    // as authorizationContext which would then set a Legacy AuthorizationMode
     const secureGetActionsClientWithRequest = (request: KibanaRequest) =>
       getActionsClientWithRequest(request);
 
@@ -389,11 +393,11 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
 
   private instantiateAuthorization = (
     request: KibanaRequest,
-    shouldUseLegacyRbac: boolean = false
+    authorizationMode?: AuthorizationMode
   ) => {
     return new ActionsAuthorization({
       request,
-      shouldUseLegacyRbac,
+      authorizationMode,
       authorization: this.security?.authz,
       authentication: this.security?.authc,
       auditLogger: new ActionsAuthorizationAuditLogger(
diff --git a/x-pack/plugins/alerts/server/alerts_client.test.ts b/x-pack/plugins/alerts/server/alerts_client.test.ts
index 4b5af942024c0..a6cffb0284815 100644
--- a/x-pack/plugins/alerts/server/alerts_client.test.ts
+++ b/x-pack/plugins/alerts/server/alerts_client.test.ts
@@ -220,7 +220,7 @@ describe('create()', () => {
         params: {},
         ownerId: null,
       });
-      unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+      unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
         id: '1',
         type: 'alert',
         attributes: {
@@ -270,27 +270,33 @@ describe('create()', () => {
 
   test('creates an alert', async () => {
     const data = getMockData();
+    const createdAttributes = {
+      ...data,
+      alertTypeId: '123',
+      schedule: { interval: '10s' },
+      params: {
+        bar: true,
+      },
+      createdAt: '2019-02-12T21:01:22.479Z',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      muteAll: false,
+      mutedInstanceIds: [],
+      actions: [
+        {
+          group: 'default',
+          actionRef: 'action_0',
+          actionTypeId: 'test',
+          params: {
+            foo: true,
+          },
+        },
+      ],
+    };
     unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
-      attributes: {
-        alertTypeId: '123',
-        schedule: { interval: '10s' },
-        params: {
-          bar: true,
-        },
-        createdAt: '2019-02-12T21:01:22.479Z',
-        actions: [
-          {
-            group: 'default',
-            actionRef: 'action_0',
-            actionTypeId: 'test',
-            params: {
-              foo: true,
-            },
-          },
-        ],
-      },
+      attributes: createdAttributes,
       references: [
         {
           name: 'action_0',
@@ -312,11 +318,11 @@ describe('create()', () => {
       params: {},
       ownerId: null,
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
-        actions: [],
+        ...createdAttributes,
         scheduledTaskId: 'task-123',
       },
       references: [
@@ -342,8 +348,14 @@ describe('create()', () => {
           },
         ],
         "alertTypeId": "123",
+        "consumer": "bar",
         "createdAt": 2019-02-12T21:01:22.479Z,
+        "createdBy": "elastic",
+        "enabled": true,
         "id": "1",
+        "muteAll": false,
+        "mutedInstanceIds": Array [],
+        "name": "abc",
         "params": Object {
           "bar": true,
         },
@@ -351,7 +363,12 @@ describe('create()', () => {
           "interval": "10s",
         },
         "scheduledTaskId": "task-123",
+        "tags": Array [
+          "foo",
+        ],
+        "throttle": null,
         "updatedAt": 2019-02-12T21:01:22.479Z,
+        "updatedBy": "elastic",
       }
     `);
     expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
@@ -531,7 +548,7 @@ describe('create()', () => {
       params: {},
       ownerId: null,
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -965,7 +982,7 @@ describe('create()', () => {
       params: {},
       ownerId: null,
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -1081,7 +1098,7 @@ describe('create()', () => {
       params: {},
       ownerId: null,
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -1175,6 +1192,16 @@ describe('enable()', () => {
     alertsClientParams.createAPIKey.mockResolvedValue({
       apiKeysEnabled: false,
     });
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
+      ...existingAlert,
+      attributes: {
+        ...existingAlert.attributes,
+        enabled: true,
+        apiKey: null,
+        apiKeyOwner: null,
+        updatedBy: 'elastic',
+      },
+    });
     taskManager.schedule.mockResolvedValue({
       id: 'task-123',
       scheduledAt: new Date(),
@@ -1233,6 +1260,17 @@ describe('enable()', () => {
   });
 
   test('enables an alert', async () => {
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
+      ...existingAlert,
+      attributes: {
+        ...existingAlert.attributes,
+        enabled: true,
+        apiKey: null,
+        apiKeyOwner: null,
+        updatedBy: 'elastic',
+      },
+    });
+
     await alertsClient.enable({ id: '1' });
     expect(unsecuredSavedObjectsClient.get).not.toHaveBeenCalled();
     expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
@@ -1317,7 +1355,7 @@ describe('enable()', () => {
     await alertsClient.enable({ id: '1' });
     expect(alertsClientParams.getUserName).not.toHaveBeenCalled();
     expect(alertsClientParams.createAPIKey).not.toHaveBeenCalled();
-    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.create).not.toHaveBeenCalled();
     expect(taskManager.schedule).not.toHaveBeenCalled();
   });
 
@@ -1384,6 +1422,7 @@ describe('enable()', () => {
   });
 
   test('throws error when failing to update the first time', async () => {
+    unsecuredSavedObjectsClient.update.mockReset();
     unsecuredSavedObjectsClient.update.mockRejectedValueOnce(new Error('Fail to update'));
 
     await expect(alertsClient.enable({ id: '1' })).rejects.toThrowErrorMatchingInlineSnapshot(
@@ -1396,6 +1435,7 @@ describe('enable()', () => {
   });
 
   test('throws error when failing to update the second time', async () => {
+    unsecuredSavedObjectsClient.update.mockReset();
     unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       ...existingAlert,
       attributes: {
@@ -1460,6 +1500,8 @@ describe('disable()', () => {
       ...existingAlert.attributes,
       apiKey: Buffer.from('123:abc').toString('base64'),
     },
+    version: '123',
+    references: [],
   };
 
   beforeEach(() => {
@@ -1501,13 +1543,13 @@ describe('disable()', () => {
         consumer: 'myApp',
         schedule: { interval: '10s' },
         alertTypeId: 'myType',
-        apiKey: null,
-        apiKeyOwner: null,
         enabled: false,
         meta: {
           versionApiKeyLastmodified: kibanaVersion,
         },
         scheduledTaskId: null,
+        apiKey: null,
+        apiKeyOwner: null,
         updatedBy: 'elastic',
         actions: [
           {
@@ -1544,13 +1586,13 @@ describe('disable()', () => {
         consumer: 'myApp',
         schedule: { interval: '10s' },
         alertTypeId: 'myType',
-        apiKey: null,
-        apiKeyOwner: null,
         enabled: false,
         meta: {
           versionApiKeyLastmodified: kibanaVersion,
         },
         scheduledTaskId: null,
+        apiKey: null,
+        apiKeyOwner: null,
         updatedBy: 'elastic',
         actions: [
           {
@@ -1739,6 +1781,7 @@ describe('unmuteAll()', () => {
         muteAll: true,
       },
       references: [],
+      version: '123',
     });
 
     await alertsClient.unmuteAll({ id: '1' });
@@ -1829,7 +1872,9 @@ describe('muteInstance()', () => {
         mutedInstanceIds: ['2'],
         updatedBy: 'elastic',
       },
-      { version: '123' }
+      {
+        version: '123',
+      }
     );
   });
 
@@ -1850,7 +1895,7 @@ describe('muteInstance()', () => {
     });
 
     await alertsClient.muteInstance({ alertId: '1', alertInstanceId: '2' });
-    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.create).not.toHaveBeenCalled();
   });
 
   test('skips muting when alert is muted', async () => {
@@ -1871,7 +1916,7 @@ describe('muteInstance()', () => {
     });
 
     await alertsClient.muteInstance({ alertId: '1', alertInstanceId: '2' });
-    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.create).not.toHaveBeenCalled();
   });
 
   describe('authorization', () => {
@@ -1983,7 +2028,7 @@ describe('unmuteInstance()', () => {
     });
 
     await alertsClient.unmuteInstance({ alertId: '1', alertInstanceId: '2' });
-    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.create).not.toHaveBeenCalled();
   });
 
   test('skips unmuting when alert is muted', async () => {
@@ -2004,7 +2049,7 @@ describe('unmuteInstance()', () => {
     });
 
     await alertsClient.unmuteInstance({ alertId: '1', alertInstanceId: '2' });
-    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.create).not.toHaveBeenCalled();
   });
 
   describe('authorization', () => {
@@ -3052,7 +3097,7 @@ describe('update()', () => {
   });
 
   test('updates given parameters', async () => {
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -3189,11 +3234,10 @@ describe('update()', () => {
       namespace: 'default',
     });
     expect(unsecuredSavedObjectsClient.get).not.toHaveBeenCalled();
-    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toHaveLength(4);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][1]).toEqual('1');
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0]).toHaveLength(3);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][0]).toEqual('alert');
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][1]).toMatchInlineSnapshot(`
       Object {
         "actions": Array [
           Object {
@@ -3244,8 +3288,10 @@ describe('update()', () => {
         "updatedBy": "elastic",
       }
     `);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][3]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][2]).toMatchInlineSnapshot(`
       Object {
+        "id": "1",
+        "overwrite": true,
         "references": Array [
           Object {
             "id": "1",
@@ -3286,7 +3332,7 @@ describe('update()', () => {
       apiKeysEnabled: true,
       result: { id: '123', name: '123', api_key: 'abc' },
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -3365,11 +3411,10 @@ describe('update()', () => {
         "updatedAt": 2019-02-12T21:01:22.479Z,
       }
     `);
-    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toHaveLength(4);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][1]).toEqual('1');
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0]).toHaveLength(3);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][0]).toEqual('alert');
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][1]).toMatchInlineSnapshot(`
       Object {
         "actions": Array [
           Object {
@@ -3404,18 +3449,20 @@ describe('update()', () => {
         "updatedBy": "elastic",
       }
     `);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][3]).toMatchInlineSnapshot(`
-                                                Object {
-                                                  "references": Array [
-                                                    Object {
-                                                      "id": "1",
-                                                      "name": "action_0",
-                                                      "type": "action",
-                                                    },
-                                                  ],
-                                                  "version": "123",
-                                                }
-                                `);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][2]).toMatchInlineSnapshot(`
+      Object {
+        "id": "1",
+        "overwrite": true,
+        "references": Array [
+          Object {
+            "id": "1",
+            "name": "action_0",
+            "type": "action",
+          },
+        ],
+        "version": "123",
+      }
+    `);
   });
 
   it(`doesn't call the createAPIKey function when alert is disabled`, async () => {
@@ -3439,7 +3486,7 @@ describe('update()', () => {
         },
       ],
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -3519,11 +3566,10 @@ describe('update()', () => {
         "updatedAt": 2019-02-12T21:01:22.479Z,
       }
     `);
-    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toHaveLength(4);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][1]).toEqual('1');
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0]).toHaveLength(3);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][0]).toEqual('alert');
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][1]).toMatchInlineSnapshot(`
       Object {
         "actions": Array [
           Object {
@@ -3558,18 +3604,20 @@ describe('update()', () => {
         "updatedBy": "elastic",
       }
     `);
-    expect(unsecuredSavedObjectsClient.update.mock.calls[0][3]).toMatchInlineSnapshot(`
-                                                Object {
-                                                  "references": Array [
-                                                    Object {
-                                                      "id": "1",
-                                                      "name": "action_0",
-                                                      "type": "action",
-                                                    },
-                                                  ],
-                                                  "version": "123",
-                                                }
-                                `);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][2]).toMatchInlineSnapshot(`
+      Object {
+        "id": "1",
+        "overwrite": true,
+        "references": Array [
+          Object {
+            "id": "1",
+            "name": "action_0",
+            "type": "action",
+          },
+        ],
+        "version": "123",
+      }
+    `);
   });
 
   it('should validate params', async () => {
@@ -3627,7 +3675,7 @@ describe('update()', () => {
         },
       ],
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -3686,7 +3734,7 @@ describe('update()', () => {
         },
       ],
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -3765,7 +3813,7 @@ describe('update()', () => {
         },
       ],
     });
-    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -3919,7 +3967,7 @@ describe('update()', () => {
         params: {},
         ownerId: null,
       });
-      unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+      unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
         id: alertId,
         type: 'alert',
         attributes: {
@@ -4091,7 +4139,7 @@ describe('update()', () => {
 
   describe('authorization', () => {
     beforeEach(() => {
-      unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+      unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
         id: '1',
         type: 'alert',
         attributes: {
diff --git a/x-pack/plugins/alerts/server/alerts_client.ts b/x-pack/plugins/alerts/server/alerts_client.ts
index 0a08ca848c73d..671b1d6411d7f 100644
--- a/x-pack/plugins/alerts/server/alerts_client.ts
+++ b/x-pack/plugins/alerts/server/alerts_client.ts
@@ -251,7 +251,7 @@ export class AlertsClient {
         }
         throw e;
       }
-      await this.unsecuredSavedObjectsClient.update('alert', createdAlert.id, {
+      await this.unsecuredSavedObjectsClient.update<RawAlert>('alert', createdAlert.id, {
         scheduledTaskId: scheduledTask.id,
       });
       createdAlert.attributes.scheduledTaskId = scheduledTask.id;
@@ -488,9 +488,8 @@ export class AlertsClient {
       : null;
     const apiKeyAttributes = this.apiKeyAsAlertAttributes(createdAPIKey, username);
 
-    const updatedObject = await this.unsecuredSavedObjectsClient.update<RawAlert>(
+    const updatedObject = await this.unsecuredSavedObjectsClient.create<RawAlert>(
       'alert',
-      id,
       this.updateMeta({
         ...attributes,
         ...data,
@@ -500,6 +499,8 @@ export class AlertsClient {
         updatedBy: username,
       }),
       {
+        id,
+        overwrite: true,
         version,
         references,
       }
@@ -798,6 +799,7 @@ export class AlertsClient {
       'alert',
       alertId
     );
+
     await this.authorization.ensureAuthorized(
       attributes.alertTypeId,
       attributes.consumer,
@@ -809,7 +811,7 @@ export class AlertsClient {
 
     const mutedInstanceIds = attributes.mutedInstanceIds || [];
     if (!attributes.muteAll && mutedInstanceIds.includes(alertInstanceId)) {
-      await this.unsecuredSavedObjectsClient.update(
+      await this.unsecuredSavedObjectsClient.update<RawAlert>(
         'alert',
         alertId,
         this.updateMeta({
diff --git a/x-pack/plugins/alerts/server/task_runner/create_execution_handler.ts b/x-pack/plugins/alerts/server/task_runner/create_execution_handler.ts
index f873b0178ece9..aca447b6adedd 100644
--- a/x-pack/plugins/alerts/server/task_runner/create_execution_handler.ts
+++ b/x-pack/plugins/alerts/server/task_runner/create_execution_handler.ts
@@ -19,6 +19,7 @@ import {
   AlertInstanceContext,
   AlertType,
   AlertTypeParams,
+  RawAlert,
 } from '../types';
 
 interface CreateExecutionHandlerOptions {
@@ -28,7 +29,7 @@ interface CreateExecutionHandlerOptions {
   actionsPlugin: ActionsPluginStartContract;
   actions: AlertAction[];
   spaceId: string;
-  apiKey: string | null;
+  apiKey: RawAlert['apiKey'];
   alertType: AlertType;
   logger: Logger;
   eventLogger: IEventLogger;
@@ -99,7 +100,7 @@ export function createExecutionHandler({
         id: action.id,
         params: action.params,
         spaceId,
-        apiKey,
+        apiKey: apiKey ?? null,
         source: asSavedObjectExecutionSource({
           id: alertId,
           type: 'alert',
diff --git a/x-pack/plugins/alerts/server/task_runner/task_runner.ts b/x-pack/plugins/alerts/server/task_runner/task_runner.ts
index 4c16d23b485b5..5be684eca4651 100644
--- a/x-pack/plugins/alerts/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerts/server/task_runner/task_runner.ts
@@ -73,7 +73,7 @@ export class TaskRunner {
     return apiKey;
   }
 
-  private getFakeKibanaRequest(spaceId: string, apiKey: string | null) {
+  private getFakeKibanaRequest(spaceId: string, apiKey: RawAlert['apiKey']) {
     const requestHeaders: Record<string, string> = {};
 
     if (apiKey) {
@@ -98,7 +98,7 @@ export class TaskRunner {
 
   private getServicesWithSpaceLevelPermissions(
     spaceId: string,
-    apiKey: string | null
+    apiKey: RawAlert['apiKey']
   ): [Services, PublicMethodsOf<AlertsClient>] {
     const request = this.getFakeKibanaRequest(spaceId, apiKey);
     return [this.context.getServices(request), this.context.getAlertsClientWithRequest(request)];
@@ -109,7 +109,7 @@ export class TaskRunner {
     alertName: string,
     tags: string[] | undefined,
     spaceId: string,
-    apiKey: string | null,
+    apiKey: RawAlert['apiKey'],
     actions: Alert['actions'],
     alertParams: RawAlert['params']
   ) {
@@ -250,7 +250,11 @@ export class TaskRunner {
     };
   }
 
-  async validateAndExecuteAlert(services: Services, apiKey: string | null, alert: SanitizedAlert) {
+  async validateAndExecuteAlert(
+    services: Services,
+    apiKey: RawAlert['apiKey'],
+    alert: SanitizedAlert
+  ) {
     const {
       params: { alertId, spaceId },
     } = this.taskInstance;
diff --git a/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap b/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
index 8218eefe738f0..8c233d3691c7f 100644
--- a/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
+++ b/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
@@ -36,12 +36,12 @@ exports[`Error ERROR_LOG_MESSAGE 1`] = `undefined`;
 
 exports[`Error ERROR_PAGE_URL 1`] = `undefined`;
 
+exports[`Error EVENT_OUTCOME 1`] = `undefined`;
+
 exports[`Error FCP_FIELD 1`] = `undefined`;
 
 exports[`Error FID_FIELD 1`] = `undefined`;
 
-exports[`Error EVENT_OUTCOME 1`] = `undefined`;
-
 exports[`Error HOST_NAME 1`] = `"my hostname"`;
 
 exports[`Error HTTP_REQUEST_METHOD 1`] = `undefined`;
@@ -52,6 +52,10 @@ exports[`Error LABEL_NAME 1`] = `undefined`;
 
 exports[`Error LCP_FIELD 1`] = `undefined`;
 
+exports[`Error METRIC_CGROUP_MEMORY_LIMIT_BYTES 1`] = `undefined`;
+
+exports[`Error METRIC_CGROUP_MEMORY_USAGE_BYTES 1`] = `undefined`;
+
 exports[`Error METRIC_JAVA_GC_COUNT 1`] = `undefined`;
 
 exports[`Error METRIC_JAVA_GC_TIME 1`] = `undefined`;
@@ -136,6 +140,8 @@ exports[`Error TRANSACTION_DOM_INTERACTIVE 1`] = `undefined`;
 
 exports[`Error TRANSACTION_DURATION 1`] = `undefined`;
 
+exports[`Error TRANSACTION_DURATION_HISTOGRAM 1`] = `undefined`;
+
 exports[`Error TRANSACTION_ID 1`] = `"transaction id"`;
 
 exports[`Error TRANSACTION_NAME 1`] = `undefined`;
@@ -144,6 +150,8 @@ exports[`Error TRANSACTION_PAGE_URL 1`] = `undefined`;
 
 exports[`Error TRANSACTION_RESULT 1`] = `undefined`;
 
+exports[`Error TRANSACTION_ROOT 1`] = `undefined`;
+
 exports[`Error TRANSACTION_SAMPLED 1`] = `undefined`;
 
 exports[`Error TRANSACTION_TIME_TO_FIRST_BYTE 1`] = `undefined`;
@@ -200,12 +208,12 @@ exports[`Span ERROR_LOG_MESSAGE 1`] = `undefined`;
 
 exports[`Span ERROR_PAGE_URL 1`] = `undefined`;
 
+exports[`Span EVENT_OUTCOME 1`] = `undefined`;
+
 exports[`Span FCP_FIELD 1`] = `undefined`;
 
 exports[`Span FID_FIELD 1`] = `undefined`;
 
-exports[`Span EVENT_OUTCOME 1`] = `undefined`;
-
 exports[`Span HOST_NAME 1`] = `undefined`;
 
 exports[`Span HTTP_REQUEST_METHOD 1`] = `undefined`;
@@ -216,6 +224,10 @@ exports[`Span LABEL_NAME 1`] = `undefined`;
 
 exports[`Span LCP_FIELD 1`] = `undefined`;
 
+exports[`Span METRIC_CGROUP_MEMORY_LIMIT_BYTES 1`] = `undefined`;
+
+exports[`Span METRIC_CGROUP_MEMORY_USAGE_BYTES 1`] = `undefined`;
+
 exports[`Span METRIC_JAVA_GC_COUNT 1`] = `undefined`;
 
 exports[`Span METRIC_JAVA_GC_TIME 1`] = `undefined`;
@@ -300,6 +312,8 @@ exports[`Span TRANSACTION_DOM_INTERACTIVE 1`] = `undefined`;
 
 exports[`Span TRANSACTION_DURATION 1`] = `undefined`;
 
+exports[`Span TRANSACTION_DURATION_HISTOGRAM 1`] = `undefined`;
+
 exports[`Span TRANSACTION_ID 1`] = `"transaction id"`;
 
 exports[`Span TRANSACTION_NAME 1`] = `undefined`;
@@ -308,6 +322,8 @@ exports[`Span TRANSACTION_PAGE_URL 1`] = `undefined`;
 
 exports[`Span TRANSACTION_RESULT 1`] = `undefined`;
 
+exports[`Span TRANSACTION_ROOT 1`] = `undefined`;
+
 exports[`Span TRANSACTION_SAMPLED 1`] = `undefined`;
 
 exports[`Span TRANSACTION_TIME_TO_FIRST_BYTE 1`] = `undefined`;
@@ -364,12 +380,12 @@ exports[`Transaction ERROR_LOG_MESSAGE 1`] = `undefined`;
 
 exports[`Transaction ERROR_PAGE_URL 1`] = `undefined`;
 
+exports[`Transaction EVENT_OUTCOME 1`] = `undefined`;
+
 exports[`Transaction FCP_FIELD 1`] = `undefined`;
 
 exports[`Transaction FID_FIELD 1`] = `undefined`;
 
-exports[`Transaction EVENT_OUTCOME 1`] = `undefined`;
-
 exports[`Transaction HOST_NAME 1`] = `"my hostname"`;
 
 exports[`Transaction HTTP_REQUEST_METHOD 1`] = `"GET"`;
@@ -380,6 +396,10 @@ exports[`Transaction LABEL_NAME 1`] = `undefined`;
 
 exports[`Transaction LCP_FIELD 1`] = `undefined`;
 
+exports[`Transaction METRIC_CGROUP_MEMORY_LIMIT_BYTES 1`] = `undefined`;
+
+exports[`Transaction METRIC_CGROUP_MEMORY_USAGE_BYTES 1`] = `undefined`;
+
 exports[`Transaction METRIC_JAVA_GC_COUNT 1`] = `undefined`;
 
 exports[`Transaction METRIC_JAVA_GC_TIME 1`] = `undefined`;
@@ -464,6 +484,8 @@ exports[`Transaction TRANSACTION_DOM_INTERACTIVE 1`] = `undefined`;
 
 exports[`Transaction TRANSACTION_DURATION 1`] = `1337`;
 
+exports[`Transaction TRANSACTION_DURATION_HISTOGRAM 1`] = `undefined`;
+
 exports[`Transaction TRANSACTION_ID 1`] = `"transaction id"`;
 
 exports[`Transaction TRANSACTION_NAME 1`] = `"transaction name"`;
@@ -472,6 +494,8 @@ exports[`Transaction TRANSACTION_PAGE_URL 1`] = `undefined`;
 
 exports[`Transaction TRANSACTION_RESULT 1`] = `"transaction result"`;
 
+exports[`Transaction TRANSACTION_ROOT 1`] = `undefined`;
+
 exports[`Transaction TRANSACTION_SAMPLED 1`] = `true`;
 
 exports[`Transaction TRANSACTION_TIME_TO_FIRST_BYTE 1`] = `undefined`;
diff --git a/x-pack/plugins/apm/common/aggregated_transactions.ts b/x-pack/plugins/apm/common/aggregated_transactions.ts
new file mode 100644
index 0000000000000..51149df45e9de
--- /dev/null
+++ b/x-pack/plugins/apm/common/aggregated_transactions.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export enum SearchAggregatedTransactionSetting {
+  always = 'always',
+  never = 'never',
+  auto = 'auto',
+}
diff --git a/x-pack/plugins/apm/common/alert_types.ts b/x-pack/plugins/apm/common/alert_types.ts
index a1161354e04f4..15a3c642faf32 100644
--- a/x-pack/plugins/apm/common/alert_types.ts
+++ b/x-pack/plugins/apm/common/alert_types.ts
@@ -7,42 +7,33 @@
 import { i18n } from '@kbn/i18n';
 
 export enum AlertType {
-  ErrorRate = 'apm.error_rate',
+  ErrorCount = 'apm.error_rate', // ErrorRate was renamed to ErrorCount but the key is kept as `error_rate` for backwards-compat.
+  TransactionErrorRate = 'apm.transaction_error_rate',
   TransactionDuration = 'apm.transaction_duration',
   TransactionDurationAnomaly = 'apm.transaction_duration_anomaly',
 }
 
+const THRESHOLD_MET_GROUP = {
+  id: 'threshold_met',
+  name: i18n.translate('xpack.apm.a.thresholdMet', {
+    defaultMessage: 'Threshold met',
+  }),
+};
+
 export const ALERT_TYPES_CONFIG = {
-  [AlertType.ErrorRate]: {
-    name: i18n.translate('xpack.apm.errorRateAlert.name', {
-      defaultMessage: 'Error rate',
+  [AlertType.ErrorCount]: {
+    name: i18n.translate('xpack.apm.errorCountAlert.name', {
+      defaultMessage: 'Error count threshold',
     }),
-    actionGroups: [
-      {
-        id: 'threshold_met',
-        name: i18n.translate('xpack.apm.errorRateAlert.thresholdMet', {
-          defaultMessage: 'Threshold met',
-        }),
-      },
-    ],
+    actionGroups: [THRESHOLD_MET_GROUP],
     defaultActionGroupId: 'threshold_met',
     producer: 'apm',
   },
   [AlertType.TransactionDuration]: {
     name: i18n.translate('xpack.apm.transactionDurationAlert.name', {
-      defaultMessage: 'Transaction duration',
+      defaultMessage: 'Transaction duration threshold',
     }),
-    actionGroups: [
-      {
-        id: 'threshold_met',
-        name: i18n.translate(
-          'xpack.apm.transactionDurationAlert.thresholdMet',
-          {
-            defaultMessage: 'Threshold met',
-          }
-        ),
-      },
-    ],
+    actionGroups: [THRESHOLD_MET_GROUP],
     defaultActionGroupId: 'threshold_met',
     producer: 'apm',
   },
@@ -50,39 +41,24 @@ export const ALERT_TYPES_CONFIG = {
     name: i18n.translate('xpack.apm.transactionDurationAnomalyAlert.name', {
       defaultMessage: 'Transaction duration anomaly',
     }),
-    actionGroups: [
-      {
-        id: 'threshold_met',
-        name: i18n.translate(
-          'xpack.apm.transactionDurationAlert.thresholdMet',
-          {
-            defaultMessage: 'Threshold met',
-          }
-        ),
-      },
-    ],
+    actionGroups: [THRESHOLD_MET_GROUP],
+    defaultActionGroupId: 'threshold_met',
+    producer: 'apm',
+  },
+  [AlertType.TransactionErrorRate]: {
+    name: i18n.translate('xpack.apm.transactionErrorRateAlert.name', {
+      defaultMessage: 'Transaction error rate threshold',
+    }),
+    actionGroups: [THRESHOLD_MET_GROUP],
     defaultActionGroupId: 'threshold_met',
     producer: 'apm',
   },
 };
 
-export const TRANSACTION_ALERT_AGGREGATION_TYPES = {
-  avg: i18n.translate(
-    'xpack.apm.transactionDurationAlert.aggregationType.avg',
-    {
-      defaultMessage: 'Average',
-    }
-  ),
-  '95th': i18n.translate(
-    'xpack.apm.transactionDurationAlert.aggregationType.95th',
-    {
-      defaultMessage: '95th percentile',
-    }
-  ),
-  '99th': i18n.translate(
-    'xpack.apm.transactionDurationAlert.aggregationType.99th',
-    {
-      defaultMessage: '99th percentile',
-    }
-  ),
-};
+// Server side registrations
+// x-pack/plugins/apm/server/lib/alerts/<alert>.ts
+// x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts
+
+// Client side registrations:
+// x-pack/plugins/apm/public/components/alerting/<alert>/index.tsx
+// x-pack/plugins/apm/public/components/alerting/register_apm_alerts
diff --git a/x-pack/plugins/apm/common/custom_link/index.ts b/x-pack/plugins/apm/common/custom_link/index.ts
new file mode 100644
index 0000000000000..bc0ffefd79c4d
--- /dev/null
+++ b/x-pack/plugins/apm/common/custom_link/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { i18n } from '@kbn/i18n';
+
+export const INVALID_LICENSE = i18n.translate(
+  'xpack.apm.settings.customizeUI.customLink.license.text',
+  {
+    defaultMessage:
+      "To create custom links, you must be subscribed to an Elastic Gold license or above. With it, you'll have the ability to create custom links to improve your workflow when analyzing your services.",
+  }
+);
diff --git a/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts b/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
index e1a279714d308..cc6a1fffb2288 100644
--- a/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
+++ b/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
@@ -37,6 +37,7 @@ export const OBSERVER_LISTENING = 'observer.listening';
 export const PROCESSOR_EVENT = 'processor.event';
 
 export const TRANSACTION_DURATION = 'transaction.duration.us';
+export const TRANSACTION_DURATION_HISTOGRAM = 'transaction.duration.histogram';
 export const TRANSACTION_TYPE = 'transaction.type';
 export const TRANSACTION_RESULT = 'transaction.result';
 export const TRANSACTION_NAME = 'transaction.name';
@@ -44,6 +45,8 @@ export const TRANSACTION_ID = 'transaction.id';
 export const TRANSACTION_SAMPLED = 'transaction.sampled';
 export const TRANSACTION_BREAKDOWN_COUNT = 'transaction.breakdown.count';
 export const TRANSACTION_PAGE_URL = 'transaction.page.url';
+// for transaction metrics
+export const TRANSACTION_ROOT = 'transaction.root';
 
 export const EVENT_OUTCOME = 'event.outcome';
 
@@ -76,6 +79,10 @@ export const METRIC_SYSTEM_FREE_MEMORY = 'system.memory.actual.free';
 export const METRIC_SYSTEM_TOTAL_MEMORY = 'system.memory.total';
 export const METRIC_SYSTEM_CPU_PERCENT = 'system.cpu.total.norm.pct';
 export const METRIC_PROCESS_CPU_PERCENT = 'system.process.cpu.total.norm.pct';
+export const METRIC_CGROUP_MEMORY_LIMIT_BYTES =
+  'system.process.cgroup.memory.mem.limit.bytes';
+export const METRIC_CGROUP_MEMORY_USAGE_BYTES =
+  'system.process.cgroup.memory.mem.usage.bytes';
 
 export const METRIC_JAVA_HEAP_MEMORY_MAX = 'jvm.memory.heap.max';
 export const METRIC_JAVA_HEAP_MEMORY_COMMITTED = 'jvm.memory.heap.committed';
diff --git a/x-pack/plugins/apm/common/utils/maybe.ts b/x-pack/plugins/apm/common/utils/maybe.ts
new file mode 100644
index 0000000000000..b586827a71c7e
--- /dev/null
+++ b/x-pack/plugins/apm/common/utils/maybe.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export function maybe<T>(value: T): T | null | undefined {
+  return value;
+}
diff --git a/x-pack/plugins/apm/e2e/cypress/integration/helpers.ts b/x-pack/plugins/apm/e2e/cypress/integration/helpers.ts
index 1956f1c2d9f0d..462304a959102 100644
--- a/x-pack/plugins/apm/e2e/cypress/integration/helpers.ts
+++ b/x-pack/plugins/apm/e2e/cypress/integration/helpers.ts
@@ -11,14 +11,19 @@ export const DEFAULT_TIMEOUT = 60 * 1000;
 
 export function loginAndWaitForPage(
   url: string,
-  dateRange: { to: string; from: string }
+  dateRange: { to: string; from: string },
+  selectedService?: string
 ) {
   const username = Cypress.env('elasticsearch_username');
   const password = Cypress.env('elasticsearch_password');
 
   cy.log(`Authenticating via ${username} / ${password}`);
 
-  const fullUrl = `${BASE_URL}${url}?rangeFrom=${dateRange.from}&rangeTo=${dateRange.to}`;
+  let fullUrl = `${BASE_URL}${url}?rangeFrom=${dateRange.from}&rangeTo=${dateRange.to}`;
+
+  if (selectedService) {
+    fullUrl += `&serviceName=${selectedService}`;
+  }
   cy.visit(fullUrl, { auth: { username, password } });
 
   cy.viewport('macbook-15');
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/csm_dashboard.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/csm_dashboard.ts
index a57241a197ca4..461e2960c5e02 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/csm_dashboard.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/csm_dashboard.ts
@@ -15,10 +15,14 @@ Given(`a user browses the APM UI application for RUM Data`, () => {
   // open service overview page
   const RANGE_FROM = 'now-24h';
   const RANGE_TO = 'now';
-  loginAndWaitForPage(`/app/csm`, {
-    from: RANGE_FROM,
-    to: RANGE_TO,
-  });
+  loginAndWaitForPage(
+    `/app/csm`,
+    {
+      from: RANGE_FROM,
+      to: RANGE_TO,
+    },
+    'client'
+  );
 });
 
 Then(`should have correct client metrics`, () => {
diff --git a/x-pack/plugins/apm/e2e/yarn.lock b/x-pack/plugins/apm/e2e/yarn.lock
index 936294052aa7b..fc63189e97ea3 100644
--- a/x-pack/plugins/apm/e2e/yarn.lock
+++ b/x-pack/plugins/apm/e2e/yarn.lock
@@ -5494,10 +5494,10 @@ typedarray@^0.0.6:
   resolved "https://registry.yarnpkg.com/typedarray/-/typedarray-0.0.6.tgz#867ac74e3864187b1d3d47d996a78ec5c8830777"
   integrity sha1-hnrHTjhkGHsdPUfZlqeOxciDB3c=
 
-typescript@3.9.6:
-  version "3.9.6"
-  resolved "https://registry.yarnpkg.com/typescript/-/typescript-3.9.6.tgz#8f3e0198a34c3ae17091b35571d3afd31999365a"
-  integrity sha512-Pspx3oKAPJtjNwE92YS05HQoY7z2SFyOpHo9MqJor3BXAGNaPUs83CuVp9VISFkSjyRfiTpmKuAYGJB7S7hOxw==
+typescript@4.0.2:
+  version "4.0.2"
+  resolved "https://registry.yarnpkg.com/typescript/-/typescript-4.0.2.tgz#7ea7c88777c723c681e33bf7988be5d008d05ac2"
+  integrity sha512-e4ERvRV2wb+rRZ/IQeb3jm2VxBsirQLpQhdxplZ2MEzGvDkkMmPglecnNDfSUBivMjP93vRbngYYDQqQ/78bcQ==
 
 umd@^3.0.0:
   version "3.0.3"
diff --git a/x-pack/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.stories.tsx b/x-pack/plugins/apm/public/components/alerting/ErrorCountAlertTrigger/index.stories.tsx
similarity index 83%
rename from x-pack/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.stories.tsx
rename to x-pack/plugins/apm/public/components/alerting/ErrorCountAlertTrigger/index.stories.tsx
index 632d53a9c63b6..c30cef7210a43 100644
--- a/x-pack/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.stories.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/ErrorCountAlertTrigger/index.stories.tsx
@@ -6,14 +6,14 @@
 
 import { storiesOf } from '@storybook/react';
 import React from 'react';
-import { ErrorRateAlertTrigger } from '.';
+import { ErrorCountAlertTrigger } from '.';
 import { ApmPluginContextValue } from '../../../context/ApmPluginContext';
 import {
   mockApmPluginContextValue,
   MockApmPluginContextWrapper,
 } from '../../../context/ApmPluginContext/MockApmPluginContext';
 
-storiesOf('app/ErrorRateAlertTrigger', module).add(
+storiesOf('app/ErrorCountAlertTrigger', module).add(
   'example',
   () => {
     const params = {
@@ -26,7 +26,7 @@ storiesOf('app/ErrorRateAlertTrigger', module).add(
         value={(mockApmPluginContextValue as unknown) as ApmPluginContextValue}
       >
         <div style={{ width: 400 }}>
-          <ErrorRateAlertTrigger
+          <ErrorCountAlertTrigger
             alertParams={params as any}
             setAlertParams={() => undefined}
             setAlertProperty={() => undefined}
@@ -37,7 +37,7 @@ storiesOf('app/ErrorRateAlertTrigger', module).add(
   },
   {
     info: {
-      propTablesExclude: [ErrorRateAlertTrigger, MockApmPluginContextWrapper],
+      propTablesExclude: [ErrorCountAlertTrigger, MockApmPluginContextWrapper],
       source: false,
     },
   }
diff --git a/x-pack/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.tsx b/x-pack/plugins/apm/public/components/alerting/ErrorCountAlertTrigger/index.tsx
similarity index 54%
rename from x-pack/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.tsx
rename to x-pack/plugins/apm/public/components/alerting/ErrorCountAlertTrigger/index.tsx
index 7b284696477f3..a465b90e7bf05 100644
--- a/x-pack/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/ErrorCountAlertTrigger/index.tsx
@@ -3,36 +3,33 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { EuiFieldNumber, EuiSelect } from '@elastic/eui';
+
 import { i18n } from '@kbn/i18n';
-import { isFinite } from 'lodash';
 import React from 'react';
 import { useParams } from 'react-router-dom';
 import { ForLastExpression } from '../../../../../triggers_actions_ui/public';
-import { ALERT_TYPES_CONFIG } from '../../../../common/alert_types';
-import {
-  ENVIRONMENT_ALL,
-  getEnvironmentLabel,
-} from '../../../../common/environment_filter_values';
+import { ALERT_TYPES_CONFIG, AlertType } from '../../../../common/alert_types';
+import { ENVIRONMENT_ALL } from '../../../../common/environment_filter_values';
 import { useEnvironments } from '../../../hooks/useEnvironments';
 import { useUrlParams } from '../../../hooks/useUrlParams';
+import { EnvironmentField, ServiceField, IsAboveField } from '../fields';
 import { ServiceAlertTrigger } from '../ServiceAlertTrigger';
-import { PopoverExpression } from '../ServiceAlertTrigger/PopoverExpression';
 
-export interface ErrorRateAlertTriggerParams {
+export interface AlertParams {
   windowSize: number;
   windowUnit: string;
   threshold: number;
+  serviceName: string;
   environment: string;
 }
 
 interface Props {
-  alertParams: ErrorRateAlertTriggerParams;
+  alertParams: AlertParams;
   setAlertParams: (key: string, value: any) => void;
   setAlertProperty: (key: string, value: any) => void;
 }
 
-export function ErrorRateAlertTrigger(props: Props) {
+export function ErrorCountAlertTrigger(props: Props) {
   const { setAlertParams, setAlertProperty, alertParams } = props;
   const { serviceName } = useParams<{ serviceName?: string }>();
   const { urlParams } = useUrlParams();
@@ -51,45 +48,20 @@ export function ErrorRateAlertTrigger(props: Props) {
     ...alertParams,
   };
 
-  const threshold = isFinite(params.threshold) ? params.threshold : '';
-
   const fields = [
-    <PopoverExpression
-      value={getEnvironmentLabel(params.environment)}
-      title={i18n.translate('xpack.apm.errorRateAlertTrigger.environment', {
-        defaultMessage: 'Environment',
-      })}
-    >
-      <EuiSelect
-        value={params.environment}
-        options={environmentOptions}
-        onChange={(e) =>
-          setAlertParams(
-            'environment',
-            e.target.value as ErrorRateAlertTriggerParams['environment']
-          )
-        }
-        compressed
-      />
-    </PopoverExpression>,
-    <PopoverExpression
-      title={i18n.translate('xpack.apm.errorRateAlertTrigger.isAbove', {
-        defaultMessage: 'is above',
+    <ServiceField value={serviceName} />,
+    <EnvironmentField
+      currentValue={params.environment}
+      options={environmentOptions}
+      onChange={(e) => setAlertParams('environment', e.target.value)}
+    />,
+    <IsAboveField
+      value={params.threshold}
+      unit={i18n.translate('xpack.apm.errorCountAlertTrigger.errors', {
+        defaultMessage: ' errors',
       })}
-      value={threshold.toString()}
-    >
-      <EuiFieldNumber
-        value={threshold}
-        step={0}
-        onChange={(e) =>
-          setAlertParams('threshold', parseInt(e.target.value, 10))
-        }
-        compressed
-        append={i18n.translate('xpack.apm.errorRateAlertTrigger.errors', {
-          defaultMessage: 'errors',
-        })}
-      />
-    </PopoverExpression>,
+      onChange={(value) => setAlertParams('threshold', value)}
+    />,
     <ForLastExpression
       onChangeWindowSize={(windowSize) =>
         setAlertParams('windowSize', windowSize || '')
@@ -108,7 +80,7 @@ export function ErrorRateAlertTrigger(props: Props) {
 
   return (
     <ServiceAlertTrigger
-      alertTypeName={ALERT_TYPES_CONFIG['apm.error_rate'].name}
+      alertTypeName={ALERT_TYPES_CONFIG[AlertType.ErrorCount].name}
       defaults={defaults}
       fields={fields}
       setAlertParams={setAlertParams}
@@ -120,4 +92,4 @@ export function ErrorRateAlertTrigger(props: Props) {
 // Default export is required for React.lazy loading
 //
 // eslint-disable-next-line import/no-default-export
-export default ErrorRateAlertTrigger;
+export default ErrorCountAlertTrigger;
diff --git a/x-pack/plugins/apm/public/components/shared/ServiceAlertTrigger/PopoverExpression/index.tsx b/x-pack/plugins/apm/public/components/alerting/ServiceAlertTrigger/PopoverExpression/index.tsx
similarity index 99%
rename from x-pack/plugins/apm/public/components/shared/ServiceAlertTrigger/PopoverExpression/index.tsx
rename to x-pack/plugins/apm/public/components/alerting/ServiceAlertTrigger/PopoverExpression/index.tsx
index 33f61d61f989b..ac96951ab54ca 100644
--- a/x-pack/plugins/apm/public/components/shared/ServiceAlertTrigger/PopoverExpression/index.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/ServiceAlertTrigger/PopoverExpression/index.tsx
@@ -15,7 +15,6 @@ interface Props {
 
 export function PopoverExpression(props: Props) {
   const { title, value, children } = props;
-
   const [popoverOpen, setPopoverOpen] = useState(false);
 
   return (
diff --git a/x-pack/plugins/apm/public/components/shared/ServiceAlertTrigger/index.tsx b/x-pack/plugins/apm/public/components/alerting/ServiceAlertTrigger/index.tsx
similarity index 100%
rename from x-pack/plugins/apm/public/components/shared/ServiceAlertTrigger/index.tsx
rename to x-pack/plugins/apm/public/components/alerting/ServiceAlertTrigger/index.tsx
diff --git a/x-pack/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.stories.tsx b/x-pack/plugins/apm/public/components/alerting/TransactionDurationAlertTrigger/index.stories.tsx
similarity index 100%
rename from x-pack/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.stories.tsx
rename to x-pack/plugins/apm/public/components/alerting/TransactionDurationAlertTrigger/index.stories.tsx
diff --git a/x-pack/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.tsx b/x-pack/plugins/apm/public/components/alerting/TransactionDurationAlertTrigger/index.tsx
similarity index 57%
rename from x-pack/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.tsx
rename to x-pack/plugins/apm/public/components/alerting/TransactionDurationAlertTrigger/index.tsx
index 3c1669c39ac4c..3ddd623d9e848 100644
--- a/x-pack/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/TransactionDurationAlertTrigger/index.tsx
@@ -3,26 +3,27 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { EuiFieldNumber, EuiSelect } from '@elastic/eui';
+import { EuiSelect } from '@elastic/eui';
+import { useParams } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
 import { map } from 'lodash';
 import React from 'react';
 import { ForLastExpression } from '../../../../../triggers_actions_ui/public';
-import {
-  ALERT_TYPES_CONFIG,
-  TRANSACTION_ALERT_AGGREGATION_TYPES,
-} from '../../../../common/alert_types';
+import { ALERT_TYPES_CONFIG } from '../../../../common/alert_types';
 import { useEnvironments } from '../../../hooks/useEnvironments';
 import { useServiceTransactionTypes } from '../../../hooks/useServiceTransactionTypes';
 import { useUrlParams } from '../../../hooks/useUrlParams';
 import { ServiceAlertTrigger } from '../ServiceAlertTrigger';
 import { PopoverExpression } from '../ServiceAlertTrigger/PopoverExpression';
+import { ENVIRONMENT_ALL } from '../../../../common/environment_filter_values';
 import {
-  ENVIRONMENT_ALL,
-  getEnvironmentLabel,
-} from '../../../../common/environment_filter_values';
+  EnvironmentField,
+  ServiceField,
+  TransactionTypeField,
+  IsAboveField,
+} from '../fields';
 
-interface Params {
+interface AlertParams {
   windowSize: number;
   windowUnit: string;
   threshold: number;
@@ -32,23 +33,42 @@ interface Params {
   environment: string;
 }
 
+const TRANSACTION_ALERT_AGGREGATION_TYPES = {
+  avg: i18n.translate(
+    'xpack.apm.transactionDurationAlert.aggregationType.avg',
+    {
+      defaultMessage: 'Average',
+    }
+  ),
+  '95th': i18n.translate(
+    'xpack.apm.transactionDurationAlert.aggregationType.95th',
+    {
+      defaultMessage: '95th percentile',
+    }
+  ),
+  '99th': i18n.translate(
+    'xpack.apm.transactionDurationAlert.aggregationType.99th',
+    {
+      defaultMessage: '99th percentile',
+    }
+  ),
+};
+
 interface Props {
-  alertParams: Params;
+  alertParams: AlertParams;
   setAlertParams: (key: string, value: any) => void;
   setAlertProperty: (key: string, value: any) => void;
 }
 
 export function TransactionDurationAlertTrigger(props: Props) {
   const { setAlertParams, alertParams, setAlertProperty } = props;
-  const { serviceName } = alertParams;
   const { urlParams } = useUrlParams();
-
   const transactionTypes = useServiceTransactionTypes(urlParams);
-
-  const { start, end } = urlParams;
+  const { serviceName } = useParams<{ serviceName?: string }>();
+  const { start, end, transactionType } = urlParams;
   const { environmentOptions } = useEnvironments({ serviceName, start, end });
 
-  if (!transactionTypes.length) {
+  if (!transactionTypes.length || !serviceName) {
     return null;
   }
 
@@ -57,7 +77,9 @@ export function TransactionDurationAlertTrigger(props: Props) {
     aggregationType: 'avg',
     windowSize: 5,
     windowUnit: 'm',
-    transactionType: transactionTypes[0],
+
+    // use the current transaction type or default to the first in the list
+    transactionType: transactionType || transactionTypes[0],
     environment: urlParams.environment || ENVIRONMENT_ALL.value,
   };
 
@@ -67,47 +89,17 @@ export function TransactionDurationAlertTrigger(props: Props) {
   };
 
   const fields = [
-    <PopoverExpression
-      value={getEnvironmentLabel(params.environment)}
-      title={i18n.translate(
-        'xpack.apm.transactionDurationAlertTrigger.environment',
-        {
-          defaultMessage: 'Environment',
-        }
-      )}
-    >
-      <EuiSelect
-        value={params.environment}
-        options={environmentOptions}
-        onChange={(e) =>
-          setAlertParams('environment', e.target.value as Params['environment'])
-        }
-        compressed
-      />
-    </PopoverExpression>,
-    <PopoverExpression
-      value={params.transactionType}
-      title={i18n.translate('xpack.apm.transactionDurationAlertTrigger.type', {
-        defaultMessage: 'Type',
-      })}
-    >
-      <EuiSelect
-        value={params.transactionType}
-        options={transactionTypes.map((key) => {
-          return {
-            text: key,
-            value: key,
-          };
-        })}
-        onChange={(e) =>
-          setAlertParams(
-            'transactionType',
-            e.target.value as Params['transactionType']
-          )
-        }
-        compressed
-      />
-    </PopoverExpression>,
+    <ServiceField value={serviceName} />,
+    <EnvironmentField
+      currentValue={params.environment}
+      options={environmentOptions}
+      onChange={(e) => setAlertParams('environment', e.target.value)}
+    />,
+    <TransactionTypeField
+      currentValue={params.transactionType}
+      options={transactionTypes.map((key) => ({ text: key, value: key }))}
+      onChange={(e) => setAlertParams('transactionType', e.target.value)}
+    />,
     <PopoverExpression
       value={params.aggregationType}
       title={i18n.translate('xpack.apm.transactionDurationAlertTrigger.when', {
@@ -122,33 +114,17 @@ export function TransactionDurationAlertTrigger(props: Props) {
             value: key,
           };
         })}
-        onChange={(e) =>
-          setAlertParams(
-            'aggregationType',
-            e.target.value as Params['aggregationType']
-          )
-        }
-        compressed
-      />
-    </PopoverExpression>,
-    <PopoverExpression
-      value={params.threshold ? `${params.threshold}ms` : ''}
-      title={i18n.translate(
-        'xpack.apm.transactionDurationAlertTrigger.isAbove',
-        {
-          defaultMessage: 'is above',
-        }
-      )}
-    >
-      <EuiFieldNumber
-        value={params.threshold ?? ''}
-        onChange={(e) => setAlertParams('threshold', e.target.value)}
-        append={i18n.translate('xpack.apm.transactionDurationAlertTrigger.ms', {
-          defaultMessage: 'ms',
-        })}
+        onChange={(e) => setAlertParams('aggregationType', e.target.value)}
         compressed
       />
     </PopoverExpression>,
+    <IsAboveField
+      value={params.threshold}
+      unit={i18n.translate('xpack.apm.transactionDurationAlertTrigger.ms', {
+        defaultMessage: 'ms',
+      })}
+      onChange={(value) => setAlertParams('threshold', value)}
+    />,
     <ForLastExpression
       onChangeWindowSize={(timeWindowSize) =>
         setAlertParams('windowSize', timeWindowSize || '')
diff --git a/x-pack/plugins/apm/public/components/shared/TransactionDurationAnomalyAlertTrigger/SelectAnomalySeverity.tsx b/x-pack/plugins/apm/public/components/alerting/TransactionDurationAnomalyAlertTrigger/SelectAnomalySeverity.tsx
similarity index 100%
rename from x-pack/plugins/apm/public/components/shared/TransactionDurationAnomalyAlertTrigger/SelectAnomalySeverity.tsx
rename to x-pack/plugins/apm/public/components/alerting/TransactionDurationAnomalyAlertTrigger/SelectAnomalySeverity.tsx
diff --git a/x-pack/plugins/apm/public/components/shared/TransactionDurationAnomalyAlertTrigger/index.tsx b/x-pack/plugins/apm/public/components/alerting/TransactionDurationAnomalyAlertTrigger/index.tsx
similarity index 75%
rename from x-pack/plugins/apm/public/components/shared/TransactionDurationAnomalyAlertTrigger/index.tsx
rename to x-pack/plugins/apm/public/components/alerting/TransactionDurationAnomalyAlertTrigger/index.tsx
index 20e0a3f27c4a4..fb4cda56fce04 100644
--- a/x-pack/plugins/apm/public/components/shared/TransactionDurationAnomalyAlertTrigger/index.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/TransactionDurationAnomalyAlertTrigger/index.tsx
@@ -3,7 +3,8 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { EuiExpression, EuiSelect } from '@elastic/eui';
+
+import { useParams } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { ALERT_TYPES_CONFIG } from '../../../../common/alert_types';
@@ -16,14 +17,16 @@ import {
   AnomalySeverity,
   SelectAnomalySeverity,
 } from './SelectAnomalySeverity';
-import {
-  ENVIRONMENT_ALL,
-  getEnvironmentLabel,
-} from '../../../../common/environment_filter_values';
+import { ENVIRONMENT_ALL } from '../../../../common/environment_filter_values';
 import {
   TRANSACTION_PAGE_LOAD,
   TRANSACTION_REQUEST,
 } from '../../../../common/transaction_types';
+import {
+  EnvironmentField,
+  ServiceField,
+  TransactionTypeField,
+} from '../fields';
 
 interface Params {
   windowSize: number;
@@ -42,9 +45,9 @@ interface Props {
 
 export function TransactionDurationAnomalyAlertTrigger(props: Props) {
   const { setAlertParams, alertParams, setAlertProperty } = props;
-  const { serviceName } = alertParams;
   const { urlParams } = useUrlParams();
   const transactionTypes = useServiceTransactionTypes(urlParams);
+  const { serviceName } = useParams<{ serviceName?: string }>();
   const { start, end } = urlParams;
   const { environmentOptions } = useEnvironments({ serviceName, start, end });
   const supportedTransactionTypes = transactionTypes.filter((transactionType) =>
@@ -55,10 +58,13 @@ export function TransactionDurationAnomalyAlertTrigger(props: Props) {
     return null;
   }
 
+  // 'page-load' for RUM, 'request' otherwise
+  const transactionType = supportedTransactionTypes[0];
+
   const defaults: Params = {
     windowSize: 15,
     windowUnit: 'm',
-    transactionType: supportedTransactionTypes[0], // 'page-load' for RUM, 'request' otherwise
+    transactionType,
     serviceName,
     environment: urlParams.environment || ENVIRONMENT_ALL.value,
     anomalyScore: 75,
@@ -70,31 +76,13 @@ export function TransactionDurationAnomalyAlertTrigger(props: Props) {
   };
 
   const fields = [
-    <EuiExpression
-      description={i18n.translate(
-        'xpack.apm.transactionDurationAnomalyAlertTrigger.service',
-        {
-          defaultMessage: 'Service',
-        }
-      )}
-      value={serviceName}
+    <ServiceField value={serviceName} />,
+    <TransactionTypeField currentValue={transactionType} />,
+    <EnvironmentField
+      currentValue={params.environment}
+      options={environmentOptions}
+      onChange={(e) => setAlertParams('environment', e.target.value)}
     />,
-    <PopoverExpression
-      value={getEnvironmentLabel(params.environment)}
-      title={i18n.translate(
-        'xpack.apm.transactionDurationAnomalyAlertTrigger.environment',
-        {
-          defaultMessage: 'Environment',
-        }
-      )}
-    >
-      <EuiSelect
-        value={params.environment}
-        options={environmentOptions}
-        onChange={(e) => setAlertParams('environment', e.target.value)}
-        compressed
-      />
-    </PopoverExpression>,
     <PopoverExpression
       value={<AnomalySeverity severityScore={params.anomalyScore} />}
       title={i18n.translate(
diff --git a/x-pack/plugins/apm/public/components/alerting/TransactionErrorRateAlertTrigger/index.tsx b/x-pack/plugins/apm/public/components/alerting/TransactionErrorRateAlertTrigger/index.tsx
new file mode 100644
index 0000000000000..4dbf4dc10a907
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/alerting/TransactionErrorRateAlertTrigger/index.tsx
@@ -0,0 +1,110 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { useParams } from 'react-router-dom';
+import React from 'react';
+import { ForLastExpression } from '../../../../../triggers_actions_ui/public';
+import { ALERT_TYPES_CONFIG, AlertType } from '../../../../common/alert_types';
+import { useEnvironments } from '../../../hooks/useEnvironments';
+import { useServiceTransactionTypes } from '../../../hooks/useServiceTransactionTypes';
+import { useUrlParams } from '../../../hooks/useUrlParams';
+import { ServiceAlertTrigger } from '../ServiceAlertTrigger';
+
+import { ENVIRONMENT_ALL } from '../../../../common/environment_filter_values';
+import {
+  ServiceField,
+  TransactionTypeField,
+  EnvironmentField,
+  IsAboveField,
+} from '../fields';
+
+interface AlertParams {
+  windowSize: number;
+  windowUnit: string;
+  threshold: number;
+  serviceName: string;
+  transactionType: string;
+  environment: string;
+}
+
+interface Props {
+  alertParams: AlertParams;
+  setAlertParams: (key: string, value: any) => void;
+  setAlertProperty: (key: string, value: any) => void;
+}
+
+export function TransactionErrorRateAlertTrigger(props: Props) {
+  const { setAlertParams, alertParams, setAlertProperty } = props;
+  const { urlParams } = useUrlParams();
+  const transactionTypes = useServiceTransactionTypes(urlParams);
+  const { serviceName } = useParams<{ serviceName?: string }>();
+  const { start, end, transactionType } = urlParams;
+  const { environmentOptions } = useEnvironments({ serviceName, start, end });
+
+  if (!transactionTypes.length || !serviceName) {
+    return null;
+  }
+
+  const defaultParams = {
+    threshold: 30,
+    windowSize: 5,
+    windowUnit: 'm',
+    transactionType: transactionType || transactionTypes[0],
+    environment: urlParams.environment || ENVIRONMENT_ALL.value,
+  };
+
+  const params = {
+    ...defaultParams,
+    ...alertParams,
+  };
+
+  const fields = [
+    <ServiceField value={serviceName} />,
+    <EnvironmentField
+      currentValue={params.environment}
+      options={environmentOptions}
+      onChange={(e) => setAlertParams('environment', e.target.value)}
+    />,
+    <TransactionTypeField
+      currentValue={params.transactionType}
+      options={transactionTypes.map((key) => ({ text: key, value: key }))}
+      onChange={(e) => setAlertParams('transactionType', e.target.value)}
+    />,
+    <IsAboveField
+      value={params.threshold}
+      unit="%"
+      onChange={(value) => setAlertParams('threshold', value)}
+    />,
+    <ForLastExpression
+      onChangeWindowSize={(timeWindowSize) =>
+        setAlertParams('windowSize', timeWindowSize || '')
+      }
+      onChangeWindowUnit={(timeWindowUnit) =>
+        setAlertParams('windowUnit', timeWindowUnit)
+      }
+      timeWindowSize={params.windowSize}
+      timeWindowUnit={params.windowUnit}
+      errors={{
+        timeWindowSize: [],
+        timeWindowUnit: [],
+      }}
+    />,
+  ];
+
+  return (
+    <ServiceAlertTrigger
+      alertTypeName={ALERT_TYPES_CONFIG[AlertType.TransactionErrorRate].name}
+      fields={fields}
+      defaults={defaultParams}
+      setAlertParams={setAlertParams}
+      setAlertProperty={setAlertProperty}
+    />
+  );
+}
+
+// Default export is required for React.lazy loading
+//
+// eslint-disable-next-line import/no-default-export
+export default TransactionErrorRateAlertTrigger;
diff --git a/x-pack/plugins/apm/public/components/alerting/fields.tsx b/x-pack/plugins/apm/public/components/alerting/fields.tsx
new file mode 100644
index 0000000000000..e145d03671a18
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/alerting/fields.tsx
@@ -0,0 +1,108 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiSelect, EuiExpression, EuiFieldNumber } from '@elastic/eui';
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiSelectOption } from '@elastic/eui';
+import { getEnvironmentLabel } from '../../../common/environment_filter_values';
+import { PopoverExpression } from './ServiceAlertTrigger/PopoverExpression';
+
+export function ServiceField({ value }: { value?: string }) {
+  return (
+    <EuiExpression
+      description={i18n.translate('xpack.apm.alerting.fields.service', {
+        defaultMessage: 'Service',
+      })}
+      value={value}
+    />
+  );
+}
+
+export function EnvironmentField({
+  currentValue,
+  options,
+  onChange,
+}: {
+  currentValue: string;
+  options: EuiSelectOption[];
+  onChange: (event: React.ChangeEvent<HTMLSelectElement>) => void;
+}) {
+  return (
+    <PopoverExpression
+      value={getEnvironmentLabel(currentValue)}
+      title={i18n.translate('xpack.apm.alerting.fields.environment', {
+        defaultMessage: 'Environment',
+      })}
+    >
+      <EuiSelect
+        value={currentValue}
+        options={options}
+        onChange={onChange}
+        compressed
+      />
+    </PopoverExpression>
+  );
+}
+
+export function TransactionTypeField({
+  currentValue,
+  options,
+  onChange,
+}: {
+  currentValue: string;
+  options?: EuiSelectOption[];
+  onChange?: (event: React.ChangeEvent<HTMLSelectElement>) => void;
+}) {
+  const label = i18n.translate('xpack.apm.alerting.fields.type', {
+    defaultMessage: 'Type',
+  });
+
+  if (!options || options.length === 1) {
+    return <EuiExpression description={label} value={currentValue} />;
+  }
+
+  return (
+    <PopoverExpression value={currentValue} title={label}>
+      <EuiSelect
+        value={currentValue}
+        options={options}
+        onChange={onChange}
+        compressed
+      />
+    </PopoverExpression>
+  );
+}
+
+export function IsAboveField({
+  value,
+  unit,
+  onChange,
+  step,
+}: {
+  value: number;
+  unit: string;
+  onChange: (value: number) => void;
+  step?: number;
+}) {
+  return (
+    <PopoverExpression
+      value={value ? `${value.toString()}${unit}` : ''}
+      title={i18n.translate(
+        'xpack.apm.transactionErrorRateAlertTrigger.isAbove',
+        { defaultMessage: 'is above' }
+      )}
+    >
+      <EuiFieldNumber
+        value={value ?? ''}
+        onChange={(e) => onChange(parseInt(e.target.value, 10))}
+        append={unit}
+        compressed
+        step={step}
+      />
+    </PopoverExpression>
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts b/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
new file mode 100644
index 0000000000000..c0a1955e2cc8a
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { lazy } from 'react';
+import { AlertType } from '../../../common/alert_types';
+import { ApmPluginStartDeps } from '../../plugin';
+
+export function registerApmAlerts(
+  alertTypeRegistry: ApmPluginStartDeps['triggers_actions_ui']['alertTypeRegistry']
+) {
+  alertTypeRegistry.register({
+    id: AlertType.ErrorCount,
+    name: i18n.translate('xpack.apm.alertTypes.errorCount', {
+      defaultMessage: 'Error count threshold',
+    }),
+    iconClass: 'bell',
+    alertParamsExpression: lazy(() => import('./ErrorCountAlertTrigger')),
+    validate: () => ({
+      errors: [],
+    }),
+    requiresAppContext: true,
+  });
+
+  alertTypeRegistry.register({
+    id: AlertType.TransactionDuration,
+    name: i18n.translate('xpack.apm.alertTypes.transactionDuration', {
+      defaultMessage: 'Transaction duration threshold',
+    }),
+    iconClass: 'bell',
+    alertParamsExpression: lazy(
+      () => import('./TransactionDurationAlertTrigger')
+    ),
+    validate: () => ({
+      errors: [],
+    }),
+    requiresAppContext: true,
+  });
+
+  alertTypeRegistry.register({
+    id: AlertType.TransactionErrorRate,
+    name: i18n.translate('xpack.apm.alertTypes.transactionErrorRate', {
+      defaultMessage: 'Transaction error rate threshold',
+    }),
+    iconClass: 'bell',
+    alertParamsExpression: lazy(
+      () => import('./TransactionErrorRateAlertTrigger')
+    ),
+    validate: () => ({
+      errors: [],
+    }),
+    requiresAppContext: true,
+  });
+
+  alertTypeRegistry.register({
+    id: AlertType.TransactionDurationAnomaly,
+    name: i18n.translate('xpack.apm.alertTypes.transactionDurationAnomaly', {
+      defaultMessage: 'Transaction duration anomaly',
+    }),
+    iconClass: 'bell',
+    alertParamsExpression: lazy(
+      () => import('./TransactionDurationAnomalyAlertTrigger')
+    ),
+    validate: () => ({
+      errors: [],
+    }),
+    requiresAppContext: true,
+  });
+}
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx
index 91ce57c78b993..626c2124d421e 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx
@@ -75,8 +75,9 @@ export function BreakdownFilter({
   const onOptionChange = (value: string) => {
     if (value === NO_BREAKDOWN) {
       onBreakdownChange(null);
+    } else {
+      onBreakdownChange(items.find(({ fieldName }) => fieldName === value)!);
     }
-    onBreakdownChange(items.find(({ fieldName }) => fieldName === value)!);
   };
 
   return (
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageLoadDistChart.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageLoadDistChart.tsx
index c832ec9fcc0d0..79cd1c5753ae5 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageLoadDistChart.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageLoadDistChart.tsx
@@ -18,6 +18,7 @@ import {
   TooltipValueFormatter,
   DARK_THEME,
   LIGHT_THEME,
+  Fit,
 } from '@elastic/charts';
 import {
   EUI_CHARTS_THEME_DARK,
@@ -115,12 +116,14 @@ export function PageLoadDistChart({
             tickFormat={(d) => numeral(d).format('0.0') + '%'}
           />
           <LineSeries
+            fit={Fit.Linear}
             id={'PagesPercentage'}
             name={I18LABELS.overall}
             xScaleType={ScaleType.Linear}
             yScaleType={ScaleType.Linear}
             data={data?.pageLoadDistribution ?? []}
             curve={CurveType.CURVE_CATMULL_ROM}
+            lineSeriesStyle={{ point: { visible: false } }}
           />
           {breakdown && (
             <BreakdownSeries
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/ClientMetrics/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/ClientMetrics/index.tsx
index f54a54211359c..1edfd724dadd7 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/ClientMetrics/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/ClientMetrics/index.tsx
@@ -26,7 +26,8 @@ export function ClientMetrics() {
 
   const { data, status } = useFetcher(
     (callApmApi) => {
-      if (start && end) {
+      const { serviceName } = uiFilters;
+      if (start && end && serviceName) {
         return callApmApi({
           pathname: '/api/apm/rum/client-metrics',
           params: {
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/BreakdownSeries.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/BreakdownSeries.tsx
index 475a235ef5eed..3463327441b7b 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/BreakdownSeries.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/BreakdownSeries.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CurveType, LineSeries, ScaleType } from '@elastic/charts';
+import { CurveType, Fit, LineSeries, ScaleType } from '@elastic/charts';
 import React, { useEffect } from 'react';
 import { PercentileRange } from './index';
 import { useBreakdowns } from './use_breakdowns';
@@ -41,8 +41,10 @@ export function BreakdownSeries({
           name={name}
           xScaleType={ScaleType.Linear}
           yScaleType={ScaleType.Linear}
+          curve={CurveType.CURVE_CATMULL_ROM}
           data={seriesData ?? []}
-          curve={CurveType.CURVE_NATURAL}
+          lineSeriesStyle={{ point: { visible: false } }}
+          fit={Fit.Linear}
         />
       ))}
     </>
diff --git a/x-pack/plugins/apm/public/components/app/ServiceDetails/AlertIntegrations/index.tsx b/x-pack/plugins/apm/public/components/app/ServiceDetails/AlertIntegrations/index.tsx
index 27c4a37e09c00..c11bfdeae945b 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceDetails/AlertIntegrations/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceDetails/AlertIntegrations/index.tsx
@@ -24,9 +24,13 @@ const transactionDurationLabel = i18n.translate(
   'xpack.apm.serviceDetails.alertsMenu.transactionDuration',
   { defaultMessage: 'Transaction duration' }
 );
-const errorRateLabel = i18n.translate(
-  'xpack.apm.serviceDetails.alertsMenu.errorRate',
-  { defaultMessage: 'Error rate' }
+const transactionErrorRateLabel = i18n.translate(
+  'xpack.apm.serviceDetails.alertsMenu.transactionErrorRate',
+  { defaultMessage: 'Transaction error rate' }
+);
+const errorCountLabel = i18n.translate(
+  'xpack.apm.serviceDetails.alertsMenu.errorCount',
+  { defaultMessage: 'Error count' }
 );
 const createThresholdAlertLabel = i18n.translate(
   'xpack.apm.serviceDetails.alertsMenu.createThresholdAlert',
@@ -38,8 +42,10 @@ const createAnomalyAlertAlertLabel = i18n.translate(
 );
 
 const CREATE_TRANSACTION_DURATION_ALERT_PANEL_ID =
-  'create_transaction_duration';
-const CREATE_ERROR_RATE_ALERT_PANEL_ID = 'create_error_rate';
+  'create_transaction_duration_panel';
+const CREATE_TRANSACTION_ERROR_RATE_ALERT_PANEL_ID =
+  'create_transaction_error_rate_panel';
+const CREATE_ERROR_COUNT_ALERT_PANEL_ID = 'create_error_count_panel';
 
 interface Props {
   canReadAlerts: boolean;
@@ -77,7 +83,14 @@ export function AlertIntegrations(props: Props) {
                 name: transactionDurationLabel,
                 panel: CREATE_TRANSACTION_DURATION_ALERT_PANEL_ID,
               },
-              { name: errorRateLabel, panel: CREATE_ERROR_RATE_ALERT_PANEL_ID },
+              {
+                name: transactionErrorRateLabel,
+                panel: CREATE_TRANSACTION_ERROR_RATE_ALERT_PANEL_ID,
+              },
+              {
+                name: errorCountLabel,
+                panel: CREATE_ERROR_COUNT_ALERT_PANEL_ID,
+              },
             ]
           : []),
         ...(canReadAlerts
@@ -96,10 +109,13 @@ export function AlertIntegrations(props: Props) {
           : []),
       ],
     },
+
+    // transaction duration panel
     {
       id: CREATE_TRANSACTION_DURATION_ALERT_PANEL_ID,
       title: transactionDurationLabel,
       items: [
+        // threshold alerts
         {
           name: createThresholdAlertLabel,
           onClick: () => {
@@ -107,6 +123,8 @@ export function AlertIntegrations(props: Props) {
             setPopoverOpen(false);
           },
         },
+
+        // anomaly alerts
         ...(canReadAnomalies
           ? [
               {
@@ -120,14 +138,32 @@ export function AlertIntegrations(props: Props) {
           : []),
       ],
     },
+
+    // transaction error rate panel
+    {
+      id: CREATE_TRANSACTION_ERROR_RATE_ALERT_PANEL_ID,
+      title: transactionErrorRateLabel,
+      items: [
+        // threshold alerts
+        {
+          name: createThresholdAlertLabel,
+          onClick: () => {
+            setAlertType(AlertType.TransactionErrorRate);
+            setPopoverOpen(false);
+          },
+        },
+      ],
+    },
+
+    // error alerts panel
     {
-      id: CREATE_ERROR_RATE_ALERT_PANEL_ID,
-      title: errorRateLabel,
+      id: CREATE_ERROR_COUNT_ALERT_PANEL_ID,
+      title: errorCountLabel,
       items: [
         {
           name: createThresholdAlertLabel,
           onClick: () => {
-            setAlertType(AlertType.ErrorRate);
+            setAlertType(AlertType.ErrorCount);
             setPopoverOpen(false);
           },
         },
diff --git a/x-pack/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.tsx b/x-pack/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.tsx
index aa34515ea460a..45a7fa2a118f2 100644
--- a/x-pack/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.tsx
@@ -7,7 +7,7 @@
 import { EuiPanel, EuiSpacer, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { isEmpty } from 'lodash';
 import React, { useEffect, useState } from 'react';
-import { i18n } from '@kbn/i18n';
+import { INVALID_LICENSE } from '../../../../../../common/custom_link';
 import { CustomLink } from '../../../../../../common/custom_link/custom_link_types';
 import { useLicense } from '../../../../../hooks/useLicense';
 import { useFetcher, FETCH_STATUS } from '../../../../../hooks/useFetcher';
@@ -94,15 +94,7 @@ export function CustomLinkOverview() {
             />
           )
         ) : (
-          <LicensePrompt
-            text={i18n.translate(
-              'xpack.apm.settings.customizeUI.customLink.license.text',
-              {
-                defaultMessage:
-                  "To create custom links, you must be subscribed to an Elastic Gold license or above. With it, you'll have the ability to create custom links to improve your workflow when analyzing your services.",
-              }
-            )}
-          />
+          <LicensePrompt text={INVALID_LICENSE} />
         )}
       </EuiPanel>
     </>
diff --git a/x-pack/plugins/apm/public/components/app/TraceLink/get_redirect_to_trace_page_url.ts b/x-pack/plugins/apm/public/components/app/TraceLink/get_redirect_to_trace_page_url.ts
new file mode 100644
index 0000000000000..4b1ced980010a
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/TraceLink/get_redirect_to_trace_page_url.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { format } from 'url';
+import { TRACE_ID } from '../../../../common/elasticsearch_fieldnames';
+
+export const getRedirectToTracePageUrl = ({
+  traceId,
+  rangeFrom,
+  rangeTo,
+}: {
+  traceId: string;
+  rangeFrom?: string;
+  rangeTo?: string;
+}) =>
+  format({
+    pathname: `/traces`,
+    query: {
+      kuery: encodeURIComponent(`${TRACE_ID} : "${traceId}"`),
+      rangeFrom,
+      rangeTo,
+    },
+  });
diff --git a/x-pack/plugins/apm/public/components/app/TraceLink/get_redirect_to_transaction_detail_page_url.ts b/x-pack/plugins/apm/public/components/app/TraceLink/get_redirect_to_transaction_detail_page_url.ts
new file mode 100644
index 0000000000000..4738622aa9c31
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/TraceLink/get_redirect_to_transaction_detail_page_url.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { format } from 'url';
+import { Transaction } from '../../../../typings/es_schemas/ui/transaction';
+
+export const getRedirectToTransactionDetailPageUrl = ({
+  transaction,
+  rangeFrom,
+  rangeTo,
+}: {
+  transaction: Transaction;
+  rangeFrom?: string;
+  rangeTo?: string;
+}) =>
+  format({
+    pathname: `/services/${transaction.service.name}/transactions/view`,
+    query: {
+      traceId: transaction.trace.id,
+      transactionId: transaction.transaction.id,
+      transactionName: transaction.transaction.name,
+      transactionType: transaction.transaction.type,
+      rangeFrom,
+      rangeTo,
+    },
+  });
diff --git a/x-pack/plugins/apm/public/components/app/TraceLink/index.tsx b/x-pack/plugins/apm/public/components/app/TraceLink/index.tsx
index 584af956c2022..ee3b0a33ebbc2 100644
--- a/x-pack/plugins/apm/public/components/app/TraceLink/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TraceLink/index.tsx
@@ -8,56 +8,16 @@ import { EuiEmptyPrompt } from '@elastic/eui';
 import React from 'react';
 import { Redirect, RouteComponentProps } from 'react-router-dom';
 import styled from 'styled-components';
-import url from 'url';
-import { TRACE_ID } from '../../../../common/elasticsearch_fieldnames';
-import { Transaction } from '../../../../typings/es_schemas/ui/transaction';
 import { FETCH_STATUS, useFetcher } from '../../../hooks/useFetcher';
 import { useUrlParams } from '../../../hooks/useUrlParams';
+import { getRedirectToTransactionDetailPageUrl } from './get_redirect_to_transaction_detail_page_url';
+import { getRedirectToTracePageUrl } from './get_redirect_to_trace_page_url';
 
 const CentralizedContainer = styled.div`
   height: 100%;
   display: flex;
 `;
 
-const redirectToTransactionDetailPage = ({
-  transaction,
-  rangeFrom,
-  rangeTo,
-}: {
-  transaction: Transaction;
-  rangeFrom?: string;
-  rangeTo?: string;
-}) =>
-  url.format({
-    pathname: `/services/${transaction.service.name}/transactions/view`,
-    query: {
-      traceId: transaction.trace.id,
-      transactionId: transaction.transaction.id,
-      transactionName: transaction.transaction.name,
-      transactionType: transaction.transaction.type,
-      rangeFrom,
-      rangeTo,
-    },
-  });
-
-const redirectToTracePage = ({
-  traceId,
-  rangeFrom,
-  rangeTo,
-}: {
-  traceId: string;
-  rangeFrom?: string;
-  rangeTo?: string;
-}) =>
-  url.format({
-    pathname: `/traces`,
-    query: {
-      kuery: encodeURIComponent(`${TRACE_ID} : "${traceId}"`),
-      rangeFrom,
-      rangeTo,
-    },
-  });
-
 export function TraceLink({ match }: RouteComponentProps<{ traceId: string }>) {
   const { traceId } = match.params;
   const { urlParams } = useUrlParams();
@@ -80,12 +40,12 @@ export function TraceLink({ match }: RouteComponentProps<{ traceId: string }>) {
   );
   if (traceId && status === FETCH_STATUS.SUCCESS) {
     const to = data.transaction
-      ? redirectToTransactionDetailPage({
+      ? getRedirectToTransactionDetailPageUrl({
           transaction: data.transaction,
           rangeFrom,
           rangeTo,
         })
-      : redirectToTracePage({ traceId, rangeFrom, rangeTo });
+      : getRedirectToTracePageUrl({ traceId, rangeFrom, rangeTo });
     return <Redirect to={to} />;
   }
 
diff --git a/x-pack/plugins/apm/public/components/app/TraceOverview/TraceList.tsx b/x-pack/plugins/apm/public/components/app/TraceOverview/TraceList.tsx
index f54255ec0cd18..cf2fe006f67d2 100644
--- a/x-pack/plugins/apm/public/components/app/TraceOverview/TraceList.tsx
+++ b/x-pack/plugins/apm/public/components/app/TraceOverview/TraceList.tsx
@@ -14,9 +14,9 @@ import { fontSizes, truncate } from '../../../style/variables';
 import { asMillisecondDuration } from '../../../utils/formatters';
 import { EmptyMessage } from '../../shared/EmptyMessage';
 import { ImpactBar } from '../../shared/ImpactBar';
-import { TransactionDetailLink } from '../../shared/Links/apm/TransactionDetailLink';
 import { ITableColumn, ManagedTable } from '../../shared/ManagedTable';
 import { LoadingStatePrompt } from '../../shared/LoadingStatePrompt';
+import { TransactionDetailLink } from '../../shared/Links/apm/TransactionDetailLink';
 
 const StyledTransactionLink = styled(TransactionDetailLink)`
   font-size: ${fontSizes.large};
@@ -36,22 +36,23 @@ const traceListColumns: Array<ITableColumn<TransactionGroup>> = [
     }),
     width: '40%',
     sortable: true,
-    render: (_: string, { sample }: TransactionGroup) => (
-      <EuiToolTip content={sample.transaction.name}>
+    render: (
+      _: string,
+      { serviceName, transactionName, transactionType }: TransactionGroup
+    ) => (
+      <EuiToolTip content={transactionName}>
         <StyledTransactionLink
-          serviceName={sample.service.name}
-          transactionId={sample.transaction.id}
-          traceId={sample.trace.id}
-          transactionName={sample.transaction.name}
-          transactionType={sample.transaction.type}
+          serviceName={serviceName}
+          transactionName={transactionName}
+          transactionType={transactionType}
         >
-          {sample.transaction.name}
+          {transactionName}
         </StyledTransactionLink>
       </EuiToolTip>
     ),
   },
   {
-    field: 'sample.service.name',
+    field: 'serviceName',
     name: i18n.translate(
       'xpack.apm.tracesTable.originatingServiceColumnLabel',
       {
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/__test__/distribution.test.ts b/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/__test__/distribution.test.ts
index 488dba00f96f5..d944e3fa6db7c 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/__test__/distribution.test.ts
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/__test__/distribution.test.ts
@@ -34,30 +34,20 @@ describe('Distribution', () => {
       },
     ] as IBucket[];
     expect(getFormattedBuckets(buckets, 20)).toEqual([
-      { x: 20, x0: 0, y: 0, style: { cursor: 'default' }, samples: [] },
-      { x: 40, x0: 20, y: 0, style: { cursor: 'default' }, samples: [] },
-      { x: 60, x0: 40, y: 0, style: { cursor: 'default' }, samples: [] },
+      { x: 20, x0: 0, y: 0, style: { cursor: 'default' } },
+      { x: 40, x0: 20, y: 0, style: { cursor: 'default' } },
+      { x: 60, x0: 40, y: 0, style: { cursor: 'default' } },
       {
         x: 80,
         x0: 60,
         y: 5,
         style: { cursor: 'pointer' },
-        samples: [
-          {
-            transactionId: 'someTransactionId',
-          },
-        ],
       },
       {
         x: 100,
         x0: 80,
         y: 100,
         style: { cursor: 'pointer' },
-        samples: [
-          {
-            transactionId: 'anotherTransactionId',
-          },
-        ],
       },
     ]);
   });
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/index.tsx
index 069c4468d206b..fa5a9956c8287 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/index.tsx
@@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n';
 import d3 from 'd3';
 import { isEmpty } from 'lodash';
 import React, { useCallback } from 'react';
-import { useHistory } from 'react-router-dom';
+import { ValuesType } from 'utility-types';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { TransactionDistributionAPIResponse } from '../../../../../server/lib/transactions/distribution';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
@@ -19,11 +19,9 @@ import { getDurationFormatter } from '../../../../utils/formatters';
 // @ts-expect-error
 import Histogram from '../../../shared/charts/Histogram';
 import { EmptyMessage } from '../../../shared/EmptyMessage';
-import { fromQuery, toQuery } from '../../../shared/Links/url_helpers';
 import { LoadingStatePrompt } from '../../../shared/LoadingStatePrompt';
 
 interface IChartPoint {
-  samples: IBucket['samples'];
   x0: number;
   x: number;
   y: number;
@@ -40,7 +38,6 @@ export function getFormattedBuckets(buckets: IBucket[], bucketSize: number) {
   return buckets.map(
     ({ samples, count, key }): IChartPoint => {
       return {
-        samples,
         x0: key,
         x: key + bucketSize,
         y: count,
@@ -97,6 +94,9 @@ interface Props {
   urlParams: IUrlParams;
   isLoading: boolean;
   bucketIndex: number;
+  onBucketClick: (
+    bucket: ValuesType<TransactionDistributionAPIResponse['buckets']>
+  ) => void;
 }
 
 export function TransactionDistribution(props: Props) {
@@ -105,8 +105,8 @@ export function TransactionDistribution(props: Props) {
     urlParams: { transactionType },
     isLoading,
     bucketIndex,
+    onBucketClick,
   } = props;
-  const history = useHistory();
 
   /* eslint-disable-next-line react-hooks/exhaustive-deps */
   const formatYShort = useCallback(getFormatYShort(transactionType), [
@@ -134,6 +134,14 @@ export function TransactionDistribution(props: Props) {
     );
   }
 
+  function getBucketFromChartPoint(chartPoint: IChartPoint) {
+    const clickedBucket = distribution?.buckets.find((bucket) => {
+      return bucket.key === chartPoint.x0;
+    });
+
+    return clickedBucket;
+  }
+
   const buckets = getFormattedBuckets(
     distribution.buckets,
     distribution.bucketSize
@@ -175,31 +183,29 @@ export function TransactionDistribution(props: Props) {
         buckets={buckets}
         bucketSize={distribution.bucketSize}
         bucketIndex={bucketIndex}
-        onClick={(bucket: IChartPoint) => {
-          if (!isEmpty(bucket.samples)) {
-            const sample = bucket.samples[0];
-            history.push({
-              ...history.location,
-              search: fromQuery({
-                ...toQuery(history.location.search),
-                transactionId: sample.transactionId,
-                traceId: sample.traceId,
-              }),
-            });
+        onClick={(chartPoint: IChartPoint) => {
+          const clickedBucket = getBucketFromChartPoint(chartPoint);
+
+          if (clickedBucket) {
+            onBucketClick(clickedBucket);
           }
         }}
         formatX={(time: number) => timeFormatter(time).formatted}
         formatYShort={formatYShort}
         formatYLong={formatYLong}
-        verticalLineHover={(bucket: IChartPoint) => isEmpty(bucket.samples)}
-        backgroundHover={(bucket: IChartPoint) => !isEmpty(bucket.samples)}
-        tooltipHeader={(bucket: IChartPoint) => {
-          const xFormatted = timeFormatter(bucket.x);
-          const x0Formatted = timeFormatter(bucket.x0);
+        verticalLineHover={(point: IChartPoint) =>
+          isEmpty(getBucketFromChartPoint(point)?.samples)
+        }
+        backgroundHover={(point: IChartPoint) =>
+          !isEmpty(getBucketFromChartPoint(point)?.samples)
+        }
+        tooltipHeader={(point: IChartPoint) => {
+          const xFormatted = timeFormatter(point.x);
+          const x0Formatted = timeFormatter(point.x0);
           return `${x0Formatted.value} - ${xFormatted.value} ${xFormatted.unit}`;
         }}
-        tooltipFooter={(bucket: IChartPoint) =>
-          isEmpty(bucket.samples) &&
+        tooltipFooter={(point: IChartPoint) =>
+          isEmpty(getBucketFromChartPoint(point)?.samples) &&
           i18n.translate(
             'xpack.apm.transactionDetails.transactionsDurationDistributionChart.noSampleTooltip',
             {
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/index.tsx
index d166656db0672..3bf4807877428 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/index.tsx
@@ -132,7 +132,7 @@ export function Waterfall({
           <div style={{ display: 'flex' }}>
             <EuiButtonEmpty
               style={{ zIndex: 3, position: 'absolute' }}
-              iconType={isAccordionOpen ? 'arrowDown' : 'arrowRight'}
+              iconType={isAccordionOpen ? 'fold' : 'unfold'}
               onClick={() => {
                 setIsAccordionOpen((isOpen) => !isOpen);
               }}
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionDetails/index.tsx
index 614089c0457ac..e31a2b24f1d15 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/index.tsx
@@ -13,21 +13,29 @@ import {
   EuiTitle,
 } from '@elastic/eui';
 import React, { useMemo } from 'react';
+import { isEmpty, flatten } from 'lodash';
+import { useHistory } from 'react-router-dom';
 import { RouteComponentProps } from 'react-router-dom';
-import { useTrackPageview } from '../../../../../observability/public';
-import { Projection } from '../../../../common/projections';
-import { ChartsSyncContextProvider } from '../../../context/ChartsSyncContext';
-import { FETCH_STATUS } from '../../../hooks/useFetcher';
 import { useTransactionCharts } from '../../../hooks/useTransactionCharts';
 import { useTransactionDistribution } from '../../../hooks/useTransactionDistribution';
-import { useUrlParams } from '../../../hooks/useUrlParams';
 import { useWaterfall } from '../../../hooks/useWaterfall';
 import { ApmHeader } from '../../shared/ApmHeader';
 import { TransactionCharts } from '../../shared/charts/TransactionCharts';
-import { HeightRetainer } from '../../shared/HeightRetainer';
-import { LocalUIFilters } from '../../shared/LocalUIFilters';
 import { TransactionDistribution } from './Distribution';
 import { WaterfallWithSummmary } from './WaterfallWithSummmary';
+import { FETCH_STATUS } from '../../../hooks/useFetcher';
+import { ChartsSyncContextProvider } from '../../../context/ChartsSyncContext';
+import { useTrackPageview } from '../../../../../observability/public';
+import { Projection } from '../../../../common/projections';
+import { fromQuery, toQuery } from '../../shared/Links/url_helpers';
+import { useUrlParams } from '../../../hooks/useUrlParams';
+import { LocalUIFilters } from '../../shared/LocalUIFilters';
+import { HeightRetainer } from '../../shared/HeightRetainer';
+
+interface Sample {
+  traceId: string;
+  transactionId: string;
+}
 
 type TransactionDetailsProps = RouteComponentProps<{ serviceName: string }>;
 
@@ -37,6 +45,7 @@ export function TransactionDetails({
 }: TransactionDetailsProps) {
   const { serviceName } = match.params;
   const { urlParams } = useUrlParams();
+  const history = useHistory();
   const {
     data: distributionData,
     status: distributionStatus,
@@ -64,15 +73,35 @@ export function TransactionDetails({
     return config;
   }, [transactionName, transactionType, serviceName]);
 
-  const bucketIndex = distributionData.buckets.findIndex((bucket) =>
-    bucket.samples.some(
-      (sample) =>
-        sample.transactionId === urlParams.transactionId &&
-        sample.traceId === urlParams.traceId
-    )
+  const selectedSample = flatten(
+    distributionData.buckets.map((bucket) => bucket.samples)
+  ).find(
+    (sample) =>
+      sample.transactionId === urlParams.transactionId &&
+      sample.traceId === urlParams.traceId
   );
 
-  const traceSamples = distributionData.buckets[bucketIndex]?.samples;
+  const bucketWithSample =
+    selectedSample &&
+    distributionData.buckets.find((bucket) =>
+      bucket.samples.includes(selectedSample)
+    );
+
+  const traceSamples = bucketWithSample?.samples ?? [];
+  const bucketIndex = bucketWithSample
+    ? distributionData.buckets.indexOf(bucketWithSample)
+    : -1;
+
+  const selectSampleFromBucketClick = (sample: Sample) => {
+    history.push({
+      ...history.location,
+      search: fromQuery({
+        ...toQuery(history.location.search),
+        transactionId: sample.transactionId,
+        traceId: sample.traceId,
+      }),
+    });
+  };
 
   return (
     <div>
@@ -102,6 +131,11 @@ export function TransactionDetails({
               isLoading={distributionStatus === FETCH_STATUS.LOADING}
               urlParams={urlParams}
               bucketIndex={bucketIndex}
+              onBucketClick={(bucket) => {
+                if (!isEmpty(bucket.samples)) {
+                  selectSampleFromBucketClick(bucket.samples[0]);
+                }
+              }}
             />
           </EuiPanel>
 
diff --git a/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/TransactionList.stories.tsx b/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/TransactionList.stories.tsx
index bc9df71c534ef..a65589bdd147f 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/TransactionList.stories.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/TransactionList.stories.tsx
@@ -15,102 +15,19 @@ storiesOf('app/TransactionOverview/TransactionList', module).add(
   () => {
     const items: TransactionGroup[] = [
       {
-        name:
-          'GET /api/v1/regions/azure-eastus2/clusters/elasticsearch/xc18de071deb4262be54baebf5f6a1ce/proxy/_snapshot/found-snapshots/_all',
-        sample: {
-          container: {
-            id:
-              'xa802046074071c9c828e8db3b7ef92ea0484d9fe783b9c518f65a7b45dfdd2c',
-          },
-          agent: {
-            name: 'java',
-            ephemeral_id: 'x787d6b7-3241-4b55-ba49-0c96bc9857d1',
-            version: '1.17.0',
-          },
-          process: {
-            pid: 28,
-            title: '/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java',
-          },
-          processor: {
-            name: 'transaction',
-            event: 'transaction',
-          },
-          labels: {
-            path:
-              '/api/v1/regions/azure-eastus2/clusters/elasticsearch/xc18de071deb4262be54baebf5f6a1ce/proxy/_snapshot/found-snapshots/_all',
-            status_code: '200',
-            request_method: 'GET',
-            request_id: 'x273dc2477e021979125e0ec67e8d778',
-          },
-          observer: {
-            hostname: 'x840922c967b',
-            name: 'instance-000000000x',
-            id: 'xb384baf-c16a-415a-928a-a10635a04b81',
-            ephemeral_id: 'x9227f0e-848d-423e-a65a-5fdee321f4a9',
-            type: 'apm-server',
-            version: '7.8.1',
-            version_major: 7,
-          },
-          trace: {
-            id: 'x998d7e5db84aa8341b358a264a78984',
-          },
-          '@timestamp': '2020-08-26T14:40:31.472Z',
-          ecs: {
-            version: '1.5.0',
-          },
-          service: {
-            node: {
-              name:
-                'xa802046074071c9c828e8db3b7ef92ea0484d9fe783b9c518f65a7b45dfdd2c',
-            },
-            environment: 'qa',
-            framework: {
-              name: 'API',
-            },
-            name: 'adminconsole',
-            runtime: {
-              name: 'Java',
-              version: '1.8.0_265',
-            },
-            language: {
-              name: 'Java',
-              version: '1.8.0_265',
-            },
-            version: 'ms-44.1-BC_1',
-          },
-          host: {
-            hostname: 'xa8020460740',
-            os: {
-              platform: 'Linux',
-            },
-            ip: '3.83.239.24',
-            name: 'xa8020460740',
-            architecture: 'amd64',
-          },
-          transaction: {
-            duration: {
-              us: 8260617,
-            },
-            result: 'HTTP 2xx',
-            name:
-              'GET /api/v1/regions/azure-eastus2/clusters/elasticsearch/xc18de071deb4262be54baebf5f6a1ce/proxy/_snapshot/found-snapshots/_all',
-            span_count: {
-              dropped: 0,
-              started: 8,
-            },
-            id: 'xaa3cae6fd4f7023',
-            type: 'request',
-            sampled: true,
-          },
-          timestamp: {
-            us: 1598452831472001,
-          },
+        key: {
+          ['service.name']: 'adminconsole',
+          ['transaction.name']:
+            'GET /api/v1/regions/azure-eastus2/clusters/elasticsearch/xc18de071deb4262be54baebf5f6a1ce/proxy/_snapshot/found-snapshots/_all',
         },
+        transactionName:
+          'GET /api/v1/regions/azure-eastus2/clusters/elasticsearch/xc18de071deb4262be54baebf5f6a1ce/proxy/_snapshot/found-snapshots/_all',
+        serviceName: 'adminconsole',
+        transactionType: 'request',
         p95: 11974156,
         averageResponseTime: 8087434.558974359,
         transactionsPerMinute: 0.40625,
         impact: 100,
-        impactRelative: 100,
       },
     ];
 
diff --git a/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/index.tsx
index d8c6d7d28fa9f..68f9c240f1562 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/index.tsx
@@ -8,7 +8,6 @@ import { EuiToolTip, EuiIconTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
-import { NOT_AVAILABLE_LABEL } from '../../../../../common/i18n';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { TransactionGroup } from '../../../../../server/lib/transaction_groups/fetcher';
 import { fontFamilyCode, truncate } from '../../../../style/variables';
@@ -46,20 +45,21 @@ export function TransactionList({ items, isLoading }: Props) {
         }),
         width: '50%',
         sortable: true,
-        render: (_, { sample }: TransactionGroup) => {
+        render: (
+          _,
+          { serviceName, transactionName, transactionType }: TransactionGroup
+        ) => {
           return (
             <TransactionNameLink
-              serviceName={sample.service.name}
-              transactionId={sample.transaction.id}
-              traceId={sample.trace.id}
-              transactionName={sample.transaction.name}
-              transactionType={sample.transaction.type}
+              serviceName={serviceName}
+              transactionName={transactionName}
+              transactionType={transactionType}
             >
               <EuiToolTip
                 id="transaction-name-link-tooltip"
-                content={sample.transaction.name || NOT_AVAILABLE_LABEL}
+                content={transactionName}
               >
-                <>{sample.transaction.name || NOT_AVAILABLE_LABEL}</>
+                <>{transactionName}</>
               </EuiToolTip>
             </TransactionNameLink>
           );
diff --git a/x-pack/plugins/apm/public/components/shared/Links/apm/TransactionDetailLink.tsx b/x-pack/plugins/apm/public/components/shared/Links/apm/TransactionDetailLink.tsx
index 2ca3dce5da9ce..c9b26b557512c 100644
--- a/x-pack/plugins/apm/public/components/shared/Links/apm/TransactionDetailLink.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Links/apm/TransactionDetailLink.tsx
@@ -11,8 +11,8 @@ import { pickKeys } from '../../../../../common/utils/pick_keys';
 
 interface Props extends APMLinkExtendProps {
   serviceName: string;
-  traceId: string;
-  transactionId: string;
+  traceId?: string;
+  transactionId?: string;
   transactionName: string;
   transactionType: string;
 }
diff --git a/x-pack/plugins/apm/public/components/shared/LocalUIFilters/ServiceNameFilter/index.tsx b/x-pack/plugins/apm/public/components/shared/LocalUIFilters/ServiceNameFilter/index.tsx
index 3deba69a25df2..cbf9ba009dce2 100644
--- a/x-pack/plugins/apm/public/components/shared/LocalUIFilters/ServiceNameFilter/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/LocalUIFilters/ServiceNameFilter/index.tsx
@@ -24,7 +24,7 @@ interface Props {
 function ServiceNameFilter({ loading, serviceNames }: Props) {
   const history = useHistory();
   const {
-    urlParams: { serviceName },
+    urlParams: { serviceName: selectedServiceName },
   } = useUrlParams();
 
   const options = serviceNames.map((type) => ({
@@ -47,10 +47,22 @@ function ServiceNameFilter({ loading, serviceNames }: Props) {
   );
 
   useEffect(() => {
-    if (!serviceName && serviceNames.length > 0) {
-      updateServiceName(serviceNames[0]);
+    if (serviceNames?.length > 0) {
+      // select first from the list
+      if (!selectedServiceName) {
+        updateServiceName(serviceNames[0]);
+      }
+
+      // in case serviceName is cached from url and isn't present in current list
+      if (selectedServiceName && !serviceNames.includes(selectedServiceName)) {
+        updateServiceName(serviceNames[0]);
+      }
+    }
+
+    if (selectedServiceName && serviceNames.length === 0 && !loading) {
+      updateServiceName('');
     }
-  }, [serviceNames, serviceName, updateServiceName]);
+  }, [serviceNames, selectedServiceName, updateServiceName, loading]);
 
   return (
     <>
@@ -68,7 +80,7 @@ function ServiceNameFilter({ loading, serviceNames }: Props) {
         isLoading={loading}
         data-cy="serviceNameFilter"
         options={options}
-        value={serviceName}
+        value={selectedServiceName}
         compressed={true}
         onChange={(event) => {
           updateServiceName(event.target.value);
diff --git a/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/Stackframe.test.tsx b/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/Stackframe.test.tsx
index c502237235578..589b2dd27fbc4 100644
--- a/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/Stackframe.test.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/Stackframe.test.tsx
@@ -11,6 +11,12 @@ import { mountWithTheme } from '../../../../utils/testHelpers';
 import { Stackframe as StackframeComponent } from '../Stackframe';
 import stacktracesMock from './stacktraces.json';
 
+jest.mock('@elastic/eui/lib/services/accessibility/html_id_generator', () => {
+  return {
+    htmlIdGenerator: () => () => `generated-id`,
+  };
+});
+
 describe('Stackframe', () => {
   describe('when stackframe has source lines', () => {
     let wrapper: ReactWrapper;
diff --git a/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/__snapshots__/Stackframe.test.tsx.snap b/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/__snapshots__/Stackframe.test.tsx.snap
index f87cc62d7809d..a5f8c40876540 100644
--- a/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/__snapshots__/Stackframe.test.tsx.snap
+++ b/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/__snapshots__/Stackframe.test.tsx.snap
@@ -177,6 +177,7 @@ exports[`Stackframe when stackframe has source lines should render correctly 1`]
           aria-controls="test"
           aria-expanded={false}
           className="euiAccordion__button"
+          id="generated-id"
           onClick={[Function]}
           type="button"
         >
diff --git a/x-pack/plugins/apm/public/components/shared/charts/ErroneousTransactionsRateChart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/ErroneousTransactionsRateChart/index.tsx
index 85d975870d9bc..e806f556347f1 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/ErroneousTransactionsRateChart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/ErroneousTransactionsRateChart/index.tsx
@@ -70,6 +70,7 @@ export function ErroneousTransactionsRateChart() {
       <CustomPlot
         {...syncedChartsProps}
         noHits={data?.noHits}
+        yMax={1}
         series={[
           {
             color: theme.euiColorVis7,
diff --git a/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/Histogram.test.js b/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/Histogram.test.js
index ebb10f6676c55..be0716ba748dd 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/Histogram.test.js
+++ b/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/Histogram.test.js
@@ -108,11 +108,6 @@ describe('Histogram', () => {
 
     it('should call onClick with bucket', () => {
       expect(onClick).toHaveBeenCalledWith({
-        samples: [
-          {
-            transactionId: '99c50a5b-44b4-4289-a3d1-a2815d128192',
-          },
-        ],
         style: { cursor: 'pointer' },
         xCenter: 869010,
         x0: 811076,
diff --git a/x-pack/plugins/apm/public/hooks/useTransactionDistribution.ts b/x-pack/plugins/apm/public/hooks/useTransactionDistribution.ts
index d93a27df1c861..65482c9d21c16 100644
--- a/x-pack/plugins/apm/public/hooks/useTransactionDistribution.ts
+++ b/x-pack/plugins/apm/public/hooks/useTransactionDistribution.ts
@@ -4,12 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { useParams } from 'react-router-dom';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { TransactionDistributionAPIResponse } from '../../server/lib/transactions/distribution';
-import { useUiFilters } from '../context/UrlParamsContext';
+import { flatten, omit } from 'lodash';
+import { useHistory, useParams } from 'react-router-dom';
 import { IUrlParams } from '../context/UrlParamsContext/types';
 import { useFetcher } from './useFetcher';
+import { useUiFilters } from '../context/UrlParamsContext';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { TransactionDistributionAPIResponse } from '../../server/lib/transactions/distribution';
+import { toQuery, fromQuery } from '../components/shared/Links/url_helpers';
+import { maybe } from '../../common/utils/maybe';
 
 const INITIAL_DATA = {
   buckets: [] as TransactionDistributionAPIResponse['buckets'],
@@ -29,10 +32,12 @@ export function useTransactionDistribution(urlParams: IUrlParams) {
   } = urlParams;
   const uiFilters = useUiFilters(urlParams);
 
+  const history = useHistory();
+
   const { data = INITIAL_DATA, status, error } = useFetcher(
-    (callApmApi) => {
+    async (callApmApi) => {
       if (serviceName && start && end && transactionType && transactionName) {
-        return callApmApi({
+        const response = await callApmApi({
           pathname:
             '/api/apm/services/{serviceName}/transaction_groups/distribution',
           params: {
@@ -50,6 +55,39 @@ export function useTransactionDistribution(urlParams: IUrlParams) {
             },
           },
         });
+
+        const selectedSample =
+          transactionId && traceId
+            ? flatten(response.buckets.map((bucket) => bucket.samples)).find(
+                (sample) =>
+                  sample.transactionId === transactionId &&
+                  sample.traceId === traceId
+              )
+            : undefined;
+
+        if (!selectedSample) {
+          // selected sample was not found. select a new one:
+          // sorted by total number of requests, but only pick
+          // from buckets that have samples
+          const preferredSample = maybe(
+            response.buckets
+              .filter((bucket) => bucket.samples.length > 0)
+              .sort((bucket) => bucket.count)[0]?.samples[0]
+          );
+
+          history.push({
+            ...history.location,
+            search: fromQuery({
+              ...omit(toQuery(history.location.search), [
+                'traceId',
+                'transactionId',
+              ]),
+              ...preferredSample,
+            }),
+          });
+        }
+
+        return response;
       }
     },
     // the histogram should not be refetched if the transactionId or traceId changes
diff --git a/x-pack/plugins/apm/public/plugin.ts b/x-pack/plugins/apm/public/plugin.ts
index 51ac6673251fb..ab3f1026a92dd 100644
--- a/x-pack/plugins/apm/public/plugin.ts
+++ b/x-pack/plugins/apm/public/plugin.ts
@@ -4,8 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { i18n } from '@kbn/i18n';
-import { lazy } from 'react';
 import { ConfigSchema } from '.';
 import {
   FetchDataParams,
@@ -34,10 +32,10 @@ import {
   TriggersAndActionsUIPublicPluginSetup,
   TriggersAndActionsUIPublicPluginStart,
 } from '../../triggers_actions_ui/public';
-import { AlertType } from '../common/alert_types';
 import { featureCatalogueEntry } from './featureCatalogueEntry';
 import { toggleAppLinkInNav } from './toggleAppLinkInNav';
 import { EmbeddableStart } from '../../../../src/plugins/embeddable/public';
+import { registerApmAlerts } from './components/alerting/register_apm_alerts';
 
 export type ApmPluginSetup = void;
 export type ApmPluginStart = void;
@@ -147,51 +145,6 @@ export class ApmPlugin implements Plugin<ApmPluginSetup, ApmPluginStart> {
   }
   public start(core: CoreStart, plugins: ApmPluginStartDeps) {
     toggleAppLinkInNav(core, this.initializerContext.config.get());
-
-    plugins.triggers_actions_ui.alertTypeRegistry.register({
-      id: AlertType.ErrorRate,
-      name: i18n.translate('xpack.apm.alertTypes.errorRate', {
-        defaultMessage: 'Error rate',
-      }),
-      iconClass: 'bell',
-      alertParamsExpression: lazy(
-        () => import('./components/shared/ErrorRateAlertTrigger')
-      ),
-      validate: () => ({
-        errors: [],
-      }),
-      requiresAppContext: true,
-    });
-
-    plugins.triggers_actions_ui.alertTypeRegistry.register({
-      id: AlertType.TransactionDuration,
-      name: i18n.translate('xpack.apm.alertTypes.transactionDuration', {
-        defaultMessage: 'Transaction duration',
-      }),
-      iconClass: 'bell',
-      alertParamsExpression: lazy(
-        () => import('./components/shared/TransactionDurationAlertTrigger')
-      ),
-      validate: () => ({
-        errors: [],
-      }),
-      requiresAppContext: true,
-    });
-
-    plugins.triggers_actions_ui.alertTypeRegistry.register({
-      id: AlertType.TransactionDurationAnomaly,
-      name: i18n.translate('xpack.apm.alertTypes.transactionDurationAnomaly', {
-        defaultMessage: 'Transaction duration anomaly',
-      }),
-      iconClass: 'bell',
-      alertParamsExpression: lazy(
-        () =>
-          import('./components/shared/TransactionDurationAnomalyAlertTrigger')
-      ),
-      validate: () => ({
-        errors: [],
-      }),
-      requiresAppContext: true,
-    });
+    registerApmAlerts(plugins.triggers_actions_ui.alertTypeRegistry);
   }
 }
diff --git a/x-pack/plugins/apm/scripts/optimize-tsconfig/optimize.js b/x-pack/plugins/apm/scripts/optimize-tsconfig/optimize.js
index f6f64db164f9a..1de98515e1aac 100644
--- a/x-pack/plugins/apm/scripts/optimize-tsconfig/optimize.js
+++ b/x-pack/plugins/apm/scripts/optimize-tsconfig/optimize.js
@@ -11,6 +11,7 @@ const { promisify } = require('util');
 const path = require('path');
 const json5 = require('json5');
 const execa = require('execa');
+const { omit } = require('lodash');
 
 const readFile = promisify(fs.readFile);
 const writeFile = promisify(fs.writeFile);
@@ -27,6 +28,7 @@ function prepareParentTsConfigs() {
   return Promise.all(
     [
       path.resolve(xpackRoot, 'tsconfig.json'),
+      path.resolve(kibanaRoot, 'tsconfig.base.json'),
       path.resolve(kibanaRoot, 'tsconfig.json'),
     ].map(async (filename) => {
       const config = json5.parse(await readFile(filename, 'utf-8'));
@@ -35,7 +37,11 @@ function prepareParentTsConfigs() {
         filename,
         JSON.stringify(
           {
-            ...config,
+            ...omit(config, 'references'),
+            compilerOptions: {
+              ...config.compilerOptions,
+              incremental: false,
+            },
             include: [],
           },
           null,
diff --git a/x-pack/plugins/apm/scripts/optimize-tsconfig/paths.js b/x-pack/plugins/apm/scripts/optimize-tsconfig/paths.js
index c75e16f74b932..b32bb9b20796e 100644
--- a/x-pack/plugins/apm/scripts/optimize-tsconfig/paths.js
+++ b/x-pack/plugins/apm/scripts/optimize-tsconfig/paths.js
@@ -13,6 +13,7 @@ const tsconfigTpl = path.resolve(__dirname, './tsconfig.json');
 const filesToIgnore = [
   path.resolve(xpackRoot, 'tsconfig.json'),
   path.resolve(kibanaRoot, 'tsconfig.json'),
+  path.resolve(kibanaRoot, 'tsconfig.base.json'),
 ];
 
 module.exports = {
diff --git a/x-pack/plugins/apm/server/feature.ts b/x-pack/plugins/apm/server/feature.ts
index 0f6061653f352..1cda70a140c67 100644
--- a/x-pack/plugins/apm/server/feature.ts
+++ b/x-pack/plugins/apm/server/feature.ts
@@ -5,7 +5,12 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { LicenseType } from '../../licensing/common/types';
 import { AlertType } from '../common/alert_types';
+import {
+  LicensingPluginSetup,
+  LicensingRequestHandlerContext,
+} from '../../licensing/server';
 
 export const APM_FEATURE = {
   id: 'apm',
@@ -58,5 +63,43 @@ export const APM_FEATURE = {
   },
 };
 
-export const APM_SERVICE_MAPS_FEATURE_NAME = 'APM service maps';
-export const APM_SERVICE_MAPS_LICENSE_TYPE = 'platinum';
+interface Feature {
+  name: string;
+  license: LicenseType;
+}
+type FeatureName = 'serviceMaps' | 'ml' | 'customLinks';
+export const features: Record<FeatureName, Feature> = {
+  serviceMaps: {
+    name: 'APM service maps',
+    license: 'platinum',
+  },
+  ml: {
+    name: 'APM machine learning',
+    license: 'platinum',
+  },
+  customLinks: {
+    name: 'APM custom links',
+    license: 'gold',
+  },
+};
+
+export function registerFeaturesUsage({
+  licensingPlugin,
+}: {
+  licensingPlugin: LicensingPluginSetup;
+}) {
+  Object.values(features).forEach(({ name, license }) => {
+    licensingPlugin.featureUsage.register(name, license);
+  });
+}
+
+export function notifyFeatureUsage({
+  licensingPlugin,
+  featureName,
+}: {
+  licensingPlugin: LicensingRequestHandlerContext;
+  featureName: FeatureName;
+}) {
+  const feature = features[featureName];
+  licensingPlugin.featureUsage.notifyUsage(feature.name);
+}
diff --git a/x-pack/plugins/apm/server/index.ts b/x-pack/plugins/apm/server/index.ts
index 29b2a77df348e..090110b0454c0 100644
--- a/x-pack/plugins/apm/server/index.ts
+++ b/x-pack/plugins/apm/server/index.ts
@@ -8,6 +8,7 @@ import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginInitializerContext } from 'src/core/server';
 import { APMOSSConfig } from 'src/plugins/apm_oss/server';
 import { APMPlugin } from './plugin';
+import { SearchAggregatedTransactionSetting } from '../common/aggregated_transactions';
 
 export const config = {
   exposeToBrowser: {
@@ -30,6 +31,16 @@ export const config = {
       transactionGroupBucketSize: schema.number({ defaultValue: 1000 }),
       maxTraceItems: schema.number({ defaultValue: 1000 }),
     }),
+    searchAggregatedTransactions: schema.oneOf(
+      [
+        schema.literal(SearchAggregatedTransactionSetting.auto),
+        schema.literal(SearchAggregatedTransactionSetting.always),
+        schema.literal(SearchAggregatedTransactionSetting.never),
+      ],
+      {
+        defaultValue: SearchAggregatedTransactionSetting.never,
+      }
+    ),
     telemetryCollectionEnabled: schema.boolean({ defaultValue: true }),
     metricsInterval: schema.number({ defaultValue: 30 }),
   }),
@@ -69,6 +80,8 @@ export function mergeConfigs(
     'xpack.apm.autocreateApmIndexPattern': apmConfig.autocreateApmIndexPattern,
     'xpack.apm.telemetryCollectionEnabled':
       apmConfig.telemetryCollectionEnabled,
+    'xpack.apm.searchAggregatedTransactions':
+      apmConfig.searchAggregatedTransactions,
     'xpack.apm.metricsInterval': apmConfig.metricsInterval,
   };
 }
diff --git a/x-pack/plugins/apm/server/lib/alerts/action_variables.ts b/x-pack/plugins/apm/server/lib/alerts/action_variables.ts
new file mode 100644
index 0000000000000..f2558da3a30e4
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/alerts/action_variables.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const apmActionVariables = {
+  serviceName: {
+    description: i18n.translate(
+      'xpack.apm.alerts.action_variables.serviceName',
+      { defaultMessage: 'The service the alert is created for' }
+    ),
+    name: 'serviceName',
+  },
+  transactionType: {
+    description: i18n.translate(
+      'xpack.apm.alerts.action_variables.transactionType',
+      { defaultMessage: 'The transaction type the alert is created for' }
+    ),
+    name: 'transactionType',
+  },
+  environment: {
+    description: i18n.translate(
+      'xpack.apm.alerts.action_variables.environment',
+      { defaultMessage: 'The transaction type the alert is created for' }
+    ),
+    name: 'environment',
+  },
+  threshold: {
+    description: i18n.translate('xpack.apm.alerts.action_variables.threshold', {
+      defaultMessage:
+        'Any trigger value above this value will cause the alert to fire',
+    }),
+    name: 'threshold',
+  },
+  triggerValue: {
+    description: i18n.translate(
+      'xpack.apm.alerts.action_variables.triggerValue',
+      {
+        defaultMessage:
+          'The value that breached the threshold and triggered the alert',
+      }
+    ),
+    name: 'triggerValue',
+  },
+};
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts b/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts
index 44ca80143bcd9..fcbb4cc5950e0 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts
@@ -9,9 +9,10 @@ import { AlertingPlugin } from '../../../../alerts/server';
 import { ActionsPlugin } from '../../../../actions/server';
 import { registerTransactionDurationAlertType } from './register_transaction_duration_alert_type';
 import { registerTransactionDurationAnomalyAlertType } from './register_transaction_duration_anomaly_alert_type';
-import { registerErrorRateAlertType } from './register_error_rate_alert_type';
+import { registerErrorCountAlertType } from './register_error_count_alert_type';
 import { APMConfig } from '../..';
 import { MlPluginSetup } from '../../../../ml/server';
+import { registerTransactionErrorRateAlertType } from './register_transaction_error_rate_alert_type';
 
 interface Params {
   alerts: AlertingPlugin['setup'];
@@ -30,7 +31,11 @@ export function registerApmAlerts(params: Params) {
     ml: params.ml,
     config$: params.config$,
   });
-  registerErrorRateAlertType({
+  registerErrorCountAlertType({
+    alerts: params.alerts,
+    config$: params.config$,
+  });
+  registerTransactionErrorRateAlertType({
     alerts: params.alerts,
     config$: params.config$,
   });
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_error_rate_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
similarity index 66%
rename from x-pack/plugins/apm/server/lib/alerts/register_error_rate_alert_type.ts
rename to x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
index 61e3dfee420a5..5455cd9f6a495 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_error_rate_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
@@ -4,11 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { schema, TypeOf } from '@kbn/config-schema';
+import { schema } from '@kbn/config-schema';
 import { Observable } from 'rxjs';
 import { take } from 'rxjs/operators';
-import { i18n } from '@kbn/i18n';
-import { ENVIRONMENT_ALL } from '../../../common/environment_filter_values';
+import { ProcessorEvent } from '../../../common/processor_event';
+import { getEnvironmentUiFilterES } from '../helpers/convert_ui_filters/get_environment_ui_filter_es';
 import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
 import {
   ESSearchResponse,
@@ -17,11 +17,11 @@ import {
 import {
   PROCESSOR_EVENT,
   SERVICE_NAME,
-  SERVICE_ENVIRONMENT,
 } from '../../../common/elasticsearch_fieldnames';
 import { AlertingPlugin } from '../../../../alerts/server';
 import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
 import { APMConfig } from '../..';
+import { apmActionVariables } from './action_variables';
 
 interface RegisterAlertParams {
   alerts: AlertingPlugin['setup'];
@@ -29,21 +29,21 @@ interface RegisterAlertParams {
 }
 
 const paramsSchema = schema.object({
-  serviceName: schema.string(),
   windowSize: schema.number(),
   windowUnit: schema.string(),
   threshold: schema.number(),
+  serviceName: schema.string(),
   environment: schema.string(),
 });
 
-const alertTypeConfig = ALERT_TYPES_CONFIG[AlertType.ErrorRate];
+const alertTypeConfig = ALERT_TYPES_CONFIG[AlertType.ErrorCount];
 
-export function registerErrorRateAlertType({
+export function registerErrorCountAlertType({
   alerts,
   config$,
 }: RegisterAlertParams) {
   alerts.registerType({
-    id: AlertType.ErrorRate,
+    id: AlertType.ErrorCount,
     name: alertTypeConfig.name,
     actionGroups: alertTypeConfig.actionGroups,
     defaultActionGroupId: alertTypeConfig.defaultActionGroupId,
@@ -52,37 +52,26 @@ export function registerErrorRateAlertType({
     },
     actionVariables: {
       context: [
-        {
-          description: i18n.translate(
-            'xpack.apm.registerErrorRateAlertType.variables.serviceName',
-            {
-              defaultMessage: 'Service name',
-            }
-          ),
-          name: 'serviceName',
-        },
+        apmActionVariables.serviceName,
+        apmActionVariables.environment,
+        apmActionVariables.threshold,
+        apmActionVariables.triggerValue,
       ],
     },
     producer: 'apm',
     executor: async ({ services, params }) => {
       const config = await config$.pipe(take(1)).toPromise();
-
-      const alertParams = params as TypeOf<typeof paramsSchema>;
-
+      const alertParams = params;
       const indices = await getApmIndices({
         config,
         savedObjectsClient: services.savedObjectsClient,
       });
 
-      const environmentTerm =
-        alertParams.environment === ENVIRONMENT_ALL.value
-          ? []
-          : [{ term: { [SERVICE_ENVIRONMENT]: alertParams.environment } }];
-
       const searchParams = {
         index: indices['apm_oss.errorIndices'],
         size: 0,
         body: {
+          track_total_hits: true,
           query: {
             bool: {
               filter: [
@@ -93,21 +82,12 @@ export function registerErrorRateAlertType({
                     },
                   },
                 },
-                {
-                  term: {
-                    [PROCESSOR_EVENT]: 'error',
-                  },
-                },
-                {
-                  term: {
-                    [SERVICE_NAME]: alertParams.serviceName,
-                  },
-                },
-                ...environmentTerm,
+                { term: { [PROCESSOR_EVENT]: ProcessorEvent.error } },
+                { term: { [SERVICE_NAME]: alertParams.serviceName } },
+                ...getEnvironmentUiFilterES(alertParams.environment),
               ],
             },
           },
-          track_total_hits: true,
         },
       };
 
@@ -116,18 +96,19 @@ export function registerErrorRateAlertType({
         ESSearchRequest
       > = await services.callCluster('search', searchParams);
 
-      const value = response.hits.total.value;
+      const errorCount = response.hits.total.value;
 
-      if (value && value > alertParams.threshold) {
+      if (errorCount > alertParams.threshold) {
         const alertInstance = services.alertInstanceFactory(
-          AlertType.ErrorRate
+          AlertType.ErrorCount
         );
         alertInstance.scheduleActions(alertTypeConfig.defaultActionGroupId, {
           serviceName: alertParams.serviceName,
+          environment: alertParams.environment,
+          threshold: alertParams.threshold,
+          triggerValue: errorCount,
         });
       }
-
-      return {};
     },
   });
 }
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
index ead28c325692d..373d4bd4da832 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
@@ -4,11 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { schema, TypeOf } from '@kbn/config-schema';
+import { schema } from '@kbn/config-schema';
 import { Observable } from 'rxjs';
 import { take } from 'rxjs/operators';
-import { i18n } from '@kbn/i18n';
-import { ENVIRONMENT_ALL } from '../../../common/environment_filter_values';
+import { ProcessorEvent } from '../../../common/processor_event';
 import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
 import { ESSearchResponse } from '../../../typings/elasticsearch';
 import {
@@ -16,11 +15,12 @@ import {
   SERVICE_NAME,
   TRANSACTION_TYPE,
   TRANSACTION_DURATION,
-  SERVICE_ENVIRONMENT,
 } from '../../../common/elasticsearch_fieldnames';
 import { AlertingPlugin } from '../../../../alerts/server';
 import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
 import { APMConfig } from '../..';
+import { getEnvironmentUiFilterES } from '../helpers/convert_ui_filters/get_environment_ui_filter_es';
+import { apmActionVariables } from './action_variables';
 
 interface RegisterAlertParams {
   alerts: AlertingPlugin['setup'];
@@ -57,42 +57,22 @@ export function registerTransactionDurationAlertType({
     },
     actionVariables: {
       context: [
-        {
-          description: i18n.translate(
-            'xpack.apm.registerTransactionDurationAlertType.variables.serviceName',
-            {
-              defaultMessage: 'Service name',
-            }
-          ),
-          name: 'serviceName',
-        },
-        {
-          description: i18n.translate(
-            'xpack.apm.registerTransactionDurationAlertType.variables.transactionType',
-            {
-              defaultMessage: 'Transaction type',
-            }
-          ),
-          name: 'transactionType',
-        },
+        apmActionVariables.serviceName,
+        apmActionVariables.transactionType,
+        apmActionVariables.environment,
+        apmActionVariables.threshold,
+        apmActionVariables.triggerValue,
       ],
     },
     producer: 'apm',
     executor: async ({ services, params }) => {
       const config = await config$.pipe(take(1)).toPromise();
-
-      const alertParams = params as TypeOf<typeof paramsSchema>;
-
+      const alertParams = params;
       const indices = await getApmIndices({
         config,
         savedObjectsClient: services.savedObjectsClient,
       });
 
-      const environmentTerm =
-        alertParams.environment === ENVIRONMENT_ALL.value
-          ? []
-          : [{ term: { [SERVICE_ENVIRONMENT]: alertParams.environment } }];
-
       const searchParams = {
         index: indices['apm_oss.transactionIndices'],
         size: 0,
@@ -107,33 +87,17 @@ export function registerTransactionDurationAlertType({
                     },
                   },
                 },
-                {
-                  term: {
-                    [PROCESSOR_EVENT]: 'transaction',
-                  },
-                },
-                {
-                  term: {
-                    [SERVICE_NAME]: alertParams.serviceName,
-                  },
-                },
-                {
-                  term: {
-                    [TRANSACTION_TYPE]: alertParams.transactionType,
-                  },
-                },
-                ...environmentTerm,
+                { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
+                { term: { [SERVICE_NAME]: alertParams.serviceName } },
+                { term: { [TRANSACTION_TYPE]: alertParams.transactionType } },
+                ...getEnvironmentUiFilterES(alertParams.environment),
               ],
             },
           },
           aggs: {
             agg:
               alertParams.aggregationType === 'avg'
-                ? {
-                    avg: {
-                      field: TRANSACTION_DURATION,
-                    },
-                  }
+                ? { avg: { field: TRANSACTION_DURATION } }
                 : {
                     percentiles: {
                       field: TRANSACTION_DURATION,
@@ -157,19 +121,23 @@ export function registerTransactionDurationAlertType({
 
       const { agg } = response.aggregations;
 
-      const value = 'values' in agg ? Object.values(agg.values)[0] : agg?.value;
+      const transactionDuration =
+        'values' in agg ? Object.values(agg.values)[0] : agg?.value;
 
-      if (value && value > alertParams.threshold * 1000) {
+      const threshold = alertParams.threshold * 1000;
+
+      if (transactionDuration && transactionDuration > threshold) {
         const alertInstance = services.alertInstanceFactory(
           AlertType.TransactionDuration
         );
         alertInstance.scheduleActions(alertTypeConfig.defaultActionGroupId, {
           transactionType: alertParams.transactionType,
           serviceName: alertParams.serviceName,
+          environment: alertParams.environment,
+          threshold,
+          triggerValue: transactionDuration,
         });
       }
-
-      return {};
     },
   });
 }
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
index 93af51b572aa5..b3526b6a97ad9 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
@@ -4,15 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { schema, TypeOf } from '@kbn/config-schema';
+import { schema } from '@kbn/config-schema';
 import { Observable } from 'rxjs';
-import { i18n } from '@kbn/i18n';
 import { KibanaRequest } from '../../../../../../src/core/server';
 import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
 import { AlertingPlugin } from '../../../../alerts/server';
 import { APMConfig } from '../..';
 import { MlPluginSetup } from '../../../../ml/server';
 import { getMLJobIds } from '../service_map/get_service_anomalies';
+import { apmActionVariables } from './action_variables';
 
 interface RegisterAlertParams {
   alerts: AlertingPlugin['setup'];
@@ -47,24 +47,9 @@ export function registerTransactionDurationAnomalyAlertType({
     },
     actionVariables: {
       context: [
-        {
-          description: i18n.translate(
-            'xpack.apm.registerTransactionDurationAnomalyAlertType.variables.serviceName',
-            {
-              defaultMessage: 'Service name',
-            }
-          ),
-          name: 'serviceName',
-        },
-        {
-          description: i18n.translate(
-            'xpack.apm.registerTransactionDurationAnomalyAlertType.variables.transactionType',
-            {
-              defaultMessage: 'Transaction type',
-            }
-          ),
-          name: 'transactionType',
-        },
+        apmActionVariables.serviceName,
+        apmActionVariables.transactionType,
+        apmActionVariables.environment,
       ],
     },
     producer: 'apm',
@@ -72,7 +57,7 @@ export function registerTransactionDurationAnomalyAlertType({
       if (!ml) {
         return;
       }
-      const alertParams = params as TypeOf<typeof paramsSchema>;
+      const alertParams = params;
       const request = {} as KibanaRequest;
       const { mlAnomalySearch } = ml.mlSystemProvider(request);
       const anomalyDetectors = ml.anomalyDetectorsProvider(request);
@@ -88,6 +73,7 @@ export function registerTransactionDurationAnomalyAlertType({
 
       const anomalySearchParams = {
         body: {
+          terminateAfter: 1,
           size: 0,
           query: {
             bool: {
@@ -131,10 +117,10 @@ export function registerTransactionDurationAnomalyAlertType({
         );
         alertInstance.scheduleActions(alertTypeConfig.defaultActionGroupId, {
           serviceName: alertParams.serviceName,
+          transactionType: alertParams.transactionType,
+          environment: alertParams.environment,
         });
       }
-
-      return {};
     },
   });
 }
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
new file mode 100644
index 0000000000000..a6ed40fc15ec6
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
@@ -0,0 +1,131 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { Observable } from 'rxjs';
+import { take } from 'rxjs/operators';
+import { ProcessorEvent } from '../../../common/processor_event';
+import { EventOutcome } from '../../../common/event_outcome';
+import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
+import { ESSearchResponse } from '../../../typings/elasticsearch';
+import {
+  PROCESSOR_EVENT,
+  SERVICE_NAME,
+  TRANSACTION_TYPE,
+  EVENT_OUTCOME,
+} from '../../../common/elasticsearch_fieldnames';
+import { AlertingPlugin } from '../../../../alerts/server';
+import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
+import { APMConfig } from '../..';
+import { getEnvironmentUiFilterES } from '../helpers/convert_ui_filters/get_environment_ui_filter_es';
+import { apmActionVariables } from './action_variables';
+
+interface RegisterAlertParams {
+  alerts: AlertingPlugin['setup'];
+  config$: Observable<APMConfig>;
+}
+
+const paramsSchema = schema.object({
+  windowSize: schema.number(),
+  windowUnit: schema.string(),
+  threshold: schema.number(),
+  transactionType: schema.string(),
+  serviceName: schema.string(),
+  environment: schema.string(),
+});
+
+const alertTypeConfig = ALERT_TYPES_CONFIG[AlertType.TransactionErrorRate];
+
+export function registerTransactionErrorRateAlertType({
+  alerts,
+  config$,
+}: RegisterAlertParams) {
+  alerts.registerType({
+    id: AlertType.TransactionErrorRate,
+    name: alertTypeConfig.name,
+    actionGroups: alertTypeConfig.actionGroups,
+    defaultActionGroupId: alertTypeConfig.defaultActionGroupId,
+    validate: {
+      params: paramsSchema,
+    },
+    actionVariables: {
+      context: [
+        apmActionVariables.transactionType,
+        apmActionVariables.serviceName,
+        apmActionVariables.environment,
+        apmActionVariables.threshold,
+        apmActionVariables.triggerValue,
+      ],
+    },
+    producer: 'apm',
+    executor: async ({ services, params: alertParams }) => {
+      const config = await config$.pipe(take(1)).toPromise();
+      const indices = await getApmIndices({
+        config,
+        savedObjectsClient: services.savedObjectsClient,
+      });
+
+      const searchParams = {
+        index: indices['apm_oss.transactionIndices'],
+        size: 0,
+        body: {
+          track_total_hits: true,
+          query: {
+            bool: {
+              filter: [
+                {
+                  range: {
+                    '@timestamp': {
+                      gte: `now-${alertParams.windowSize}${alertParams.windowUnit}`,
+                    },
+                  },
+                },
+                { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
+                { term: { [SERVICE_NAME]: alertParams.serviceName } },
+                { term: { [TRANSACTION_TYPE]: alertParams.transactionType } },
+                ...getEnvironmentUiFilterES(alertParams.environment),
+              ],
+            },
+          },
+          aggs: {
+            erroneous_transactions: {
+              filter: { term: { [EVENT_OUTCOME]: EventOutcome.failure } },
+            },
+          },
+        },
+      };
+
+      const response: ESSearchResponse<
+        unknown,
+        typeof searchParams
+      > = await services.callCluster('search', searchParams);
+
+      if (!response.aggregations) {
+        return;
+      }
+
+      const errornousTransactionsCount =
+        response.aggregations.erroneous_transactions.doc_count;
+      const totalTransactionCount = response.hits.total.value;
+      const transactionErrorRate =
+        (errornousTransactionsCount / totalTransactionCount) * 100;
+
+      if (transactionErrorRate > alertParams.threshold) {
+        const alertInstance = services.alertInstanceFactory(
+          AlertType.TransactionErrorRate
+        );
+
+        alertInstance.scheduleActions(alertTypeConfig.defaultActionGroupId, {
+          serviceName: alertParams.serviceName,
+          transactionType: alertParams.transactionType,
+          environment: alertParams.environment,
+          threshold: alertParams.threshold,
+          triggerValue: transactionErrorRate,
+        });
+      }
+    },
+  });
+}
diff --git a/x-pack/plugins/apm/server/lib/anomaly_detection/create_anomaly_detection_jobs.ts b/x-pack/plugins/apm/server/lib/anomaly_detection/create_anomaly_detection_jobs.ts
index 7bcd945d890ad..d0673335387c6 100644
--- a/x-pack/plugins/apm/server/lib/anomaly_detection/create_anomaly_detection_jobs.ts
+++ b/x-pack/plugins/apm/server/lib/anomaly_detection/create_anomaly_detection_jobs.ts
@@ -8,6 +8,7 @@ import { Logger } from 'kibana/server';
 import uuid from 'uuid/v4';
 import { snakeCase } from 'lodash';
 import Boom from 'boom';
+import { ProcessorEvent } from '../../../common/processor_event';
 import { ML_ERRORS } from '../../../common/anomaly_detection';
 import { PromiseReturnType } from '../../../../observability/typings/common';
 import { Setup } from '../helpers/setup_request';
@@ -79,7 +80,7 @@ async function createAnomalyDetectionJob({
     query: {
       bool: {
         filter: [
-          { term: { [PROCESSOR_EVENT]: 'transaction' } },
+          { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
           { exists: { field: TRANSACTION_DURATION } },
           ...getEnvironmentUiFilterES(environment),
         ],
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
index a53068d152d03..fcd4f468d4367 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
@@ -85,7 +85,7 @@ export const tasks: TelemetryTask[] = [
             query: {
               bool: {
                 filter: [
-                  { term: { [PROCESSOR_EVENT]: 'transaction' } },
+                  { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
                   { range: { '@timestamp': { gte: start, lt: end } } },
                 ],
               },
@@ -606,7 +606,10 @@ export const tasks: TelemetryTask[] = [
             timeout,
             query: {
               bool: {
-                filter: [{ term: { [PROCESSOR_EVENT]: 'error' } }, range1d],
+                filter: [
+                  { term: { [PROCESSOR_EVENT]: ProcessorEvent.error } },
+                  range1d,
+                ],
               },
             },
             aggs: {
@@ -640,7 +643,7 @@ export const tasks: TelemetryTask[] = [
             query: {
               bool: {
                 filter: [
-                  { term: { [PROCESSOR_EVENT]: 'transaction' } },
+                  { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
                   range1d,
                 ],
               },
@@ -674,7 +677,7 @@ export const tasks: TelemetryTask[] = [
             query: {
               bool: {
                 filter: [
-                  { term: { [PROCESSOR_EVENT]: 'transaction' } },
+                  { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
                   range1d,
                 ],
                 must_not: {
diff --git a/x-pack/plugins/apm/server/lib/environments/get_all_environments.test.ts b/x-pack/plugins/apm/server/lib/environments/get_all_environments.test.ts
index dfac607eb7232..141d58cc02ba8 100644
--- a/x-pack/plugins/apm/server/lib/environments/get_all_environments.test.ts
+++ b/x-pack/plugins/apm/server/lib/environments/get_all_environments.test.ts
@@ -21,6 +21,7 @@ describe('getAllEnvironments', () => {
     mock = await inspectSearchParams((setup) =>
       getAllEnvironments({
         serviceName: 'test',
+        searchAggregatedTransactions: false,
         setup,
       })
     );
@@ -33,6 +34,7 @@ describe('getAllEnvironments', () => {
       getAllEnvironments({
         serviceName: 'test',
         setup,
+        searchAggregatedTransactions: false,
         includeMissing: true,
       })
     );
diff --git a/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts b/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts
index 8060bf10da99c..95ff357937d47 100644
--- a/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts
+++ b/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts
@@ -11,14 +11,17 @@ import {
   SERVICE_ENVIRONMENT,
 } from '../../../common/elasticsearch_fieldnames';
 import { ENVIRONMENT_NOT_DEFINED } from '../../../common/environment_filter_values';
+import { getProcessorEventForAggregatedTransactions } from '../helpers/aggregated_transactions';
 
 export async function getAllEnvironments({
   serviceName,
   setup,
+  searchAggregatedTransactions,
   includeMissing = false,
 }: {
   serviceName?: string;
   setup: Setup;
+  searchAggregatedTransactions: boolean;
   includeMissing?: boolean;
 }) {
   const { apmEventClient } = setup;
@@ -31,7 +34,9 @@ export async function getAllEnvironments({
   const params = {
     apm: {
       events: [
-        ProcessorEvent.transaction,
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
         ProcessorEvent.error,
         ProcessorEvent.metric,
       ],
diff --git a/x-pack/plugins/apm/server/lib/helpers/aggregated_transactions/index.ts b/x-pack/plugins/apm/server/lib/helpers/aggregated_transactions/index.ts
new file mode 100644
index 0000000000000..167bcfd634520
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/helpers/aggregated_transactions/index.ts
@@ -0,0 +1,97 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SearchAggregatedTransactionSetting } from '../../../../common/aggregated_transactions';
+import { rangeFilter } from '../../../../common/utils/range_filter';
+import { ProcessorEvent } from '../../../../common/processor_event';
+import {
+  TRANSACTION_DURATION,
+  TRANSACTION_DURATION_HISTOGRAM,
+} from '../../../../common/elasticsearch_fieldnames';
+import { APMConfig } from '../../..';
+import { APMEventClient } from '../create_es_client/create_apm_event_client';
+
+export async function getHasAggregatedTransactions({
+  start,
+  end,
+  apmEventClient,
+}: {
+  start?: number;
+  end?: number;
+  apmEventClient: APMEventClient;
+}) {
+  const response = await apmEventClient.search({
+    apm: {
+      events: [ProcessorEvent.metric],
+    },
+    body: {
+      query: {
+        bool: {
+          filter: [
+            { exists: { field: TRANSACTION_DURATION_HISTOGRAM } },
+            ...(start && end ? [{ range: rangeFilter(start, end) }] : []),
+          ],
+        },
+      },
+    },
+    terminateAfter: 1,
+  });
+
+  if (response.hits.total.value > 0) {
+    return true;
+  }
+
+  return false;
+}
+
+export async function getSearchAggregatedTransactions({
+  config,
+  start,
+  end,
+  apmEventClient,
+}: {
+  config: APMConfig;
+  start?: number;
+  end?: number;
+  apmEventClient: APMEventClient;
+}): Promise<boolean> {
+  const searchAggregatedTransactions =
+    config['xpack.apm.searchAggregatedTransactions'];
+
+  if (
+    searchAggregatedTransactions === SearchAggregatedTransactionSetting.auto
+  ) {
+    return getHasAggregatedTransactions({ start, end, apmEventClient });
+  }
+
+  return (
+    searchAggregatedTransactions === SearchAggregatedTransactionSetting.always
+  );
+}
+
+export function getTransactionDurationFieldForAggregatedTransactions(
+  searchAggregatedTransactions: boolean
+) {
+  return searchAggregatedTransactions
+    ? TRANSACTION_DURATION_HISTOGRAM
+    : TRANSACTION_DURATION;
+}
+
+export function getDocumentTypeFilterForAggregatedTransactions(
+  searchAggregatedTransactions: boolean
+) {
+  return searchAggregatedTransactions
+    ? [{ exists: { field: TRANSACTION_DURATION_HISTOGRAM } }]
+    : [];
+}
+
+export function getProcessorEventForAggregatedTransactions(
+  searchAggregatedTransactions: boolean
+): ProcessorEvent.metric | ProcessorEvent.transaction {
+  return searchAggregatedTransactions
+    ? ProcessorEvent.metric
+    : ProcessorEvent.transaction;
+}
diff --git a/x-pack/plugins/apm/server/lib/helpers/convert_ui_filters/get_environment_ui_filter_es.ts b/x-pack/plugins/apm/server/lib/helpers/convert_ui_filters/get_environment_ui_filter_es.ts
index 6ff98a9be75f9..ea8d02eb833cf 100644
--- a/x-pack/plugins/apm/server/lib/helpers/convert_ui_filters/get_environment_ui_filter_es.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/convert_ui_filters/get_environment_ui_filter_es.ts
@@ -5,11 +5,14 @@
  */
 
 import { ESFilter } from '../../../../typings/elasticsearch';
-import { ENVIRONMENT_NOT_DEFINED } from '../../../../common/environment_filter_values';
+import {
+  ENVIRONMENT_NOT_DEFINED,
+  ENVIRONMENT_ALL,
+} from '../../../../common/environment_filter_values';
 import { SERVICE_ENVIRONMENT } from '../../../../common/elasticsearch_fieldnames';
 
 export function getEnvironmentUiFilterES(environment?: string): ESFilter[] {
-  if (!environment) {
+  if (!environment || environment === ENVIRONMENT_ALL.value) {
     return [];
   }
   if (environment === ENVIRONMENT_NOT_DEFINED.value) {
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/unpack_processor_events.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/unpack_processor_events.ts
index d35403ad35d94..736c7ad2d1089 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/unpack_processor_events.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/unpack_processor_events.ts
@@ -32,9 +32,9 @@ export function unpackProcessorEvents(
 ) {
   const { apm, ...params } = request;
 
-  const index = uniq(
-    apm.events.map((event) => indices[processorEventIndexMap[event]])
-  );
+  const events = uniq(apm.events);
+
+  const index = events.map((event) => indices[processorEventIndexMap[event]]);
 
   const withFilterForProcessorEvent: ESSearchRequest & {
     body: { query: { bool: { filter: ESFilter[] } } };
@@ -50,7 +50,7 @@ export function unpackProcessorEvents(
 
   withFilterForProcessorEvent.body.query.bool.filter.push({
     terms: {
-      [PROCESSOR_EVENT]: apm.events,
+      [PROCESSOR_EVENT]: events,
     },
   });
 
diff --git a/x-pack/plugins/apm/server/lib/metrics/__snapshots__/queries.test.ts.snap b/x-pack/plugins/apm/server/lib/metrics/__snapshots__/queries.test.ts.snap
index b88c90a213c67..2868dcfda97b6 100644
--- a/x-pack/plugins/apm/server/lib/metrics/__snapshots__/queries.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/metrics/__snapshots__/queries.test.ts.snap
@@ -203,16 +203,50 @@ Object {
       "memoryUsedAvg": Object {
         "avg": Object {
           "script": Object {
-            "lang": "expression",
-            "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+            "lang": "painless",
+            "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
           },
         },
       },
       "memoryUsedMax": Object {
         "max": Object {
           "script": Object {
-            "lang": "expression",
-            "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+            "lang": "painless",
+            "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
           },
         },
       },
@@ -221,16 +255,50 @@ Object {
           "memoryUsedAvg": Object {
             "avg": Object {
               "script": Object {
-                "lang": "expression",
-                "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+                "lang": "painless",
+                "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
               },
             },
           },
           "memoryUsedMax": Object {
             "max": Object {
               "script": Object {
-                "lang": "expression",
-                "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+                "lang": "painless",
+                "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
               },
             },
           },
@@ -275,12 +343,7 @@ Object {
           },
           Object {
             "exists": Object {
-              "field": "system.memory.actual.free",
-            },
-          },
-          Object {
-            "exists": Object {
-              "field": "system.memory.total",
+              "field": "system.process.cgroup.memory.mem.usage.bytes",
             },
           },
         ],
@@ -682,16 +745,50 @@ Object {
       "memoryUsedAvg": Object {
         "avg": Object {
           "script": Object {
-            "lang": "expression",
-            "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+            "lang": "painless",
+            "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
           },
         },
       },
       "memoryUsedMax": Object {
         "max": Object {
           "script": Object {
-            "lang": "expression",
-            "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+            "lang": "painless",
+            "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
           },
         },
       },
@@ -700,16 +797,50 @@ Object {
           "memoryUsedAvg": Object {
             "avg": Object {
               "script": Object {
-                "lang": "expression",
-                "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+                "lang": "painless",
+                "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
               },
             },
           },
           "memoryUsedMax": Object {
             "max": Object {
               "script": Object {
-                "lang": "expression",
-                "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+                "lang": "painless",
+                "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
               },
             },
           },
@@ -760,12 +891,7 @@ Object {
           },
           Object {
             "exists": Object {
-              "field": "system.memory.actual.free",
-            },
-          },
-          Object {
-            "exists": Object {
-              "field": "system.memory.total",
+              "field": "system.process.cgroup.memory.mem.usage.bytes",
             },
           },
         ],
@@ -1157,16 +1283,50 @@ Object {
       "memoryUsedAvg": Object {
         "avg": Object {
           "script": Object {
-            "lang": "expression",
-            "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+            "lang": "painless",
+            "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
           },
         },
       },
       "memoryUsedMax": Object {
         "max": Object {
           "script": Object {
-            "lang": "expression",
-            "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+            "lang": "painless",
+            "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
           },
         },
       },
@@ -1175,16 +1335,50 @@ Object {
           "memoryUsedAvg": Object {
             "avg": Object {
               "script": Object {
-                "lang": "expression",
-                "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+                "lang": "painless",
+                "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
               },
             },
           },
           "memoryUsedMax": Object {
             "max": Object {
               "script": Object {
-                "lang": "expression",
-                "source": "1 - doc['system.memory.actual.free'] / doc['system.memory.total']",
+                "lang": "painless",
+                "source": "
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = 'system.process.cgroup.memory.mem.limit.bytes';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['system.memory.total'].value;
+
+    double used = doc['system.process.cgroup.memory.mem.usage.bytes'].value;
+
+    return used / total;
+    ",
               },
             },
           },
@@ -1224,12 +1418,7 @@ Object {
           },
           Object {
             "exists": Object {
-              "field": "system.memory.actual.free",
-            },
-          },
-          Object {
-            "exists": Object {
-              "field": "system.memory.total",
+              "field": "system.process.cgroup.memory.mem.usage.bytes",
             },
           },
         ],
diff --git a/x-pack/plugins/apm/server/lib/metrics/by_agent/shared/memory/index.ts b/x-pack/plugins/apm/server/lib/metrics/by_agent/shared/memory/index.ts
index 316b0d59d2c5b..a60576ca0c175 100644
--- a/x-pack/plugins/apm/server/lib/metrics/by_agent/shared/memory/index.ts
+++ b/x-pack/plugins/apm/server/lib/metrics/by_agent/shared/memory/index.ts
@@ -6,6 +6,8 @@
 
 import { i18n } from '@kbn/i18n';
 import {
+  METRIC_CGROUP_MEMORY_LIMIT_BYTES,
+  METRIC_CGROUP_MEMORY_USAGE_BYTES,
   METRIC_SYSTEM_FREE_MEMORY,
   METRIC_SYSTEM_TOTAL_MEMORY,
 } from '../../../../../../common/elasticsearch_fieldnames';
@@ -14,8 +16,8 @@ import {
   SetupTimeRange,
   SetupUIFilters,
 } from '../../../../helpers/setup_request';
-import { ChartBase } from '../../../types';
 import { fetchAndTransformMetrics } from '../../../fetch_and_transform_metrics';
+import { ChartBase } from '../../../types';
 
 const series = {
   memoryUsedMax: {
@@ -43,36 +45,68 @@ const chartBase: ChartBase = {
   series,
 };
 
-export const percentMemoryUsedScript = {
+export const percentSystemMemoryUsedScript = {
   lang: 'expression',
   source: `1 - doc['${METRIC_SYSTEM_FREE_MEMORY}'] / doc['${METRIC_SYSTEM_TOTAL_MEMORY}']`,
 };
 
+export const percentCgroupMemoryUsedScript = {
+  lang: 'painless',
+  source: `
+    /*
+      When no limit is specified in the container, docker allows the app as much memory / swap memory as it wants. 
+      This number represents the max possible value for the limit field.
+    */
+    double CGROUP_LIMIT_MAX_VALUE = 9223372036854771712L;
+
+    String limitKey = '${METRIC_CGROUP_MEMORY_LIMIT_BYTES}';
+
+    //Should use cgropLimit when value is not empty and not equals to the max limit value.
+    boolean useCgroupLimit = doc.containsKey(limitKey) && !doc[limitKey].empty && doc[limitKey].value != CGROUP_LIMIT_MAX_VALUE;
+
+    double total = useCgroupLimit ? doc[limitKey].value : doc['${METRIC_SYSTEM_TOTAL_MEMORY}'].value;
+
+    double used = doc['${METRIC_CGROUP_MEMORY_USAGE_BYTES}'].value;
+
+    return used / total;
+    `,
+};
+
 export async function getMemoryChartData(
   setup: Setup & SetupTimeRange & SetupUIFilters,
   serviceName: string,
   serviceNodeName?: string
 ) {
-  return fetchAndTransformMetrics({
+  const cgroupResponse = await fetchAndTransformMetrics({
     setup,
     serviceName,
     serviceNodeName,
     chartBase,
     aggs: {
-      memoryUsedAvg: { avg: { script: percentMemoryUsedScript } },
-      memoryUsedMax: { max: { script: percentMemoryUsedScript } },
+      memoryUsedAvg: { avg: { script: percentCgroupMemoryUsedScript } },
+      memoryUsedMax: { max: { script: percentCgroupMemoryUsedScript } },
     },
     additionalFilters: [
-      {
-        exists: {
-          field: METRIC_SYSTEM_FREE_MEMORY,
-        },
-      },
-      {
-        exists: {
-          field: METRIC_SYSTEM_TOTAL_MEMORY,
-        },
-      },
+      { exists: { field: METRIC_CGROUP_MEMORY_USAGE_BYTES } },
     ],
   });
+
+  if (cgroupResponse.noHits) {
+    return await fetchAndTransformMetrics({
+      setup,
+      serviceName,
+      serviceNodeName,
+      chartBase,
+      aggs: {
+        memoryUsedAvg: { avg: { script: percentSystemMemoryUsedScript } },
+        memoryUsedMax: { max: { script: percentSystemMemoryUsedScript } },
+      },
+      additionalFilters: [
+        { exists: { field: METRIC_SYSTEM_FREE_MEMORY } },
+        { exists: { field: METRIC_SYSTEM_TOTAL_MEMORY } },
+      ],
+    });
+  }
+
+  return cgroupResponse;
 }
diff --git a/x-pack/plugins/apm/server/lib/observability_overview/get_service_count.ts b/x-pack/plugins/apm/server/lib/observability_overview/get_service_count.ts
index 8a1f3cb0e0149..a915457bf4a1f 100644
--- a/x-pack/plugins/apm/server/lib/observability_overview/get_service_count.ts
+++ b/x-pack/plugins/apm/server/lib/observability_overview/get_service_count.ts
@@ -8,18 +8,23 @@ import { ProcessorEvent } from '../../../common/processor_event';
 import { rangeFilter } from '../../../common/utils/range_filter';
 import { SERVICE_NAME } from '../../../common/elasticsearch_fieldnames';
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
+import { getProcessorEventForAggregatedTransactions } from '../helpers/aggregated_transactions';
 
 export async function getServiceCount({
   setup,
+  searchAggregatedTransactions,
 }: {
   setup: Setup & SetupTimeRange;
+  searchAggregatedTransactions: boolean;
 }) {
   const { apmEventClient, start, end } = setup;
 
   const params = {
     apm: {
       events: [
-        ProcessorEvent.transaction,
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
         ProcessorEvent.error,
         ProcessorEvent.metric,
       ],
diff --git a/x-pack/plugins/apm/server/lib/observability_overview/get_transaction_coordinates.ts b/x-pack/plugins/apm/server/lib/observability_overview/get_transaction_coordinates.ts
index 4eb5ff05b45e3..5531944fc7180 100644
--- a/x-pack/plugins/apm/server/lib/observability_overview/get_transaction_coordinates.ts
+++ b/x-pack/plugins/apm/server/lib/observability_overview/get_transaction_coordinates.ts
@@ -11,20 +11,29 @@
 import { rangeFilter } from '../../../common/utils/range_filter';
 import { Coordinates } from '../../../../observability/typings/common';
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
-import { ProcessorEvent } from '../../../common/processor_event';
+import {
+  getProcessorEventForAggregatedTransactions,
+  getTransactionDurationFieldForAggregatedTransactions,
+} from '../helpers/aggregated_transactions';
 
 export async function getTransactionCoordinates({
   setup,
   bucketSize,
+  searchAggregatedTransactions,
 }: {
   setup: Setup & SetupTimeRange;
   bucketSize: string;
+  searchAggregatedTransactions: boolean;
 }): Promise<Coordinates[]> {
   const { apmEventClient, start, end } = setup;
 
   const { aggregations } = await apmEventClient.search({
     apm: {
-      events: [ProcessorEvent.transaction],
+      events: [
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
+      ],
     },
     body: {
       size: 0,
@@ -40,6 +49,15 @@ export async function getTransactionCoordinates({
             fixed_interval: bucketSize,
             min_doc_count: 0,
           },
+          aggs: {
+            count: {
+              value_count: {
+                field: getTransactionDurationFieldForAggregatedTransactions(
+                  searchAggregatedTransactions
+                ),
+              },
+            },
+          },
         },
       },
     },
@@ -50,7 +68,7 @@ export async function getTransactionCoordinates({
   return (
     aggregations?.distribution.buckets.map((bucket) => ({
       x: bucket.key,
-      y: bucket.doc_count / deltaAsMinutes,
+      y: bucket.count.value / deltaAsMinutes,
     })) || []
   );
 }
diff --git a/x-pack/plugins/apm/server/lib/rum_client/__snapshots__/queries.test.ts.snap b/x-pack/plugins/apm/server/lib/rum_client/__snapshots__/queries.test.ts.snap
index 32b4343a7f81b..ceffb4f4d6654 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/__snapshots__/queries.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/rum_client/__snapshots__/queries.test.ts.snap
@@ -33,7 +33,7 @@ Object {
       },
       "pageViews": Object {
         "value_count": Object {
-          "field": "transaction.type",
+          "field": "transaction.duration.us",
         },
       },
     },
diff --git a/x-pack/plugins/apm/server/lib/rum_client/get_client_metrics.ts b/x-pack/plugins/apm/server/lib/rum_client/get_client_metrics.ts
index e0dec183f06d6..b3f9646f64029 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/get_client_metrics.ts
+++ b/x-pack/plugins/apm/server/lib/rum_client/get_client_metrics.ts
@@ -4,7 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getRumOverviewProjection } from '../../projections/rum_overview';
+import { TRANSACTION_DURATION } from '../../../common/elasticsearch_fieldnames';
+import { getRumPageLoadTransactionsProjection } from '../../projections/rum_page_load_transactions';
 import { mergeProjection } from '../../projections/util/merge_projection';
 import {
   Setup,
@@ -21,18 +22,19 @@ export async function getClientMetrics({
 }: {
   setup: Setup & SetupTimeRange & SetupUIFilters;
 }) {
-  const projection = getRumOverviewProjection({
+  const projection = getRumPageLoadTransactionsProjection({
     setup,
   });
 
   const params = mergeProjection(projection, {
     body: {
       size: 0,
-      query: {
-        bool: projection.body.query.bool,
-      },
       aggs: {
-        pageViews: { value_count: { field: 'transaction.type' } },
+        pageViews: {
+          value_count: {
+            field: TRANSACTION_DURATION,
+          },
+        },
         backEnd: {
           percentiles: {
             field: TRANSACTION_TIME_TO_FIRST_BYTE,
diff --git a/x-pack/plugins/apm/server/lib/rum_client/get_long_task_metrics.ts b/x-pack/plugins/apm/server/lib/rum_client/get_long_task_metrics.ts
index fba1b6a0a634d..1faee52034580 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/get_long_task_metrics.ts
+++ b/x-pack/plugins/apm/server/lib/rum_client/get_long_task_metrics.ts
@@ -6,8 +6,8 @@
 
 import {
   getRumLongTasksProjection,
-  getRumOverviewProjection,
-} from '../../projections/rum_overview';
+  getRumPageLoadTransactionsProjection,
+} from '../../projections/rum_page_load_transactions';
 import { mergeProjection } from '../../projections/util/merge_projection';
 import {
   Setup,
@@ -87,7 +87,7 @@ async function filterPageLoadTransactions(
   setup: Setup & SetupTimeRange & SetupUIFilters,
   transactionIds: string[]
 ) {
-  const projection = getRumOverviewProjection({
+  const projection = getRumPageLoadTransactionsProjection({
     setup,
   });
 
diff --git a/x-pack/plugins/apm/server/lib/rum_client/get_page_load_distribution.ts b/x-pack/plugins/apm/server/lib/rum_client/get_page_load_distribution.ts
index 2a0c709ea9235..3d8ab7a72654d 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/get_page_load_distribution.ts
+++ b/x-pack/plugins/apm/server/lib/rum_client/get_page_load_distribution.ts
@@ -4,7 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getRumOverviewProjection } from '../../projections/rum_overview';
+import { TRANSACTION_DURATION } from '../../../common/elasticsearch_fieldnames';
+import { getRumPageLoadTransactionsProjection } from '../../projections/rum_page_load_transactions';
 import { mergeProjection } from '../../projections/util/merge_projection';
 import {
   Setup,
@@ -14,10 +15,27 @@ import {
 
 export const MICRO_TO_SEC = 1000000;
 
+const NUMBER_OF_PLD_STEPS = 100;
+
 export function microToSec(val: number) {
   return Math.round((val / MICRO_TO_SEC + Number.EPSILON) * 100) / 100;
 }
 
+export const getPLDChartSteps = ({
+  maxDuration,
+  minDuration,
+}: {
+  maxDuration: number;
+  minDuration: number;
+}) => {
+  const stepValue = (maxDuration - minDuration) / NUMBER_OF_PLD_STEPS;
+  const stepValues = [];
+  for (let i = 1; i < NUMBER_OF_PLD_STEPS + 1; i++) {
+    stepValues.push((stepValue * i + minDuration).toFixed(2));
+  }
+  return stepValues;
+};
+
 export async function getPageLoadDistribution({
   setup,
   minPercentile,
@@ -27,26 +45,23 @@ export async function getPageLoadDistribution({
   minPercentile?: string;
   maxPercentile?: string;
 }) {
-  const projection = getRumOverviewProjection({
+  const projection = getRumPageLoadTransactionsProjection({
     setup,
   });
 
   const params = mergeProjection(projection, {
     body: {
       size: 0,
-      query: {
-        bool: projection.body.query.bool,
-      },
       aggs: {
         minDuration: {
           min: {
-            field: 'transaction.duration.us',
+            field: TRANSACTION_DURATION,
             missing: 0,
           },
         },
         durPercentiles: {
           percentiles: {
-            field: 'transaction.duration.us',
+            field: TRANSACTION_DURATION,
             percents: [50, 75, 90, 95, 99],
             hdr: {
               number_of_significant_value_digits: 3,
@@ -78,7 +93,11 @@ export async function getPageLoadDistribution({
 
   const maxPerc = maxPercentile ? +maxPercentile * MICRO_TO_SEC : maxPercQuery;
 
-  const pageDist = await getPercentilesDistribution(setup, minPerc, maxPerc);
+  const pageDist = await getPercentilesDistribution({
+    setup,
+    minDuration: minPerc,
+    maxDuration: maxPerc,
+  });
 
   Object.entries(durPercentiles?.values ?? {}).forEach(([key, val]) => {
     if (durPercentiles?.values?.[key]) {
@@ -94,31 +113,28 @@ export async function getPageLoadDistribution({
   };
 }
 
-const getPercentilesDistribution = async (
-  setup: Setup & SetupTimeRange & SetupUIFilters,
-  minDuration: number,
-  maxDuration: number
-) => {
-  const stepValue = (maxDuration - minDuration) / 100;
-  const stepValues = [];
-  for (let i = 1; i < 101; i++) {
-    stepValues.push((stepValue * i + minDuration).toFixed(2));
-  }
+const getPercentilesDistribution = async ({
+  setup,
+  minDuration,
+  maxDuration,
+}: {
+  setup: Setup & SetupTimeRange & SetupUIFilters;
+  minDuration: number;
+  maxDuration: number;
+}) => {
+  const stepValues = getPLDChartSteps({ maxDuration, minDuration });
 
-  const projection = getRumOverviewProjection({
+  const projection = getRumPageLoadTransactionsProjection({
     setup,
   });
 
   const params = mergeProjection(projection, {
     body: {
       size: 0,
-      query: {
-        bool: projection.body.query.bool,
-      },
       aggs: {
         loadDistribution: {
           percentile_ranks: {
-            field: 'transaction.duration.us',
+            field: TRANSACTION_DURATION,
             values: stepValues,
             keyed: false,
             hdr: {
diff --git a/x-pack/plugins/apm/server/lib/rum_client/get_page_view_trends.ts b/x-pack/plugins/apm/server/lib/rum_client/get_page_view_trends.ts
index 114137e9fad17..f25062c67f87a 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/get_page_view_trends.ts
+++ b/x-pack/plugins/apm/server/lib/rum_client/get_page_view_trends.ts
@@ -3,8 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
-import { getRumOverviewProjection } from '../../projections/rum_overview';
+import { getRumPageLoadTransactionsProjection } from '../../projections/rum_page_load_transactions';
 import { mergeProjection } from '../../projections/util/merge_projection';
 import {
   Setup,
@@ -20,7 +19,7 @@ export async function getPageViewTrends({
   setup: Setup & SetupTimeRange & SetupUIFilters;
   breakdowns?: string;
 }) {
-  const projection = getRumOverviewProjection({
+  const projection = getRumPageLoadTransactionsProjection({
     setup,
   });
   let breakdownItem: BreakdownItem | null = null;
@@ -68,17 +67,15 @@ export async function getPageViewTrends({
       x: xVal,
       y: bCount,
     };
-    if (breakdownItem) {
-      const categoryBuckets = (bucket.breakdown as any).buckets;
-      categoryBuckets.forEach(
-        ({ key, doc_count: docCount }: { key: string; doc_count: number }) => {
-          if (key === 'Other') {
-            res[key + `(${breakdownItem?.name})`] = docCount;
-          } else {
-            res[key] = docCount;
-          }
+    if ('breakdown' in bucket) {
+      const categoryBuckets = bucket.breakdown.buckets;
+      categoryBuckets.forEach(({ key, doc_count: docCount }) => {
+        if (key === 'Other') {
+          res[key + `(${breakdownItem?.name})`] = docCount;
+        } else {
+          res[key] = docCount;
         }
-      );
+      });
     }
 
     return res;
diff --git a/x-pack/plugins/apm/server/lib/rum_client/get_pl_dist_breakdown.ts b/x-pack/plugins/apm/server/lib/rum_client/get_pl_dist_breakdown.ts
index ffb06e649b9be..1945140e35777 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/get_pl_dist_breakdown.ts
+++ b/x-pack/plugins/apm/server/lib/rum_client/get_pl_dist_breakdown.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { getRumPageLoadTransactionsProjection } from '../../projections/rum_page_load_transactions';
 import { ProcessorEvent } from '../../../common/processor_event';
-import { getRumOverviewProjection } from '../../projections/rum_overview';
 import { mergeProjection } from '../../projections/util/merge_projection';
 import {
   Setup,
@@ -19,7 +19,11 @@ import {
   USER_AGENT_OS,
   TRANSACTION_DURATION,
 } from '../../../common/elasticsearch_fieldnames';
-import { MICRO_TO_SEC, microToSec } from './get_page_load_distribution';
+import {
+  getPLDChartSteps,
+  MICRO_TO_SEC,
+  microToSec,
+} from './get_page_load_distribution';
 
 export const getBreakdownField = (breakdown: string) => {
   switch (breakdown) {
@@ -35,22 +39,24 @@ export const getBreakdownField = (breakdown: string) => {
   }
 };
 
-export const getPageLoadDistBreakdown = async (
-  setup: Setup & SetupTimeRange & SetupUIFilters,
-  minDuration: number,
-  maxDuration: number,
-  breakdown: string
-) => {
+export const getPageLoadDistBreakdown = async ({
+  setup,
+  minDuration,
+  maxDuration,
+  breakdown,
+}: {
+  setup: Setup & SetupTimeRange & SetupUIFilters;
+  minDuration: number;
+  maxDuration: number;
+  breakdown: string;
+}) => {
   // convert secs to micros
-  const stepValue =
-    (maxDuration * MICRO_TO_SEC - minDuration * MICRO_TO_SEC) / 50;
-  const stepValues = [];
-
-  for (let i = 1; i < 51; i++) {
-    stepValues.push((stepValue * i + minDuration).toFixed(2));
-  }
+  const stepValues = getPLDChartSteps({
+    minDuration: minDuration * MICRO_TO_SEC,
+    maxDuration: maxDuration * MICRO_TO_SEC,
+  });
 
-  const projection = getRumOverviewProjection({
+  const projection = getRumPageLoadTransactionsProjection({
     setup,
   });
 
diff --git a/x-pack/plugins/apm/server/lib/rum_client/get_rum_services.ts b/x-pack/plugins/apm/server/lib/rum_client/get_rum_services.ts
index 9bfa109f00faf..3adad0868ed4b 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/get_rum_services.ts
+++ b/x-pack/plugins/apm/server/lib/rum_client/get_rum_services.ts
@@ -4,12 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { SERVICE_NAME } from '../../../common/elasticsearch_fieldnames';
 import {
   Setup,
   SetupTimeRange,
   SetupUIFilters,
 } from '../helpers/setup_request';
-import { getRumOverviewProjection } from '../../projections/rum_overview';
+import { getRumPageLoadTransactionsProjection } from '../../projections/rum_page_load_transactions';
 import { mergeProjection } from '../../projections/util/merge_projection';
 
 export async function getRumServices({
@@ -17,7 +18,7 @@ export async function getRumServices({
 }: {
   setup: Setup & SetupTimeRange & SetupUIFilters;
 }) {
-  const projection = getRumOverviewProjection({
+  const projection = getRumPageLoadTransactionsProjection({
     setup,
   });
 
@@ -30,7 +31,7 @@ export async function getRumServices({
       aggs: {
         services: {
           terms: {
-            field: 'service.name',
+            field: SERVICE_NAME,
             size: 1000,
           },
         },
diff --git a/x-pack/plugins/apm/server/lib/rum_client/get_visitor_breakdown.ts b/x-pack/plugins/apm/server/lib/rum_client/get_visitor_breakdown.ts
index 3681923b484b0..3493307929f42 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/get_visitor_breakdown.ts
+++ b/x-pack/plugins/apm/server/lib/rum_client/get_visitor_breakdown.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getRumOverviewProjection } from '../../projections/rum_overview';
+import { getRumPageLoadTransactionsProjection } from '../../projections/rum_page_load_transactions';
 import { mergeProjection } from '../../projections/util/merge_projection';
 import {
   Setup,
@@ -22,7 +22,7 @@ export async function getVisitorBreakdown({
 }: {
   setup: Setup & SetupTimeRange & SetupUIFilters;
 }) {
-  const projection = getRumOverviewProjection({
+  const projection = getRumPageLoadTransactionsProjection({
     setup,
   });
 
diff --git a/x-pack/plugins/apm/server/lib/rum_client/get_web_core_vitals.ts b/x-pack/plugins/apm/server/lib/rum_client/get_web_core_vitals.ts
index 25d1877cbb123..4fcfb53a05887 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/get_web_core_vitals.ts
+++ b/x-pack/plugins/apm/server/lib/rum_client/get_web_core_vitals.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getRumOverviewProjection } from '../../projections/rum_overview';
+import { getRumPageLoadTransactionsProjection } from '../../projections/rum_page_load_transactions';
 import { mergeProjection } from '../../projections/util/merge_projection';
 import {
   Setup,
@@ -16,6 +16,7 @@ import {
   FCP_FIELD,
   FID_FIELD,
   LCP_FIELD,
+  USER_AGENT_NAME,
   TBT_FIELD,
 } from '../../../common/elasticsearch_fieldnames';
 
@@ -24,7 +25,7 @@ export async function getWebCoreVitals({
 }: {
   setup: Setup & SetupTimeRange & SetupUIFilters;
 }) {
-  const projection = getRumOverviewProjection({
+  const projection = getRumPageLoadTransactionsProjection({
     setup,
   });
 
@@ -37,7 +38,7 @@ export async function getWebCoreVitals({
             ...projection.body.query.bool.filter,
             {
               term: {
-                'user_agent.name': 'Chrome',
+                [USER_AGENT_NAME]: 'Chrome',
               },
             },
           ],
@@ -123,7 +124,7 @@ export async function getWebCoreVitals({
 
   // Divide by 1000 to convert ms into seconds
   return {
-    cls: String(cls?.values['50.0'] || 0),
+    cls: String(cls?.values['50.0']?.toFixed(2) || 0),
     fid: ((fid?.values['50.0'] || 0) / 1000).toFixed(2),
     lcp: ((lcp?.values['50.0'] || 0) / 1000).toFixed(2),
     tbt: ((tbt?.values['50.0'] || 0) / 1000).toFixed(2),
diff --git a/x-pack/plugins/apm/server/lib/service_map/get_service_map.ts b/x-pack/plugins/apm/server/lib/service_map/get_service_map.ts
index b162c3b61d928..402beb1999240 100644
--- a/x-pack/plugins/apm/server/lib/service_map/get_service_map.ts
+++ b/x-pack/plugins/apm/server/lib/service_map/get_service_map.ts
@@ -27,6 +27,7 @@ export interface IEnvOptions {
   setup: Setup & SetupTimeRange;
   serviceName?: string;
   environment?: string;
+  searchAggregatedTransactions: boolean;
   logger: Logger;
 }
 
@@ -77,10 +78,11 @@ async function getConnectionData({
 }
 
 async function getServicesData(options: IEnvOptions) {
-  const { setup } = options;
+  const { setup, searchAggregatedTransactions } = options;
 
   const projection = getServicesProjection({
     setup: { ...setup, uiFiltersES: [] },
+    searchAggregatedTransactions,
   });
 
   const { filter } = projection.body.query.bool;
diff --git a/x-pack/plugins/apm/server/lib/service_map/get_service_map_service_node_info.test.ts b/x-pack/plugins/apm/server/lib/service_map/get_service_map_service_node_info.test.ts
index 1e26b6f3f58f9..7af1607697ef3 100644
--- a/x-pack/plugins/apm/server/lib/service_map/get_service_map_service_node_info.test.ts
+++ b/x-pack/plugins/apm/server/lib/service_map/get_service_map_service_node_info.test.ts
@@ -26,6 +26,7 @@ describe('getServiceMapServiceNodeInfo', () => {
         uiFilters: { environment },
         setup,
         serviceName,
+        searchAggregatedTransactions: false,
       });
 
       expect(result).toEqual({
@@ -52,7 +53,12 @@ describe('getServiceMapServiceNodeInfo', () => {
         apmEventClient: {
           search: () =>
             Promise.resolve({
-              hits: { total: { value: 1 } },
+              aggregations: {
+                count: { value: 1 },
+                duration: { value: null },
+                avgCpuUsage: { value: null },
+                avgMemoryUsage: { value: null },
+              },
             }),
         },
         indices: {},
@@ -68,6 +74,7 @@ describe('getServiceMapServiceNodeInfo', () => {
         uiFilters: { environment },
         setup,
         serviceName,
+        searchAggregatedTransactions: false,
       });
 
       expect(result).toEqual({
diff --git a/x-pack/plugins/apm/server/lib/service_map/get_service_map_service_node_info.ts b/x-pack/plugins/apm/server/lib/service_map/get_service_map_service_node_info.ts
index 330d38739a063..5c183fd9150dd 100644
--- a/x-pack/plugins/apm/server/lib/service_map/get_service_map_service_node_info.ts
+++ b/x-pack/plugins/apm/server/lib/service_map/get_service_map_service_node_info.ts
@@ -4,24 +4,32 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import {
+  TRANSACTION_REQUEST,
+  TRANSACTION_PAGE_LOAD,
+} from '../../../common/transaction_types';
 import { UIFilters } from '../../../typings/ui_filters';
 import {
   SERVICE_NAME,
-  TRANSACTION_DURATION,
-  TRANSACTION_TYPE,
   METRIC_SYSTEM_CPU_PERCENT,
   METRIC_SYSTEM_FREE_MEMORY,
   METRIC_SYSTEM_TOTAL_MEMORY,
+  METRIC_CGROUP_MEMORY_USAGE_BYTES,
+  TRANSACTION_TYPE,
 } from '../../../common/elasticsearch_fieldnames';
 import { ProcessorEvent } from '../../../common/processor_event';
 import { rangeFilter } from '../../../common/utils/range_filter';
 import { ESFilter } from '../../../typings/elasticsearch';
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
-import { percentMemoryUsedScript } from '../metrics/by_agent/shared/memory';
 import {
-  TRANSACTION_REQUEST,
-  TRANSACTION_PAGE_LOAD,
-} from '../../../common/transaction_types';
+  percentCgroupMemoryUsedScript,
+  percentSystemMemoryUsedScript,
+} from '../metrics/by_agent/shared/memory';
+import {
+  getProcessorEventForAggregatedTransactions,
+  getTransactionDurationFieldForAggregatedTransactions,
+  getDocumentTypeFilterForAggregatedTransactions,
+} from '../helpers/aggregated_transactions';
 import { getErrorRate } from '../transaction_groups/get_error_rate';
 import { getEnvironmentUiFilterES } from '../helpers/convert_ui_filters/get_environment_ui_filter_es';
 
@@ -29,11 +37,13 @@ interface Options {
   setup: Setup & SetupTimeRange;
   environment?: string;
   serviceName: string;
+  searchAggregatedTransactions: boolean;
 }
 
 interface TaskParameters {
   environment?: string;
   filter: ESFilter[];
+  searchAggregatedTransactions: boolean;
   minutes: number;
   serviceName?: string;
   setup: Setup;
@@ -42,6 +52,7 @@ interface TaskParameters {
 export async function getServiceMapServiceNodeInfo({
   serviceName,
   setup,
+  searchAggregatedTransactions,
   uiFilters,
 }: Options & { serviceName: string; uiFilters: UIFilters }) {
   const { start, end } = setup;
@@ -56,6 +67,7 @@ export async function getServiceMapServiceNodeInfo({
   const taskParams = {
     environment: uiFilters.environment,
     filter,
+    searchAggregatedTransactions,
     minutes,
     serviceName,
     setup,
@@ -104,6 +116,7 @@ async function getTransactionStats({
   setup,
   filter,
   minutes,
+  searchAggregatedTransactions,
 }: TaskParameters): Promise<{
   avgTransactionDuration: number | null;
   avgRequestsPerMinute: number | null;
@@ -112,7 +125,11 @@ async function getTransactionStats({
 
   const params = {
     apm: {
-      events: [ProcessorEvent.transaction],
+      events: [
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
+      ],
     },
     body: {
       size: 0,
@@ -120,6 +137,9 @@ async function getTransactionStats({
         bool: {
           filter: [
             ...filter,
+            ...getDocumentTypeFilterForAggregatedTransactions(
+              searchAggregatedTransactions
+            ),
             {
               terms: {
                 [TRANSACTION_TYPE]: [
@@ -132,15 +152,31 @@ async function getTransactionStats({
         },
       },
       track_total_hits: true,
-      aggs: { duration: { avg: { field: TRANSACTION_DURATION } } },
+      aggs: {
+        duration: {
+          avg: {
+            field: getTransactionDurationFieldForAggregatedTransactions(
+              searchAggregatedTransactions
+            ),
+          },
+        },
+        count: {
+          value_count: {
+            field: getTransactionDurationFieldForAggregatedTransactions(
+              searchAggregatedTransactions
+            ),
+          },
+        },
+      },
     },
   };
   const response = await apmEventClient.search(params);
-  const docCount = response.hits.total.value;
+
+  const totalRequests = response.aggregations?.count.value ?? 0;
 
   return {
     avgTransactionDuration: response.aggregations?.duration.value ?? null,
-    avgRequestsPerMinute: docCount > 0 ? docCount / minutes : null,
+    avgRequestsPerMinute: totalRequests > 0 ? totalRequests / minutes : null,
   };
 }
 
@@ -173,25 +209,50 @@ async function getMemoryStats({
   filter,
 }: TaskParameters): Promise<{ avgMemoryUsage: number | null }> {
   const { apmEventClient } = setup;
-  const response = await apmEventClient.search({
-    apm: {
-      events: [ProcessorEvent.metric],
-    },
-    body: {
-      query: {
-        bool: {
-          filter: [
-            ...filter,
-            { exists: { field: METRIC_SYSTEM_FREE_MEMORY } },
-            { exists: { field: METRIC_SYSTEM_TOTAL_MEMORY } },
-          ],
+
+  const getAvgMemoryUsage = async ({
+    additionalFilters,
+    script,
+  }: {
+    additionalFilters: ESFilter[];
+    script: typeof percentCgroupMemoryUsedScript;
+  }) => {
+    const response = await apmEventClient.search({
+      apm: {
+        events: [ProcessorEvent.metric],
+      },
+      body: {
+        size: 0,
+        query: {
+          bool: {
+            filter: [...filter, ...additionalFilters],
+          },
+        },
+        aggs: {
+          avgMemoryUsage: { avg: { script } },
         },
       },
-      aggs: { avgMemoryUsage: { avg: { script: percentMemoryUsedScript } } },
-    },
-  });
+    });
 
-  return {
-    avgMemoryUsage: response.aggregations?.avgMemoryUsage.value ?? null,
+    return response.aggregations?.avgMemoryUsage.value ?? null;
   };
+
+  let avgMemoryUsage = await getAvgMemoryUsage({
+    additionalFilters: [
+      { exists: { field: METRIC_CGROUP_MEMORY_USAGE_BYTES } },
+    ],
+    script: percentCgroupMemoryUsedScript,
+  });
+
+  if (!avgMemoryUsage) {
+    avgMemoryUsage = await getAvgMemoryUsage({
+      additionalFilters: [
+        { exists: { field: METRIC_SYSTEM_FREE_MEMORY } },
+        { exists: { field: METRIC_SYSTEM_TOTAL_MEMORY } },
+      ],
+      script: percentSystemMemoryUsedScript,
+    });
+  }
+
+  return { avgMemoryUsage };
 }
diff --git a/x-pack/plugins/apm/server/lib/services/__snapshots__/queries.test.ts.snap b/x-pack/plugins/apm/server/lib/services/__snapshots__/queries.test.ts.snap
index c5e072e073992..a65536df37bc8 100644
--- a/x-pack/plugins/apm/server/lib/services/__snapshots__/queries.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/services/__snapshots__/queries.test.ts.snap
@@ -156,9 +156,9 @@ Array [
   Object {
     "apm": Object {
       "events": Array [
+        "transaction",
         "metric",
         "error",
-        "transaction",
       ],
     },
     "body": Object {
@@ -213,7 +213,19 @@ Array [
       "aggs": Object {
         "services": Object {
           "aggs": Object {
+            "count": Object {
+              "value_count": Object {
+                "field": "transaction.duration.us",
+              },
+            },
             "timeseries": Object {
+              "aggs": Object {
+                "count": Object {
+                  "value_count": Object {
+                    "field": "transaction.duration.us",
+                  },
+                },
+              },
               "date_histogram": Object {
                 "extended_bounds": Object {
                   "max": 1528977600000,
@@ -328,8 +340,8 @@ Array [
   Object {
     "apm": Object {
       "events": Array [
-        "metric",
         "transaction",
+        "metric",
         "error",
       ],
     },
diff --git a/x-pack/plugins/apm/server/lib/services/annotations/get_derived_service_annotations.ts b/x-pack/plugins/apm/server/lib/services/annotations/get_derived_service_annotations.ts
index ad3f47d443b87..b80e86d53f292 100644
--- a/x-pack/plugins/apm/server/lib/services/annotations/get_derived_service_annotations.ts
+++ b/x-pack/plugins/apm/server/lib/services/annotations/get_derived_service_annotations.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { isNumber } from 'lodash';
-import { ProcessorEvent } from '../../../../common/processor_event';
 import { Annotation, AnnotationType } from '../../../../common/annotations';
 import { SetupTimeRange, Setup } from '../../helpers/setup_request';
 import { ESFilter } from '../../../../typings/elasticsearch';
@@ -14,20 +13,29 @@ import {
   SERVICE_VERSION,
 } from '../../../../common/elasticsearch_fieldnames';
 import { getEnvironmentUiFilterES } from '../../helpers/convert_ui_filters/get_environment_ui_filter_es';
+import {
+  getDocumentTypeFilterForAggregatedTransactions,
+  getProcessorEventForAggregatedTransactions,
+} from '../../helpers/aggregated_transactions';
 
 export async function getDerivedServiceAnnotations({
   setup,
   serviceName,
   environment,
+  searchAggregatedTransactions,
 }: {
   serviceName: string;
   environment?: string;
   setup: Setup & SetupTimeRange;
+  searchAggregatedTransactions: boolean;
 }) {
   const { start, end, apmEventClient } = setup;
 
   const filter: ESFilter[] = [
     { term: { [SERVICE_NAME]: serviceName } },
+    ...getDocumentTypeFilterForAggregatedTransactions(
+      searchAggregatedTransactions
+    ),
     ...getEnvironmentUiFilterES(environment),
   ];
 
@@ -35,7 +43,11 @@ export async function getDerivedServiceAnnotations({
     (
       await apmEventClient.search({
         apm: {
-          events: [ProcessorEvent.transaction],
+          events: [
+            getProcessorEventForAggregatedTransactions(
+              searchAggregatedTransactions
+            ),
+          ],
         },
         body: {
           size: 0,
@@ -62,7 +74,11 @@ export async function getDerivedServiceAnnotations({
     versions.map(async (version) => {
       const response = await apmEventClient.search({
         apm: {
-          events: [ProcessorEvent.transaction],
+          events: [
+            getProcessorEventForAggregatedTransactions(
+              searchAggregatedTransactions
+            ),
+          ],
         },
         body: {
           size: 0,
diff --git a/x-pack/plugins/apm/server/lib/services/annotations/index.test.ts b/x-pack/plugins/apm/server/lib/services/annotations/index.test.ts
index 04e6ef322e9ec..e1a3ee1c9380d 100644
--- a/x-pack/plugins/apm/server/lib/services/annotations/index.test.ts
+++ b/x-pack/plugins/apm/server/lib/services/annotations/index.test.ts
@@ -28,6 +28,7 @@ describe('getServiceAnnotations', () => {
             setup,
             serviceName: 'foo',
             environment: 'bar',
+            searchAggregatedTransactions: false,
           }),
         {
           mockResponse: () => noVersions,
@@ -46,6 +47,7 @@ describe('getServiceAnnotations', () => {
             setup,
             serviceName: 'foo',
             environment: 'bar',
+            searchAggregatedTransactions: false,
           }),
         {
           mockResponse: () => oneVersion,
@@ -69,6 +71,7 @@ describe('getServiceAnnotations', () => {
             setup,
             serviceName: 'foo',
             environment: 'bar',
+            searchAggregatedTransactions: false,
           }),
         {
           mockResponse: () => responses.shift(),
diff --git a/x-pack/plugins/apm/server/lib/services/annotations/index.ts b/x-pack/plugins/apm/server/lib/services/annotations/index.ts
index a5f8e595ccf54..9516ed3777297 100644
--- a/x-pack/plugins/apm/server/lib/services/annotations/index.ts
+++ b/x-pack/plugins/apm/server/lib/services/annotations/index.ts
@@ -11,6 +11,7 @@ import { getStoredAnnotations } from './get_stored_annotations';
 
 export async function getServiceAnnotations({
   setup,
+  searchAggregatedTransactions,
   serviceName,
   environment,
   annotationsClient,
@@ -20,6 +21,7 @@ export async function getServiceAnnotations({
   serviceName: string;
   environment?: string;
   setup: Setup & SetupTimeRange;
+  searchAggregatedTransactions: boolean;
   annotationsClient?: ScopedAnnotationsClient;
   apiCaller: LegacyAPICaller;
   logger: Logger;
@@ -30,6 +32,7 @@ export async function getServiceAnnotations({
     setup,
     serviceName,
     environment,
+    searchAggregatedTransactions,
   });
 
   const storedAnnotations = annotationsClient
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_agent_name.ts b/x-pack/plugins/apm/server/lib/services/get_service_agent_name.ts
index a95c27df0e502..17c27108f339d 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_agent_name.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_agent_name.ts
@@ -10,11 +10,17 @@ import {
 } from '../../../common/elasticsearch_fieldnames';
 import { rangeFilter } from '../../../common/utils/range_filter';
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
+import { getProcessorEventForAggregatedTransactions } from '../helpers/aggregated_transactions';
 
-export async function getServiceAgentName(
-  serviceName: string,
-  setup: Setup & SetupTimeRange
-) {
+export async function getServiceAgentName({
+  serviceName,
+  setup,
+  searchAggregatedTransactions,
+}: {
+  serviceName: string;
+  setup: Setup & SetupTimeRange;
+  searchAggregatedTransactions: boolean;
+}) {
   const { start, end, apmEventClient } = setup;
 
   const params = {
@@ -22,7 +28,9 @@ export async function getServiceAgentName(
     apm: {
       events: [
         ProcessorEvent.error,
-        ProcessorEvent.transaction,
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
         ProcessorEvent.metric,
       ],
     },
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_transaction_types.ts b/x-pack/plugins/apm/server/lib/services/get_service_transaction_types.ts
index 6c6e03ab0b46f..50b01484e9b44 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_transaction_types.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_transaction_types.ts
@@ -3,29 +3,44 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { ProcessorEvent } from '../../../common/processor_event';
 import {
   SERVICE_NAME,
   TRANSACTION_TYPE,
 } from '../../../common/elasticsearch_fieldnames';
 import { rangeFilter } from '../../../common/utils/range_filter';
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
+import {
+  getDocumentTypeFilterForAggregatedTransactions,
+  getProcessorEventForAggregatedTransactions,
+} from '../helpers/aggregated_transactions';
 
-export async function getServiceTransactionTypes(
-  serviceName: string,
-  setup: Setup & SetupTimeRange
-) {
+export async function getServiceTransactionTypes({
+  setup,
+  serviceName,
+  searchAggregatedTransactions,
+}: {
+  serviceName: string;
+  setup: Setup & SetupTimeRange;
+  searchAggregatedTransactions: boolean;
+}) {
   const { start, end, apmEventClient } = setup;
 
   const params = {
     apm: {
-      events: [ProcessorEvent.transaction],
+      events: [
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
+      ],
     },
     body: {
       size: 0,
       query: {
         bool: {
           filter: [
+            ...getDocumentTypeFilterForAggregatedTransactions(
+              searchAggregatedTransactions
+            ),
             { term: { [SERVICE_NAME]: serviceName } },
             { range: rangeFilter(start, end) },
           ],
diff --git a/x-pack/plugins/apm/server/lib/services/get_services/get_services_items.ts b/x-pack/plugins/apm/server/lib/services/get_services/get_services_items.ts
index 50a968467fb4b..c09be7aacc784 100644
--- a/x-pack/plugins/apm/server/lib/services/get_services/get_services_items.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_services/get_services_items.ts
@@ -26,14 +26,20 @@ export type ServicesItemsProjection = ReturnType<typeof getServicesProjection>;
 
 export async function getServicesItems({
   setup,
+  searchAggregatedTransactions,
   mlAnomaliesEnvironment,
 }: {
   setup: ServicesItemsSetup;
+  searchAggregatedTransactions: boolean;
   mlAnomaliesEnvironment?: string;
 }) {
   const params = {
-    projection: getServicesProjection({ setup }),
+    projection: getServicesProjection({
+      setup,
+      searchAggregatedTransactions,
+    }),
     setup,
+    searchAggregatedTransactions,
   };
 
   const [
diff --git a/x-pack/plugins/apm/server/lib/services/get_services/get_services_items_stats.ts b/x-pack/plugins/apm/server/lib/services/get_services/get_services_items_stats.ts
index ab6b61ca21746..e7e18cbff1c15 100644
--- a/x-pack/plugins/apm/server/lib/services/get_services/get_services_items_stats.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_services/get_services_items_stats.ts
@@ -8,7 +8,6 @@ import { EventOutcome } from '../../../../common/event_outcome';
 import { getSeverity } from '../../../../common/anomaly_detection';
 import { AgentName } from '../../../../typings/es_schemas/ui/fields/agent';
 import {
-  TRANSACTION_DURATION,
   AGENT_NAME,
   SERVICE_ENVIRONMENT,
   EVENT_OUTCOME,
@@ -19,6 +18,11 @@ import {
   ServicesItemsSetup,
   ServicesItemsProjection,
 } from './get_services_items';
+import {
+  getDocumentTypeFilterForAggregatedTransactions,
+  getProcessorEventForAggregatedTransactions,
+  getTransactionDurationFieldForAggregatedTransactions,
+} from '../../helpers/aggregated_transactions';
 import { getBucketSize } from '../../helpers/get_bucket_size';
 import {
   getMLJobIds,
@@ -43,21 +47,37 @@ const getDeltaAsMinutes = (setup: ServicesItemsSetup) =>
 interface AggregationParams {
   setup: ServicesItemsSetup;
   projection: ServicesItemsProjection;
+  searchAggregatedTransactions: boolean;
 }
 
 export const getTransactionDurationAverages = async ({
   setup,
   projection,
+  searchAggregatedTransactions,
 }: AggregationParams) => {
   const { apmEventClient, start, end } = setup;
 
   const response = await apmEventClient.search(
     mergeProjection(projection, {
       apm: {
-        events: [ProcessorEvent.transaction],
+        events: [
+          getProcessorEventForAggregatedTransactions(
+            searchAggregatedTransactions
+          ),
+        ],
       },
       body: {
         size: 0,
+        query: {
+          bool: {
+            filter: [
+              ...projection.body.query.bool.filter,
+              ...getDocumentTypeFilterForAggregatedTransactions(
+                searchAggregatedTransactions
+              ),
+            ],
+          },
+        },
         aggs: {
           services: {
             terms: {
@@ -67,7 +87,9 @@ export const getTransactionDurationAverages = async ({
             aggs: {
               average: {
                 avg: {
-                  field: TRANSACTION_DURATION,
+                  field: getTransactionDurationFieldForAggregatedTransactions(
+                    searchAggregatedTransactions
+                  ),
                 },
               },
               timeseries: {
@@ -75,7 +97,9 @@ export const getTransactionDurationAverages = async ({
                 aggs: {
                   average: {
                     avg: {
-                      field: TRANSACTION_DURATION,
+                      field: getTransactionDurationFieldForAggregatedTransactions(
+                        searchAggregatedTransactions
+                      ),
                     },
                   },
                 },
@@ -112,13 +136,6 @@ export const getAgentNames = async ({
   const { apmEventClient } = setup;
   const response = await apmEventClient.search(
     mergeProjection(projection, {
-      apm: {
-        events: [
-          ProcessorEvent.metric,
-          ProcessorEvent.error,
-          ProcessorEvent.transaction,
-        ],
-      },
       body: {
         size: 0,
         aggs: {
@@ -157,15 +174,30 @@ export const getAgentNames = async ({
 export const getTransactionRates = async ({
   setup,
   projection,
+  searchAggregatedTransactions,
 }: AggregationParams) => {
   const { apmEventClient, start, end } = setup;
   const response = await apmEventClient.search(
     mergeProjection(projection, {
       apm: {
-        events: [ProcessorEvent.transaction],
+        events: [
+          getProcessorEventForAggregatedTransactions(
+            searchAggregatedTransactions
+          ),
+        ],
       },
       body: {
         size: 0,
+        query: {
+          bool: {
+            filter: [
+              ...projection.body.query.bool.filter,
+              ...getDocumentTypeFilterForAggregatedTransactions(
+                searchAggregatedTransactions
+              ),
+            ],
+          },
+        },
         aggs: {
           services: {
             terms: {
@@ -173,8 +205,24 @@ export const getTransactionRates = async ({
               size: MAX_NUMBER_OF_SERVICES,
             },
             aggs: {
+              count: {
+                value_count: {
+                  field: getTransactionDurationFieldForAggregatedTransactions(
+                    searchAggregatedTransactions
+                  ),
+                },
+              },
               timeseries: {
                 date_histogram: getDateHistogramOpts(start, end),
+                aggs: {
+                  count: {
+                    value_count: {
+                      field: getTransactionDurationFieldForAggregatedTransactions(
+                        searchAggregatedTransactions
+                      ),
+                    },
+                  },
+                },
               },
             },
           },
@@ -192,14 +240,14 @@ export const getTransactionRates = async ({
   const deltaAsMinutes = getDeltaAsMinutes(setup);
 
   return aggregations.services.buckets.map((serviceBucket) => {
-    const transactionsPerMinute = serviceBucket.doc_count / deltaAsMinutes;
+    const transactionsPerMinute = serviceBucket.count.value / deltaAsMinutes;
     return {
       serviceName: serviceBucket.key as string,
       transactionsPerMinute: {
         value: transactionsPerMinute,
         timeseries: serviceBucket.timeseries.buckets.map((dateBucket) => ({
           x: dateBucket.key,
-          y: dateBucket.doc_count / deltaAsMinutes,
+          y: dateBucket.count.value / deltaAsMinutes,
         })),
       },
     };
@@ -305,13 +353,6 @@ export const getEnvironments = async ({
   const { apmEventClient } = setup;
   const response = await apmEventClient.search(
     mergeProjection(projection, {
-      apm: {
-        events: [
-          ProcessorEvent.metric,
-          ProcessorEvent.transaction,
-          ProcessorEvent.error,
-        ],
-      },
       body: {
         size: 0,
         aggs: {
diff --git a/x-pack/plugins/apm/server/lib/services/get_services/index.ts b/x-pack/plugins/apm/server/lib/services/get_services/index.ts
index 28b4c64a4af47..351457b2a815e 100644
--- a/x-pack/plugins/apm/server/lib/services/get_services/index.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_services/index.ts
@@ -19,13 +19,19 @@ export type ServiceListAPIResponse = PromiseReturnType<typeof getServices>;
 
 export async function getServices({
   setup,
+  searchAggregatedTransactions,
   mlAnomaliesEnvironment,
 }: {
   setup: Setup & SetupTimeRange & SetupUIFilters;
+  searchAggregatedTransactions: boolean;
   mlAnomaliesEnvironment?: string;
 }) {
   const [items, hasLegacyData] = await Promise.all([
-    getServicesItems({ setup, mlAnomaliesEnvironment }),
+    getServicesItems({
+      setup,
+      searchAggregatedTransactions,
+      mlAnomaliesEnvironment,
+    }),
     getLegacyDataStatus(setup),
   ]);
 
diff --git a/x-pack/plugins/apm/server/lib/services/queries.test.ts b/x-pack/plugins/apm/server/lib/services/queries.test.ts
index 9b0dd7a03ca5b..11adbe894f779 100644
--- a/x-pack/plugins/apm/server/lib/services/queries.test.ts
+++ b/x-pack/plugins/apm/server/lib/services/queries.test.ts
@@ -23,7 +23,11 @@ describe('services queries', () => {
 
   it('fetches the service agent name', async () => {
     mock = await inspectSearchParams((setup) =>
-      getServiceAgentName('foo', setup)
+      getServiceAgentName({
+        serviceName: 'foo',
+        setup,
+        searchAggregatedTransactions: false,
+      })
     );
 
     expect(mock.params).toMatchSnapshot();
@@ -31,14 +35,20 @@ describe('services queries', () => {
 
   it('fetches the service transaction types', async () => {
     mock = await inspectSearchParams((setup) =>
-      getServiceTransactionTypes('foo', setup)
+      getServiceTransactionTypes({
+        serviceName: 'foo',
+        setup,
+        searchAggregatedTransactions: false,
+      })
     );
 
     expect(mock.params).toMatchSnapshot();
   });
 
   it('fetches the service items', async () => {
-    mock = await inspectSearchParams((setup) => getServicesItems({ setup }));
+    mock = await inspectSearchParams((setup) =>
+      getServicesItems({ setup, searchAggregatedTransactions: false })
+    );
 
     const allParams = mock.spy.mock.calls.map((call) => call[0]);
 
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap b/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap
index c01e5c87eeea2..8db97a4929eb0 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap
@@ -84,6 +84,41 @@ Object {
 }
 `;
 
+exports[`agent configuration queries getAllEnvironments fetches all environments 1`] = `
+Object {
+  "apm": Object {
+    "events": Array [
+      "transaction",
+      "error",
+      "metric",
+    ],
+  },
+  "body": Object {
+    "aggs": Object {
+      "environments": Object {
+        "terms": Object {
+          "field": "service.environment",
+          "missing": undefined,
+          "size": 100,
+        },
+      },
+    },
+    "query": Object {
+      "bool": Object {
+        "filter": Array [
+          Object {
+            "term": Object {
+              "service.name": "foo",
+            },
+          },
+        ],
+      },
+    },
+    "size": 0,
+  },
+}
+`;
+
 exports[`agent configuration queries getExistingEnvironmentsForService fetches unavailable environments 1`] = `
 Object {
   "body": Object {
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/index.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/index.ts
index 630249052be0b..521fa9351cbfe 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/index.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/index.ts
@@ -17,12 +17,14 @@ export type AgentConfigurationEnvironmentsAPIResponse = PromiseReturnType<
 export async function getEnvironments({
   serviceName,
   setup,
+  searchAggregatedTransactions,
 }: {
   serviceName: string | undefined;
   setup: Setup;
+  searchAggregatedTransactions: boolean;
 }) {
   const [allEnvironments, existingEnvironments] = await Promise.all([
-    getAllEnvironments({ serviceName, setup }),
+    getAllEnvironments({ serviceName, setup, searchAggregatedTransactions }),
     getExistingEnvironmentsForService({ serviceName, setup }),
   ]);
 
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
index 91bdfeef003f1..3ca583c30c29e 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
@@ -9,17 +9,26 @@ import { Setup } from '../../helpers/setup_request';
 import { PromiseReturnType } from '../../../../../observability/typings/common';
 import { SERVICE_NAME } from '../../../../common/elasticsearch_fieldnames';
 import { ALL_OPTION_VALUE } from '../../../../common/agent_configuration/all_option';
+import { getProcessorEventForAggregatedTransactions } from '../../helpers/aggregated_transactions';
 
 export type AgentConfigurationServicesAPIResponse = PromiseReturnType<
   typeof getServiceNames
 >;
-export async function getServiceNames({ setup }: { setup: Setup }) {
+export async function getServiceNames({
+  setup,
+  searchAggregatedTransactions,
+}: {
+  setup: Setup;
+  searchAggregatedTransactions: boolean;
+}) {
   const { apmEventClient } = setup;
 
   const params = {
     apm: {
       events: [
-        ProcessorEvent.transaction,
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
         ProcessorEvent.error,
         ProcessorEvent.metric,
       ],
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/queries.test.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/queries.test.ts
index f035aa937c364..1efb50580d531 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/queries.test.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/queries.test.ts
@@ -13,6 +13,7 @@ import {
   inspectSearchParams,
 } from '../../../utils/test_helpers';
 import { findExactConfiguration } from './find_exact_configuration';
+import { getAllEnvironments } from '../../environments/get_all_environments';
 
 describe('agent configuration queries', () => {
   let mock: SearchParamsMock;
@@ -21,6 +22,20 @@ describe('agent configuration queries', () => {
     mock.teardown();
   });
 
+  describe('getAllEnvironments', () => {
+    it('fetches all environments', async () => {
+      mock = await inspectSearchParams((setup) =>
+        getAllEnvironments({
+          serviceName: 'foo',
+          setup,
+          searchAggregatedTransactions: false,
+        })
+      );
+
+      expect(mock.params).toMatchSnapshot();
+    });
+  });
+
   describe('getExistingEnvironmentsForService', () => {
     it('fetches unavailable environments', async () => {
       mock = await inspectSearchParams((setup) =>
@@ -39,6 +54,7 @@ describe('agent configuration queries', () => {
       mock = await inspectSearchParams((setup) =>
         getServiceNames({
           setup,
+          searchAggregatedTransactions: false,
         })
       );
 
diff --git a/x-pack/plugins/apm/server/lib/traces/get_trace_items.ts b/x-pack/plugins/apm/server/lib/traces/get_trace_items.ts
index 17f9743ae9f00..9aebadba23b2a 100644
--- a/x-pack/plugins/apm/server/lib/traces/get_trace_items.ts
+++ b/x-pack/plugins/apm/server/lib/traces/get_trace_items.ts
@@ -88,7 +88,7 @@ export async function getTraceItems(
     // explicit intermediary types to avoid TS "excessively deep" error
     PromiseValueType<typeof errorResponsePromise>,
     PromiseValueType<typeof traceResponsePromise>
-  ] = await Promise.all([errorResponsePromise, traceResponsePromise]);
+  ] = (await Promise.all([errorResponsePromise, traceResponsePromise])) as any;
 
   const exceedsMax = traceResponse.hits.total.value > maxTraceItems;
 
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/queries.test.ts.snap b/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/queries.test.ts.snap
index 0ea7bcf7ce8ab..bd6cefa793467 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/queries.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/__snapshots__/queries.test.ts.snap
@@ -12,8 +12,16 @@ Array [
       "aggs": Object {
         "transaction_groups": Object {
           "aggs": Object {
-            "sample": Object {
+            "count": Object {
+              "value_count": Object {
+                "field": "transaction.duration.us",
+              },
+            },
+            "transaction_type": Object {
               "top_hits": Object {
+                "_source": Array [
+                  "transaction.type",
+                ],
                 "size": 1,
               },
             },
@@ -64,27 +72,10 @@ Array [
               },
             },
           ],
-          "should": Array [
-            Object {
-              "term": Object {
-                "transaction.sampled": true,
-              },
-            },
-          ],
         },
       },
-      "sort": Array [
-        Object {
-          "_score": "desc",
-        },
-        Object {
-          "@timestamp": Object {
-            "order": "desc",
-          },
-        },
-      ],
+      "size": 0,
     },
-    "size": 0,
   },
   Object {
     "apm": Object {
@@ -150,8 +141,8 @@ Array [
           ],
         },
       },
+      "size": 0,
     },
-    "size": 0,
   },
   Object {
     "apm": Object {
@@ -217,8 +208,8 @@ Array [
           ],
         },
       },
+      "size": 0,
     },
-    "size": 0,
   },
 ]
 `;
@@ -235,8 +226,16 @@ Array [
       "aggs": Object {
         "transaction_groups": Object {
           "aggs": Object {
-            "sample": Object {
+            "count": Object {
+              "value_count": Object {
+                "field": "transaction.duration.us",
+              },
+            },
+            "transaction_type": Object {
               "top_hits": Object {
+                "_source": Array [
+                  "transaction.type",
+                ],
                 "size": 1,
               },
             },
@@ -275,27 +274,10 @@ Array [
               },
             },
           ],
-          "should": Array [
-            Object {
-              "term": Object {
-                "transaction.sampled": true,
-              },
-            },
-          ],
         },
       },
-      "sort": Array [
-        Object {
-          "_score": "desc",
-        },
-        Object {
-          "@timestamp": Object {
-            "order": "desc",
-          },
-        },
-      ],
+      "size": 0,
     },
-    "size": 0,
   },
   Object {
     "apm": Object {
@@ -349,8 +331,8 @@ Array [
           ],
         },
       },
+      "size": 0,
     },
-    "size": 0,
   },
   Object {
     "apm": Object {
@@ -404,8 +386,8 @@ Array [
           ],
         },
       },
+      "size": 0,
     },
-    "size": 0,
   },
   Object {
     "apm": Object {
@@ -465,8 +447,8 @@ Array [
           ],
         },
       },
+      "size": 0,
     },
-    "size": 0,
   },
 ]
 `;
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts b/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts
index 5c1e1839d9c53..5d581149db667 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts
@@ -15,17 +15,16 @@ import { getTransactionGroupsProjection } from '../../projections/transaction_gr
 import { mergeProjection } from '../../projections/util/merge_projection';
 import { PromiseReturnType } from '../../../../observability/typings/common';
 import { AggregationOptionsByType } from '../../../typings/elasticsearch/aggregations';
-import { Transaction } from '../../../typings/es_schemas/ui/transaction';
 import {
   Setup,
   SetupTimeRange,
   SetupUIFilters,
 } from '../helpers/setup_request';
 import {
-  getSamples,
   getAverages,
   getSums,
   getPercentiles,
+  getCounts,
 } from './get_transaction_group_stats';
 
 interface TopTransactionOptions {
@@ -33,11 +32,13 @@ interface TopTransactionOptions {
   serviceName: string;
   transactionType: string;
   transactionName?: string;
+  searchAggregatedTransactions: boolean;
 }
 
 interface TopTraceOptions {
   type: 'top_traces';
   transactionName?: string;
+  searchAggregatedTransactions: boolean;
 }
 
 export type Options = TopTransactionOptions | TopTraceOptions;
@@ -62,11 +63,11 @@ function getItemsWithRelativeImpact(
   setup: TransactionGroupSetup,
   items: Array<{
     sum?: number | null;
-    key: string | Record<string, any>;
+    key: string | Record<'service.name' | 'transaction.name', string>;
     avg?: number | null;
     count?: number | null;
+    transactionType?: string;
     p95?: number | null;
-    sample?: Transaction;
   }>
 ) {
   const values = items
@@ -79,21 +80,19 @@ function getItemsWithRelativeImpact(
   const duration = moment.duration(setup.end - setup.start);
   const minutes = duration.asMinutes();
 
-  const itemsWithRelativeImpact: TransactionGroup[] = items
-    .map((item) => {
-      return {
-        key: item.key,
-        averageResponseTime: item.avg,
-        transactionsPerMinute: (item.count ?? 0) / minutes,
-        impact:
-          item.sum !== null && item.sum !== undefined
-            ? ((item.sum - min) / (max - min)) * 100 || 0
-            : 0,
-        p95: item.p95,
-        sample: item.sample!,
-      };
-    })
-    .filter((item) => item.sample);
+  const itemsWithRelativeImpact = items.map((item) => {
+    return {
+      key: item.key,
+      averageResponseTime: item.avg,
+      transactionsPerMinute: (item.count ?? 0) / minutes,
+      transactionType: item.transactionType || '',
+      impact:
+        item.sum !== null && item.sum !== undefined
+          ? ((item.sum - min) / (max - min)) * 100 || 0
+          : 0,
+      p95: item.p95,
+    };
+  });
 
   return itemsWithRelativeImpact;
 }
@@ -119,8 +118,8 @@ export async function transactionGroupsFetcher(
   const size = isTopTraces ? 10000 : expectedBucketSize + 1;
 
   const request = mergeProjection(projection, {
-    size: 0,
     body: {
+      size: 0,
       aggs: {
         transaction_groups: {
           ...(isTopTraces
@@ -151,18 +150,19 @@ export async function transactionGroupsFetcher(
   const params = {
     request,
     setup,
+    searchAggregatedTransactions: options.searchAggregatedTransactions,
   };
 
-  const [samples, averages, sums, percentiles] = await Promise.all([
-    getSamples(params),
+  const [counts, averages, sums, percentiles] = await Promise.all([
+    getCounts(params),
     getAverages(params),
     getSums(params),
     !isTopTraces ? getPercentiles(params) : Promise.resolve(undefined),
   ]);
 
   const stats = [
-    ...samples,
     ...averages,
+    ...counts,
     ...sums,
     ...(percentiles ? percentiles : []),
   ];
@@ -171,11 +171,35 @@ export async function transactionGroupsFetcher(
 
   const itemsWithRelativeImpact = getItemsWithRelativeImpact(setup, items);
 
+  const defaultServiceName =
+    options.type === 'top_transactions' ? options.serviceName : undefined;
+
+  const itemsWithKeys: TransactionGroup[] = itemsWithRelativeImpact.map(
+    (item) => {
+      let transactionName: string;
+      let serviceName: string;
+
+      if (typeof item.key === 'string') {
+        transactionName = item.key;
+        serviceName = defaultServiceName!;
+      } else {
+        transactionName = item.key[TRANSACTION_NAME];
+        serviceName = item.key[SERVICE_NAME];
+      }
+
+      return {
+        ...item,
+        transactionName,
+        serviceName,
+      };
+    }
+  );
+
   return {
     items: take(
       // sort by impact by default so most impactful services are not cut off
-      sortBy(itemsWithRelativeImpact, 'impact').reverse(),
-      expectedBucketSize
+      sortBy(itemsWithKeys, 'impact').reverse(),
+      bucketSize
     ),
     // The aggregation is considered accurate if the configured bucket size is larger or equal to the number of buckets returned
     // the actual number of buckets retrieved are `bucketsize + 1` to detect whether it's above the limit
@@ -185,12 +209,12 @@ export async function transactionGroupsFetcher(
 }
 
 export interface TransactionGroup {
-  name?: string;
-  key?: Record<string, any> | string;
+  key: string | Record<'service.name' | 'transaction.name', string>;
+  serviceName: string;
+  transactionName: string;
+  transactionType: string;
   averageResponseTime: number | null | undefined;
   transactionsPerMinute: number;
   p95: number | null | undefined;
   impact: number;
-  impactRelative?: number;
-  sample: Transaction;
 }
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/get_error_rate.ts b/x-pack/plugins/apm/server/lib/transaction_groups/get_error_rate.ts
index 1e08b04416e17..82595317342f1 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/get_error_rate.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/get_error_rate.ts
@@ -87,12 +87,9 @@ export async function getErrorRate({
         doc_count: totalTransactions,
         erroneous_transactions: erroneousTransactions,
       }) => {
-        const errornousTransactionsCount =
-          // @ts-expect-error
-          erroneousTransactions.doc_count;
         return {
           x: key,
-          y: errornousTransactionsCount / totalTransactions,
+          y: erroneousTransactions.doc_count / totalTransactions,
         };
       }
     ) || [];
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/get_transaction_group_stats.ts b/x-pack/plugins/apm/server/lib/transaction_groups/get_transaction_group_stats.ts
index 7d45f39e08a83..2550bd70c527d 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/get_transaction_group_stats.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/get_transaction_group_stats.ts
@@ -4,20 +4,16 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { merge } from 'lodash';
+import { TRANSACTION_TYPE } from '../../../common/elasticsearch_fieldnames';
 import { arrayUnionToCallable } from '../../../common/utils/array_union_to_callable';
-import {
-  TRANSACTION_SAMPLED,
-  TRANSACTION_DURATION,
-} from '../../../common/elasticsearch_fieldnames';
-import {
-  AggregationInputMap,
-  SortOptions,
-} from '../../../typings/elasticsearch/aggregations';
+import { AggregationInputMap } from '../../../typings/elasticsearch/aggregations';
 import { TransactionGroupRequestBase, TransactionGroupSetup } from './fetcher';
+import { getTransactionDurationFieldForAggregatedTransactions } from '../helpers/aggregated_transactions';
 
 interface MetricParams {
   request: TransactionGroupRequestBase;
   setup: TransactionGroupSetup;
+  searchAggregatedTransactions: boolean;
 }
 
 type BucketKey = string | Record<string, string>;
@@ -37,51 +33,50 @@ function mergeRequestWithAggs<
   });
 }
 
-export async function getSamples({ request, setup }: MetricParams) {
+export async function getAverages({
+  request,
+  setup,
+  searchAggregatedTransactions,
+}: MetricParams) {
   const params = mergeRequestWithAggs(request, {
-    sample: {
-      top_hits: {
-        size: 1,
+    avg: {
+      avg: {
+        field: getTransactionDurationFieldForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
       },
     },
   });
 
-  const sort: SortOptions = [
-    { _score: 'desc' as const }, // sort by _score to ensure that buckets with sampled:true ends up on top
-    { '@timestamp': { order: 'desc' as const } },
-  ];
-
-  const response = await setup.apmEventClient.search({
-    ...params,
-    body: {
-      ...params.body,
-      query: {
-        ...params.body.query,
-        bool: {
-          ...params.body.query.bool,
-          should: [{ term: { [TRANSACTION_SAMPLED]: true } }],
-        },
-      },
-      sort,
-    },
-  });
+  const response = await setup.apmEventClient.search(params);
 
   return arrayUnionToCallable(
     response.aggregations?.transaction_groups.buckets ?? []
   ).map((bucket) => {
     return {
       key: bucket.key as BucketKey,
-      count: bucket.doc_count,
-      sample: bucket.sample.hits.hits[0]._source,
+      avg: bucket.avg.value,
     };
   });
 }
 
-export async function getAverages({ request, setup }: MetricParams) {
+export async function getCounts({
+  request,
+  setup,
+  searchAggregatedTransactions,
+}: MetricParams) {
   const params = mergeRequestWithAggs(request, {
-    avg: {
-      avg: {
-        field: TRANSACTION_DURATION,
+    count: {
+      value_count: {
+        field: getTransactionDurationFieldForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
+      },
+    },
+    transaction_type: {
+      top_hits: {
+        size: 1,
+        _source: [TRANSACTION_TYPE],
       },
     },
   });
@@ -91,18 +86,29 @@ export async function getAverages({ request, setup }: MetricParams) {
   return arrayUnionToCallable(
     response.aggregations?.transaction_groups.buckets ?? []
   ).map((bucket) => {
+    // type is Transaction | APMBaseDoc because it could be a metric document
+    const source = (bucket.transaction_type.hits.hits[0]
+      ._source as unknown) as { transaction: { type: string } };
+
     return {
       key: bucket.key as BucketKey,
-      avg: bucket.avg.value,
+      count: bucket.count.value,
+      transactionType: source.transaction.type,
     };
   });
 }
 
-export async function getSums({ request, setup }: MetricParams) {
+export async function getSums({
+  request,
+  setup,
+  searchAggregatedTransactions,
+}: MetricParams) {
   const params = mergeRequestWithAggs(request, {
     sum: {
       sum: {
-        field: TRANSACTION_DURATION,
+        field: getTransactionDurationFieldForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
       },
     },
   });
@@ -119,11 +125,17 @@ export async function getSums({ request, setup }: MetricParams) {
   });
 }
 
-export async function getPercentiles({ request, setup }: MetricParams) {
+export async function getPercentiles({
+  request,
+  setup,
+  searchAggregatedTransactions,
+}: MetricParams) {
   const params = mergeRequestWithAggs(request, {
     p95: {
       percentiles: {
-        field: TRANSACTION_DURATION,
+        field: getTransactionDurationFieldForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
         hdr: { number_of_significant_value_digits: 2 },
         percents: [95],
       },
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/get_transaction_sample_for_group.ts b/x-pack/plugins/apm/server/lib/transaction_groups/get_transaction_sample_for_group.ts
new file mode 100644
index 0000000000000..6c9b23b3dc079
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/get_transaction_sample_for_group.ts
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { maybe } from '../../../common/utils/maybe';
+import {
+  SERVICE_NAME,
+  TRANSACTION_NAME,
+  TRANSACTION_SAMPLED,
+} from '../../../common/elasticsearch_fieldnames';
+import { ProcessorEvent } from '../../../common/processor_event';
+import { rangeFilter } from '../../../common/utils/range_filter';
+import {
+  Setup,
+  SetupTimeRange,
+  SetupUIFilters,
+} from '../helpers/setup_request';
+
+export async function getTransactionSampleForGroup({
+  serviceName,
+  transactionName,
+  setup,
+}: {
+  serviceName: string;
+  transactionName: string;
+  setup: Setup & SetupTimeRange & SetupUIFilters;
+}) {
+  const { apmEventClient, start, end, uiFiltersES } = setup;
+
+  const filter = [
+    {
+      range: rangeFilter(start, end),
+    },
+    {
+      term: {
+        [SERVICE_NAME]: serviceName,
+      },
+    },
+    {
+      term: {
+        [TRANSACTION_NAME]: transactionName,
+      },
+    },
+    ...uiFiltersES,
+  ];
+
+  const getSampledTransaction = async () => {
+    const response = await apmEventClient.search({
+      terminateAfter: 1,
+      apm: {
+        events: [ProcessorEvent.transaction],
+      },
+      body: {
+        size: 1,
+        query: {
+          bool: {
+            filter: [...filter, { term: { [TRANSACTION_SAMPLED]: true } }],
+          },
+        },
+      },
+    });
+
+    return maybe(response.hits.hits[0]?._source);
+  };
+
+  const getUnsampledTransaction = async () => {
+    const response = await apmEventClient.search({
+      terminateAfter: 1,
+      apm: {
+        events: [ProcessorEvent.transaction],
+      },
+      body: {
+        size: 1,
+        query: {
+          bool: {
+            filter: [...filter, { term: { [TRANSACTION_SAMPLED]: false } }],
+          },
+        },
+      },
+    });
+
+    return maybe(response.hits.hits[0]?._source);
+  };
+
+  const [sampledTransaction, unsampledTransaction] = await Promise.all([
+    getSampledTransaction(),
+    getUnsampledTransaction(),
+  ]);
+
+  return sampledTransaction || unsampledTransaction;
+}
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/queries.test.ts b/x-pack/plugins/apm/server/lib/transaction_groups/queries.test.ts
index 5f36189224534..225e0c33dfabb 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/queries.test.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/queries.test.ts
@@ -25,6 +25,7 @@ describe('transaction group queries', () => {
           type: 'top_transactions',
           serviceName: 'foo',
           transactionType: 'bar',
+          searchAggregatedTransactions: false,
         },
         setup,
         bucketSize
@@ -42,6 +43,7 @@ describe('transaction group queries', () => {
       transactionGroupsFetcher(
         {
           type: 'top_traces',
+          searchAggregatedTransactions: false,
         },
         setup,
         bucketSize
diff --git a/x-pack/plugins/apm/server/lib/transactions/__snapshots__/queries.test.ts.snap b/x-pack/plugins/apm/server/lib/transactions/__snapshots__/queries.test.ts.snap
index 9bc4b1d69d9ac..e532265de24ec 100644
--- a/x-pack/plugins/apm/server/lib/transactions/__snapshots__/queries.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/transactions/__snapshots__/queries.test.ts.snap
@@ -358,6 +358,13 @@ Object {
       "transaction_results": Object {
         "aggs": Object {
           "timeseries": Object {
+            "aggs": Object {
+              "count": Object {
+                "value_count": Object {
+                  "field": "transaction.duration.us",
+                },
+              },
+            },
             "date_histogram": Object {
               "extended_bounds": Object {
                 "max": 1528977600000,
@@ -452,6 +459,13 @@ Object {
       "transaction_results": Object {
         "aggs": Object {
           "timeseries": Object {
+            "aggs": Object {
+              "count": Object {
+                "value_count": Object {
+                  "field": "transaction.duration.us",
+                },
+              },
+            },
             "date_histogram": Object {
               "extended_bounds": Object {
                 "max": 1528977600000,
@@ -551,6 +565,13 @@ Object {
       "transaction_results": Object {
         "aggs": Object {
           "timeseries": Object {
+            "aggs": Object {
+              "count": Object {
+                "value_count": Object {
+                  "field": "transaction.duration.us",
+                },
+              },
+            },
             "date_histogram": Object {
               "extended_bounds": Object {
                 "max": 1528977600000,
diff --git a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/__fixtures__/responses.ts b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/__fixtures__/responses.ts
index 520add0566fa1..44878aa6c1f2e 100644
--- a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/__fixtures__/responses.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/__fixtures__/responses.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { Transaction } from '../../../../../typings/es_schemas/ui/transaction';
+import { APMBaseDoc } from '../../../../../typings/es_schemas/raw/apm_base_doc';
 import {
   ESSearchResponse,
   ESSearchRequest,
@@ -68,7 +70,7 @@ export const response = ({
     },
   },
 } as unknown) as ESSearchResponse<
-  unknown,
+  APMBaseDoc | Transaction,
   ESSearchRequest,
   { restTotalHitsAsInt: false }
 >;
diff --git a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.test.ts b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.test.ts
index 278819ea20a83..aec124e4f4623 100644
--- a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.test.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.test.ts
@@ -20,7 +20,11 @@ describe('fetcher', () => {
       uiFiltersES: [],
     } as unknown) as Setup & SetupTimeRange & SetupUIFilters;
 
-    await fetcher({ serviceName: 'testServiceName', setup });
+    await fetcher({
+      serviceName: 'testServiceName',
+      setup,
+      searchAggregatedTransactions: false,
+    });
 
     expect(search).toHaveBeenCalled();
   });
diff --git a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts
index 51118278fb824..d40fcaaa02f60 100644
--- a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts
@@ -10,20 +10,27 @@ import {
   SERVICE_NAME,
   TRANSACTION_TYPE,
   USER_AGENT_NAME,
-  TRANSACTION_DURATION,
   TRANSACTION_NAME,
 } from '../../../../common/elasticsearch_fieldnames';
 import { rangeFilter } from '../../../../common/utils/range_filter';
 import { getBucketSize } from '../../helpers/get_bucket_size';
 import { Options } from '.';
 import { TRANSACTION_PAGE_LOAD } from '../../../../common/transaction_types';
-import { ProcessorEvent } from '../../../../common/processor_event';
+import {
+  getDocumentTypeFilterForAggregatedTransactions,
+  getTransactionDurationFieldForAggregatedTransactions,
+  getProcessorEventForAggregatedTransactions,
+} from '../../helpers/aggregated_transactions';
 
 export type ESResponse = PromiseReturnType<typeof fetcher>;
 
 export function fetcher(options: Options) {
   const { end, apmEventClient, start, uiFiltersES } = options.setup;
-  const { serviceName, transactionName } = options;
+  const {
+    serviceName,
+    searchAggregatedTransactions,
+    transactionName,
+  } = options;
   const { intervalString } = getBucketSize(start, end);
 
   const transactionNameFilter = transactionName
@@ -34,13 +41,20 @@ export function fetcher(options: Options) {
     { term: { [SERVICE_NAME]: serviceName } },
     { term: { [TRANSACTION_TYPE]: TRANSACTION_PAGE_LOAD } },
     { range: rangeFilter(start, end) },
+    ...getDocumentTypeFilterForAggregatedTransactions(
+      searchAggregatedTransactions
+    ),
     ...uiFiltersES,
     ...transactionNameFilter,
   ];
 
   const params = {
     apm: {
-      events: [ProcessorEvent.transaction],
+      events: [
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
+      ],
     },
     body: {
       size: 0,
@@ -69,7 +83,9 @@ export function fetcher(options: Options) {
               aggs: {
                 avg_duration: {
                   avg: {
-                    field: TRANSACTION_DURATION,
+                    field: getTransactionDurationFieldForAggregatedTransactions(
+                      searchAggregatedTransactions
+                    ),
                   },
                 },
               },
diff --git a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/index.ts b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/index.ts
index e3a0d9e26142a..2c259edaa26ab 100644
--- a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/index.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/index.ts
@@ -16,6 +16,7 @@ import { transformer } from './transformer';
 export interface Options {
   serviceName: string;
   setup: Setup & SetupTimeRange & SetupUIFilters;
+  searchAggregatedTransactions: boolean;
   transactionName?: string;
 }
 
diff --git a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_country/index.ts b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_country/index.ts
index 3954d99cd52a8..bc1e0af051ace 100644
--- a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_country/index.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_country/index.ts
@@ -4,11 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ProcessorEvent } from '../../../../common/processor_event';
 import {
   CLIENT_GEO_COUNTRY_ISO_CODE,
   SERVICE_NAME,
-  TRANSACTION_DURATION,
   TRANSACTION_TYPE,
   TRANSACTION_NAME,
 } from '../../../../common/elasticsearch_fieldnames';
@@ -19,15 +17,22 @@ import {
 } from '../../helpers/setup_request';
 import { rangeFilter } from '../../../../common/utils/range_filter';
 import { TRANSACTION_PAGE_LOAD } from '../../../../common/transaction_types';
+import {
+  getProcessorEventForAggregatedTransactions,
+  getTransactionDurationFieldForAggregatedTransactions,
+  getDocumentTypeFilterForAggregatedTransactions,
+} from '../../helpers/aggregated_transactions';
 
 export async function getTransactionAvgDurationByCountry({
   setup,
   serviceName,
   transactionName,
+  searchAggregatedTransactions,
 }: {
   setup: Setup & SetupTimeRange & SetupUIFilters;
   serviceName: string;
   transactionName?: string;
+  searchAggregatedTransactions: boolean;
 }) {
   const { uiFiltersES, apmEventClient, start, end } = setup;
   const transactionNameFilter = transactionName
@@ -35,7 +40,11 @@ export async function getTransactionAvgDurationByCountry({
     : [];
   const params = {
     apm: {
-      events: [ProcessorEvent.transaction],
+      events: [
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
+      ],
     },
     body: {
       size: 0,
@@ -48,6 +57,9 @@ export async function getTransactionAvgDurationByCountry({
             { exists: { field: CLIENT_GEO_COUNTRY_ISO_CODE } },
             { range: rangeFilter(start, end) },
             ...uiFiltersES,
+            ...getDocumentTypeFilterForAggregatedTransactions(
+              searchAggregatedTransactions
+            ),
           ],
         },
       },
@@ -58,8 +70,19 @@ export async function getTransactionAvgDurationByCountry({
             size: 500,
           },
           aggs: {
+            count: {
+              value_count: {
+                field: getTransactionDurationFieldForAggregatedTransactions(
+                  searchAggregatedTransactions
+                ),
+              },
+            },
             avg_duration: {
-              avg: { field: TRANSACTION_DURATION },
+              avg: {
+                field: getTransactionDurationFieldForAggregatedTransactions(
+                  searchAggregatedTransactions
+                ),
+              },
             },
           },
         },
@@ -75,10 +98,9 @@ export async function getTransactionAvgDurationByCountry({
 
   const buckets = resp.aggregations.country_code.buckets;
   const avgDurationsByCountry = buckets.map(
-    // eslint-disable-next-line @typescript-eslint/naming-convention
-    ({ key, doc_count, avg_duration: { value } }) => ({
+    ({ key, count, avg_duration: { value } }) => ({
       key: key as string,
-      docCount: doc_count,
+      docCount: count.value,
       value: value === null ? 0 : value,
     })
   );
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/__snapshots__/fetcher.test.ts.snap b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/__snapshots__/fetcher.test.ts.snap
index 7bc60a7fc7f1a..fb696b40f4ab4 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/__snapshots__/fetcher.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/__snapshots__/fetcher.test.ts.snap
@@ -49,6 +49,13 @@ Array [
           "transaction_results": Object {
             "aggs": Object {
               "timeseries": Object {
+                "aggs": Object {
+                  "count": Object {
+                    "value_count": Object {
+                      "field": "transaction.duration.us",
+                    },
+                  },
+                },
                 "date_histogram": Object {
                   "extended_bounds": Object {
                     "max": 1528977600000,
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/__snapshots__/transform.test.ts.snap b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/__snapshots__/transform.test.ts.snap
index fc9edb496784f..46d6c1425d599 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/__snapshots__/transform.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/__snapshots__/transform.test.ts.snap
@@ -2,2304 +2,4096 @@
 
 exports[`timeseriesTransformer should match snapshot 1`] = `
 Object {
-  "overallAvgDuration": 32861.15660262639,
+  "overallAvgDuration": 73065.05176360115,
   "responseTimes": Object {
     "avg": Array [
       Object {
-        "x": 1528113600000,
-        "y": 26310.63483891513,
+        "x": 1593852000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593852600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593853200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593853800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593854400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593855000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593855600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593856200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593856800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593857400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593858000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593858600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593859200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593859800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593860400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593861000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593861600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593862200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593862800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593863400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593864000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593864600000,
+        "y": null,
       },
       Object {
-        "x": 1528124400000,
-        "y": 26193.277795595466,
+        "x": 1593865200000,
+        "y": null,
       },
       Object {
-        "x": 1528135200000,
-        "y": 25291.787065995228,
+        "x": 1593865800000,
+        "y": null,
       },
       Object {
-        "x": 1528146000000,
-        "y": 24690.306474667796,
+        "x": 1593866400000,
+        "y": null,
       },
       Object {
-        "x": 1528156800000,
-        "y": 24809.8953814219,
+        "x": 1593867000000,
+        "y": null,
       },
       Object {
-        "x": 1528167600000,
-        "y": 25460.0394764508,
+        "x": 1593867600000,
+        "y": null,
       },
       Object {
-        "x": 1528178400000,
-        "y": 26360.440733498916,
+        "x": 1593868200000,
+        "y": null,
       },
       Object {
-        "x": 1528189200000,
-        "y": 27050.95205479452,
+        "x": 1593868800000,
+        "y": null,
       },
       Object {
-        "x": 1528200000000,
-        "y": 26555.857333903925,
+        "x": 1593869400000,
+        "y": null,
       },
       Object {
-        "x": 1528210800000,
-        "y": 26164.343359049206,
+        "x": 1593870000000,
+        "y": null,
       },
       Object {
-        "x": 1528221600000,
-        "y": 26989.84546419098,
+        "x": 1593870600000,
+        "y": null,
       },
       Object {
-        "x": 1528232400000,
-        "y": 26314.409430068266,
+        "x": 1593871200000,
+        "y": null,
       },
       Object {
-        "x": 1528243200000,
-        "y": 27460.774575018477,
+        "x": 1593871800000,
+        "y": null,
       },
       Object {
-        "x": 1528254000000,
-        "y": 26461.469107431974,
+        "x": 1593872400000,
+        "y": null,
       },
       Object {
-        "x": 1528264800000,
-        "y": 27657.584946692834,
+        "x": 1593873000000,
+        "y": null,
       },
       Object {
-        "x": 1528275600000,
-        "y": 27940.445967005213,
+        "x": 1593873600000,
+        "y": null,
       },
       Object {
-        "x": 1528286400000,
-        "y": 34454.377581534434,
+        "x": 1593874200000,
+        "y": null,
       },
       Object {
-        "x": 1528297200000,
-        "y": 44024.31809353839,
+        "x": 1593874800000,
+        "y": null,
       },
       Object {
-        "x": 1528308000000,
-        "y": 36374.53333333333,
+        "x": 1593875400000,
+        "y": null,
       },
       Object {
-        "x": 1528318800000,
-        "y": 36991.29442471209,
+        "x": 1593876000000,
+        "y": null,
       },
       Object {
-        "x": 1528329600000,
-        "y": 37178.002701986756,
+        "x": 1593876600000,
+        "y": null,
       },
       Object {
-        "x": 1528340400000,
-        "y": 37605.57078923814,
+        "x": 1593877200000,
+        "y": null,
       },
       Object {
-        "x": 1528351200000,
-        "y": 37319.89767295267,
+        "x": 1593877800000,
+        "y": null,
       },
       Object {
-        "x": 1528362000000,
-        "y": 38709.5041348433,
+        "x": 1593878400000,
+        "y": null,
       },
       Object {
-        "x": 1528372800000,
-        "y": 38140.131856255066,
+        "x": 1593879000000,
+        "y": null,
       },
       Object {
-        "x": 1528383600000,
-        "y": 34564.81091043125,
+        "x": 1593879600000,
+        "y": null,
       },
       Object {
-        "x": 1528394400000,
-        "y": 33256.37743828302,
+        "x": 1593880200000,
+        "y": null,
       },
       Object {
-        "x": 1528405200000,
-        "y": 37251.5625266752,
+        "x": 1593880800000,
+        "y": null,
       },
       Object {
-        "x": 1528416000000,
-        "y": 38681.89084929791,
+        "x": 1593881400000,
+        "y": null,
       },
       Object {
-        "x": 1528426800000,
-        "y": 40677.801045709355,
+        "x": 1593882000000,
+        "y": null,
       },
       Object {
-        "x": 1528437600000,
-        "y": 39987.86453616932,
+        "x": 1593882600000,
+        "y": null,
       },
       Object {
-        "x": 1528448400000,
-        "y": 41059.392914139804,
+        "x": 1593883200000,
+        "y": null,
       },
       Object {
-        "x": 1528459200000,
-        "y": 39630.710111535845,
+        "x": 1593883800000,
+        "y": null,
       },
       Object {
-        "x": 1528470000000,
-        "y": 41561.81331074284,
+        "x": 1593884400000,
+        "y": null,
       },
       Object {
-        "x": 1528480800000,
-        "y": 43079.490738297536,
+        "x": 1593885000000,
+        "y": null,
       },
       Object {
-        "x": 1528491600000,
-        "y": 43925.39609283509,
+        "x": 1593885600000,
+        "y": null,
       },
       Object {
-        "x": 1528502400000,
-        "y": 25821.91424646782,
+        "x": 1593886200000,
+        "y": null,
       },
       Object {
-        "x": 1528513200000,
-        "y": 27343.60011755486,
+        "x": 1593886800000,
+        "y": null,
       },
       Object {
-        "x": 1528524000000,
-        "y": 25249.95060523233,
+        "x": 1593887400000,
+        "y": null,
       },
       Object {
-        "x": 1528534800000,
-        "y": 25492.77199074074,
+        "x": 1593888000000,
+        "y": null,
       },
       Object {
-        "x": 1528545600000,
-        "y": 25991.647281682137,
+        "x": 1593888600000,
+        "y": 43364.46153846154,
       },
       Object {
-        "x": 1528556400000,
-        "y": 26273.31290445375,
+        "x": 1593889200000,
+        "y": 147903.58671586716,
       },
       Object {
-        "x": 1528567200000,
-        "y": 26234.98976780795,
+        "x": 1593889800000,
+        "y": 57370.52342487884,
       },
       Object {
-        "x": 1528578000000,
-        "y": 23494.54873786408,
+        "x": 1593890400000,
+        "y": 59687.82558139535,
       },
       Object {
-        "x": 1528588800000,
-        "y": 22008.80482069371,
+        "x": 1593891000000,
+        "y": 51810.68111455108,
       },
       Object {
-        "x": 1528599600000,
-        "y": 22828.136655635586,
+        "x": 1593891600000,
+        "y": 51736.59420289855,
       },
       Object {
-        "x": 1528610400000,
-        "y": 22138.7081404321,
+        "x": 1593892200000,
+        "y": 37241.293224299065,
       },
       Object {
-        "x": 1528621200000,
-        "y": 22634.985579811735,
+        "x": 1593892800000,
+        "y": 49444.90771558245,
       },
       Object {
-        "x": 1528632000000,
-        "y": 22202.780998080616,
+        "x": 1593893400000,
+        "y": 56807.80495356037,
       },
       Object {
-        "x": 1528642800000,
-        "y": 23084.082780163997,
+        "x": 1593894000000,
+        "y": 43238.74519846351,
       },
       Object {
-        "x": 1528653600000,
-        "y": 23109.666146341464,
+        "x": 1593894600000,
+        "y": 51754.80149253731,
       },
       Object {
-        "x": 1528664400000,
-        "y": 23306.89028152719,
+        "x": 1593895200000,
+        "y": 47166.5964343598,
       },
       Object {
-        "x": 1528675200000,
-        "y": 39341.022704095325,
+        "x": 1593895800000,
+        "y": 41854.688405797104,
       },
       Object {
-        "x": 1528686000000,
-        "y": 37467.17153341258,
+        "x": 1593896400000,
+        "y": 30464.317912218266,
       },
       Object {
-        "x": 1528696800000,
-        "y": 52457.50554180566,
+        "x": 1593897000000,
+        "y": 41558.531380753135,
       },
       Object {
-        "x": 1528707600000,
-        "y": 31327.95780166252,
+        "x": 1593897600000,
+        "y": 41159.68345323741,
       },
       Object {
-        "x": 1528718400000,
-        "y": 30695.334941163997,
+        "x": 1593898200000,
+        "y": 34211.03967168263,
       },
       Object {
-        "x": 1528729200000,
-        "y": 28895.042785967435,
+        "x": 1593898800000,
+        "y": 41322.30621301775,
       },
       Object {
-        "x": 1528740000000,
-        "y": 30649.363989982416,
+        "x": 1593899400000,
+        "y": 42301.523605150214,
       },
       Object {
-        "x": 1528750800000,
-        "y": 29802.63622014101,
+        "x": 1593900000000,
+        "y": 59615.69343065693,
       },
       Object {
-        "x": 1528761600000,
-        "y": 30759.03002829892,
+        "x": 1593900600000,
+        "y": 29567.520050125313,
       },
       Object {
-        "x": 1528772400000,
-        "y": 30399.76549608631,
+        "x": 1593901200000,
+        "y": 56104.7484375,
       },
       Object {
-        "x": 1528783200000,
-        "y": 29421.610233534506,
+        "x": 1593901800000,
+        "y": 40900.70954356847,
       },
       Object {
-        "x": 1528794000000,
-        "y": 32641.679897096656,
+        "x": 1593902400000,
+        "y": null,
       },
       Object {
-        "x": 1528804800000,
-        "y": 30621.65440666204,
+        "x": 1593903000000,
+        "y": null,
       },
       Object {
-        "x": 1528815600000,
-        "y": 31039.60391005818,
+        "x": 1593903600000,
+        "y": 141618.04,
       },
       Object {
-        "x": 1528826400000,
-        "y": 30954.760723541545,
+        "x": 1593904200000,
+        "y": null,
       },
       Object {
-        "x": 1528837200000,
-        "y": 31902.050234568553,
+        "x": 1593904800000,
+        "y": null,
       },
       Object {
-        "x": 1528848000000,
-        "y": 31594.350653473728,
+        "x": 1593905400000,
+        "y": null,
       },
       Object {
-        "x": 1528858800000,
-        "y": 31343.87243248879,
+        "x": 1593906000000,
+        "y": 380742.48780487804,
       },
       Object {
-        "x": 1528869600000,
-        "y": 31200.14450867052,
+        "x": 1593906600000,
+        "y": null,
       },
       Object {
-        "x": 1528880400000,
-        "y": 28560.946668743833,
+        "x": 1593907200000,
+        "y": null,
       },
       Object {
-        "x": 1528891200000,
-        "y": 24700.216146371717,
+        "x": 1593907800000,
+        "y": null,
       },
       Object {
-        "x": 1528902000000,
-        "y": 25261.025210523563,
+        "x": 1593908400000,
+        "y": null,
       },
       Object {
-        "x": 1528912800000,
-        "y": 26041.39789649068,
+        "x": 1593909000000,
+        "y": null,
       },
       Object {
-        "x": 1528923600000,
-        "y": 26123.556295209142,
+        "x": 1593909600000,
+        "y": null,
       },
       Object {
-        "x": 1528934400000,
-        "y": 46231.36177177638,
+        "x": 1593910200000,
+        "y": 122524.7027027027,
       },
       Object {
-        "x": 1528945200000,
-        "y": 45350.42005506141,
+        "x": 1593910800000,
+        "y": null,
       },
       Object {
-        "x": 1528956000000,
-        "y": 48256.049354513096,
+        "x": 1593911400000,
+        "y": null,
       },
       Object {
-        "x": 1528966800000,
-        "y": 52360.30017052116,
+        "x": 1593912000000,
+        "y": null,
       },
       Object {
-        "x": 1528977600000,
+        "x": 1593912600000,
         "y": null,
       },
-    ],
-    "p95": Array [
       Object {
-        "x": 1528113600000,
-        "y": 82172.85648714812,
+        "x": 1593913200000,
+        "y": null,
       },
       Object {
-        "x": 1528124400000,
-        "y": 80738.78571428556,
+        "x": 1593913800000,
+        "y": null,
       },
       Object {
-        "x": 1528135200000,
-        "y": 77058.03529411761,
+        "x": 1593914400000,
+        "y": null,
       },
       Object {
-        "x": 1528146000000,
-        "y": 77892.20721980717,
+        "x": 1593915000000,
+        "y": null,
       },
       Object {
-        "x": 1528156800000,
-        "y": 77085.86687499998,
+        "x": 1593915600000,
+        "y": null,
       },
       Object {
-        "x": 1528167600000,
-        "y": 80048.3462981744,
+        "x": 1593916200000,
+        "y": null,
       },
       Object {
-        "x": 1528178400000,
-        "y": 84089.21370223971,
+        "x": 1593916800000,
+        "y": 160060.1081081081,
       },
       Object {
-        "x": 1528189200000,
-        "y": 84880.90143416924,
+        "x": 1593917400000,
+        "y": null,
       },
       Object {
-        "x": 1528200000000,
-        "y": 84554.8884781166,
+        "x": 1593918000000,
+        "y": null,
       },
       Object {
-        "x": 1528210800000,
-        "y": 81839.39583333326,
+        "x": 1593918600000,
+        "y": null,
       },
       Object {
-        "x": 1528221600000,
-        "y": 85993.55410163336,
+        "x": 1593919200000,
+        "y": null,
       },
       Object {
-        "x": 1528232400000,
-        "y": 85001.44588628765,
+        "x": 1593919800000,
+        "y": null,
       },
       Object {
-        "x": 1528243200000,
-        "y": 86980.16445312503,
+        "x": 1593920400000,
+        "y": null,
       },
       Object {
-        "x": 1528254000000,
-        "y": 84961.8710743802,
+        "x": 1593921000000,
+        "y": null,
       },
       Object {
-        "x": 1528264800000,
-        "y": 88906.54601889332,
+        "x": 1593921600000,
+        "y": null,
       },
       Object {
-        "x": 1528275600000,
-        "y": 90198.34708994703,
+        "x": 1593922200000,
+        "y": null,
       },
       Object {
-        "x": 1528286400000,
-        "y": 135627.71242424246,
+        "x": 1593922800000,
+        "y": null,
       },
       Object {
-        "x": 1528297200000,
-        "y": 167037.1993837535,
+        "x": 1593923400000,
+        "y": 70357.234375,
       },
       Object {
-        "x": 1528308000000,
-        "y": 128293.12184873945,
+        "x": 1593924000000,
+        "y": null,
       },
       Object {
-        "x": 1528318800000,
-        "y": 130653.54236263742,
+        "x": 1593924600000,
+        "y": null,
       },
       Object {
-        "x": 1528329600000,
-        "y": 131630.8902645502,
+        "x": 1593925200000,
+        "y": null,
       },
       Object {
-        "x": 1528340400000,
-        "y": 133581.33541666638,
+        "x": 1593925800000,
+        "y": null,
       },
       Object {
-        "x": 1528351200000,
-        "y": 132697.92762266204,
+        "x": 1593926400000,
+        "y": null,
       },
       Object {
-        "x": 1528362000000,
-        "y": 140003.6918918918,
+        "x": 1593927000000,
+        "y": null,
       },
       Object {
-        "x": 1528372800000,
-        "y": 138149.5673529411,
+        "x": 1593927600000,
+        "y": null,
       },
       Object {
-        "x": 1528383600000,
-        "y": 121872.37504835591,
+        "x": 1593928200000,
+        "y": null,
       },
       Object {
-        "x": 1528394400000,
-        "y": 116378.03873517792,
+        "x": 1593928800000,
+        "y": null,
       },
       Object {
-        "x": 1528405200000,
-        "y": 131545.40999999995,
+        "x": 1593929400000,
+        "y": null,
       },
       Object {
-        "x": 1528416000000,
-        "y": 133111.25804878055,
+        "x": 1593930000000,
+        "y": 269745.9036144578,
       },
       Object {
-        "x": 1528426800000,
-        "y": 144821.9855278593,
+        "x": 1593930600000,
+        "y": null,
       },
       Object {
-        "x": 1528437600000,
-        "y": 134737.3997727272,
+        "x": 1593931200000,
+        "y": null,
       },
       Object {
-        "x": 1528448400000,
-        "y": 141206.57726666646,
+        "x": 1593931800000,
+        "y": null,
       },
       Object {
-        "x": 1528459200000,
-        "y": 137731.8994082841,
+        "x": 1593932400000,
+        "y": 313349.95238095237,
       },
       Object {
-        "x": 1528470000000,
-        "y": 141476.23189033198,
+        "x": 1593933000000,
+        "y": null,
       },
       Object {
-        "x": 1528480800000,
-        "y": 149636.31340909077,
+        "x": 1593933600000,
+        "y": null,
       },
       Object {
-        "x": 1528491600000,
-        "y": 151934.55000000002,
+        "x": 1593934200000,
+        "y": null,
       },
       Object {
-        "x": 1528502400000,
-        "y": 82198.17857142858,
+        "x": 1593934800000,
+        "y": null,
       },
       Object {
-        "x": 1528513200000,
-        "y": 85946.43199999983,
+        "x": 1593935400000,
+        "y": null,
       },
       Object {
-        "x": 1528524000000,
-        "y": 78617.66249999996,
+        "x": 1593936000000,
+        "y": null,
       },
       Object {
-        "x": 1528534800000,
-        "y": 79606.48333333322,
+        "x": 1593936600000,
+        "y": 397251.288372093,
       },
       Object {
-        "x": 1528545600000,
-        "y": 76297.93999999986,
+        "x": 1593937200000,
+        "y": 361953.5931174089,
       },
       Object {
-        "x": 1528556400000,
-        "y": 80742.63333333324,
+        "x": 1593937800000,
+        "y": 259173.0694980695,
       },
       Object {
-        "x": 1528567200000,
-        "y": 81291.45969696966,
+        "x": 1593938400000,
+        "y": 79648.20935412026,
       },
+    ],
+    "p95": Array [
       Object {
-        "x": 1528578000000,
-        "y": 73467.02500000004,
+        "x": 1593852000000,
+        "y": null,
       },
       Object {
-        "x": 1528588800000,
-        "y": 69177.66999999993,
+        "x": 1593852600000,
+        "y": null,
       },
       Object {
-        "x": 1528599600000,
-        "y": 71956.06111111109,
+        "x": 1593853200000,
+        "y": null,
       },
       Object {
-        "x": 1528610400000,
-        "y": 68480.91142857139,
+        "x": 1593853800000,
+        "y": null,
       },
       Object {
-        "x": 1528621200000,
-        "y": 68957.0999999999,
+        "x": 1593854400000,
+        "y": null,
       },
       Object {
-        "x": 1528632000000,
-        "y": 67489.50416666668,
+        "x": 1593855000000,
+        "y": null,
       },
       Object {
-        "x": 1528642800000,
-        "y": 71556.91249999998,
+        "x": 1593855600000,
+        "y": null,
       },
       Object {
-        "x": 1528653600000,
-        "y": 72157.65128205132,
+        "x": 1593856200000,
+        "y": null,
       },
       Object {
-        "x": 1528664400000,
-        "y": 76124.5625,
+        "x": 1593856800000,
+        "y": null,
       },
       Object {
-        "x": 1528675200000,
-        "y": 141709.34661835746,
+        "x": 1593857400000,
+        "y": null,
       },
       Object {
-        "x": 1528686000000,
-        "y": 132371.48641975303,
+        "x": 1593858000000,
+        "y": null,
       },
       Object {
-        "x": 1528696800000,
-        "y": 186783.51503759398,
+        "x": 1593858600000,
+        "y": null,
       },
       Object {
-        "x": 1528707600000,
-        "y": 99540.17819499348,
+        "x": 1593859200000,
+        "y": null,
       },
       Object {
-        "x": 1528718400000,
-        "y": 95982.62454212455,
+        "x": 1593859800000,
+        "y": null,
       },
       Object {
-        "x": 1528729200000,
-        "y": 89559.3525925925,
+        "x": 1593860400000,
+        "y": null,
       },
       Object {
-        "x": 1528740000000,
-        "y": 95769.83153735634,
+        "x": 1593861000000,
+        "y": null,
       },
       Object {
-        "x": 1528750800000,
-        "y": 94063.90833755062,
+        "x": 1593861600000,
+        "y": null,
       },
       Object {
-        "x": 1528761600000,
-        "y": 96399.67269119772,
+        "x": 1593862200000,
+        "y": null,
       },
       Object {
-        "x": 1528772400000,
-        "y": 96436.42520161276,
+        "x": 1593862800000,
+        "y": null,
       },
       Object {
-        "x": 1528783200000,
-        "y": 91860.16988095238,
+        "x": 1593863400000,
+        "y": null,
       },
       Object {
-        "x": 1528794000000,
-        "y": 105989.8333333334,
+        "x": 1593864000000,
+        "y": null,
       },
       Object {
-        "x": 1528804800000,
-        "y": 97937.60342555979,
+        "x": 1593864600000,
+        "y": null,
       },
       Object {
-        "x": 1528815600000,
-        "y": 98967.2249999999,
+        "x": 1593865200000,
+        "y": null,
       },
       Object {
-        "x": 1528826400000,
-        "y": 97561.02469135808,
+        "x": 1593865800000,
+        "y": null,
       },
       Object {
-        "x": 1528837200000,
-        "y": 102557.78813357186,
+        "x": 1593866400000,
+        "y": null,
       },
       Object {
-        "x": 1528848000000,
-        "y": 100137.87578595306,
+        "x": 1593867000000,
+        "y": null,
       },
       Object {
-        "x": 1528858800000,
-        "y": 98412.97120445351,
+        "x": 1593867600000,
+        "y": null,
       },
       Object {
-        "x": 1528869600000,
-        "y": 101607.8328012912,
+        "x": 1593868200000,
+        "y": null,
       },
       Object {
-        "x": 1528880400000,
-        "y": 92000.51368421057,
+        "x": 1593868800000,
+        "y": null,
       },
       Object {
-        "x": 1528891200000,
-        "y": 78027.29473684198,
+        "x": 1593869400000,
+        "y": null,
       },
       Object {
-        "x": 1528902000000,
-        "y": 80762.078801789,
+        "x": 1593870000000,
+        "y": null,
       },
       Object {
-        "x": 1528912800000,
-        "y": 81160.83425925927,
+        "x": 1593870600000,
+        "y": null,
       },
       Object {
-        "x": 1528923600000,
-        "y": 84215.58945578222,
+        "x": 1593871200000,
+        "y": null,
       },
       Object {
-        "x": 1528934400000,
-        "y": 194188.21428571426,
+        "x": 1593871800000,
+        "y": null,
       },
       Object {
-        "x": 1528945200000,
-        "y": 172616.2293896504,
+        "x": 1593872400000,
+        "y": null,
       },
       Object {
-        "x": 1528956000000,
-        "y": 182653.81858220184,
+        "x": 1593873000000,
+        "y": null,
       },
       Object {
-        "x": 1528966800000,
-        "y": 194970.75667682925,
+        "x": 1593873600000,
+        "y": null,
       },
       Object {
-        "x": 1528977600000,
+        "x": 1593874200000,
         "y": null,
       },
-    ],
-    "p99": Array [
       Object {
-        "x": 1528113600000,
-        "y": 293866.3866666665,
+        "x": 1593874800000,
+        "y": null,
       },
       Object {
-        "x": 1528124400000,
-        "y": 293257.27333333343,
+        "x": 1593875400000,
+        "y": null,
       },
       Object {
-        "x": 1528135200000,
-        "y": 290195.8800000004,
+        "x": 1593876000000,
+        "y": null,
       },
       Object {
-        "x": 1528146000000,
-        "y": 278548.1649999994,
+        "x": 1593876600000,
+        "y": null,
       },
       Object {
-        "x": 1528156800000,
-        "y": 290701.8973333341,
+        "x": 1593877200000,
+        "y": null,
       },
       Object {
-        "x": 1528167600000,
-        "y": 286839.5897777779,
+        "x": 1593877800000,
+        "y": null,
       },
       Object {
-        "x": 1528178400000,
-        "y": 287979.5149999999,
+        "x": 1593878400000,
+        "y": null,
       },
       Object {
-        "x": 1528189200000,
-        "y": 300107.5009999992,
+        "x": 1593879000000,
+        "y": null,
       },
       Object {
-        "x": 1528200000000,
-        "y": 294402.2179999999,
+        "x": 1593879600000,
+        "y": null,
       },
       Object {
-        "x": 1528210800000,
-        "y": 289849.459333332,
+        "x": 1593880200000,
+        "y": null,
       },
       Object {
-        "x": 1528221600000,
-        "y": 296942.86299999955,
+        "x": 1593880800000,
+        "y": null,
       },
       Object {
-        "x": 1528232400000,
-        "y": 292048.20571428596,
+        "x": 1593881400000,
+        "y": null,
       },
       Object {
-        "x": 1528243200000,
-        "y": 299308.7371666667,
+        "x": 1593882000000,
+        "y": null,
       },
       Object {
-        "x": 1528254000000,
-        "y": 292151.2377777781,
+        "x": 1593882600000,
+        "y": null,
       },
       Object {
-        "x": 1528264800000,
-        "y": 302274.4192592592,
+        "x": 1593883200000,
+        "y": null,
       },
       Object {
-        "x": 1528275600000,
-        "y": 299457.1612121209,
+        "x": 1593883800000,
+        "y": null,
       },
       Object {
-        "x": 1528286400000,
-        "y": 350398.59259259375,
+        "x": 1593884400000,
+        "y": null,
       },
       Object {
-        "x": 1528297200000,
-        "y": 421204.23333333334,
+        "x": 1593885000000,
+        "y": null,
       },
       Object {
-        "x": 1528308000000,
-        "y": 368166.68976190523,
+        "x": 1593885600000,
+        "y": null,
       },
       Object {
-        "x": 1528318800000,
-        "y": 367193.6128571426,
+        "x": 1593886200000,
+        "y": null,
       },
       Object {
-        "x": 1528329600000,
-        "y": 375658.10190476174,
+        "x": 1593886800000,
+        "y": null,
       },
       Object {
-        "x": 1528340400000,
-        "y": 368152.03822222137,
+        "x": 1593887400000,
+        "y": null,
       },
       Object {
-        "x": 1528351200000,
-        "y": 365705.8319999995,
+        "x": 1593888000000,
+        "y": null,
       },
       Object {
-        "x": 1528362000000,
-        "y": 380075.48533333326,
+        "x": 1593888600000,
+        "y": 114680,
       },
       Object {
-        "x": 1528372800000,
-        "y": 375697.1923809518,
+        "x": 1593889200000,
+        "y": 659448,
       },
       Object {
-        "x": 1528383600000,
-        "y": 351080.94111111073,
+        "x": 1593889800000,
+        "y": 122360,
       },
       Object {
-        "x": 1528394400000,
-        "y": 339294.12799999997,
+        "x": 1593890400000,
+        "y": 121336,
       },
       Object {
-        "x": 1528405200000,
-        "y": 378902.90649999987,
+        "x": 1593891000000,
+        "y": 120828,
       },
       Object {
-        "x": 1528416000000,
-        "y": 384483.3233333327,
+        "x": 1593891600000,
+        "y": 139256,
       },
       Object {
-        "x": 1528426800000,
-        "y": 394692.25000000105,
+        "x": 1593892200000,
+        "y": 76792,
       },
       Object {
-        "x": 1528437600000,
-        "y": 403362.50399999996,
+        "x": 1593892800000,
+        "y": 129528,
       },
       Object {
-        "x": 1528448400000,
-        "y": 396559.0274999993,
+        "x": 1593893400000,
+        "y": 378872,
       },
       Object {
-        "x": 1528459200000,
-        "y": 371815.8320000008,
+        "x": 1593894000000,
+        "y": 97272,
       },
       Object {
-        "x": 1528470000000,
-        "y": 405477.6133333326,
+        "x": 1593894600000,
+        "y": 102904,
       },
       Object {
-        "x": 1528480800000,
-        "y": 413542.18133333366,
+        "x": 1593895200000,
+        "y": 100856,
       },
       Object {
-        "x": 1528491600000,
-        "y": 424399.340000001,
+        "x": 1593895800000,
+        "y": 97784,
       },
       Object {
-        "x": 1528502400000,
-        "y": 303815.9000000001,
+        "x": 1593896400000,
+        "y": 72700,
       },
       Object {
-        "x": 1528513200000,
-        "y": 306305.0800000006,
+        "x": 1593897000000,
+        "y": 98296,
       },
       Object {
-        "x": 1528524000000,
-        "y": 297521.94999999984,
+        "x": 1593897600000,
+        "y": 112120,
       },
       Object {
-        "x": 1528534800000,
-        "y": 317938.0900000003,
+        "x": 1593898200000,
+        "y": 91640,
       },
       Object {
-        "x": 1528545600000,
-        "y": 312262.3000000003,
+        "x": 1593898800000,
+        "y": 83448,
       },
       Object {
-        "x": 1528556400000,
-        "y": 318428.8700000002,
+        "x": 1593899400000,
+        "y": 84476,
       },
       Object {
-        "x": 1528567200000,
-        "y": 295421.4099999999,
+        "x": 1593900000000,
+        "y": 117756,
       },
       Object {
-        "x": 1528578000000,
-        "y": 293067.86000000004,
+        "x": 1593900600000,
+        "y": 66556,
       },
       Object {
-        "x": 1528588800000,
-        "y": 264935.71999999933,
+        "x": 1593901200000,
+        "y": 130552,
       },
       Object {
-        "x": 1528599600000,
-        "y": 282795.0400000003,
+        "x": 1593901800000,
+        "y": 111608,
       },
       Object {
-        "x": 1528610400000,
-        "y": 285390.8400000001,
+        "x": 1593902400000,
+        "y": null,
       },
       Object {
-        "x": 1528621200000,
-        "y": 290402.24,
+        "x": 1593903000000,
+        "y": null,
       },
       Object {
-        "x": 1528632000000,
-        "y": 293655.53,
+        "x": 1593903600000,
+        "y": 276448,
       },
       Object {
-        "x": 1528642800000,
-        "y": 292723.56999999995,
+        "x": 1593904200000,
+        "y": null,
       },
       Object {
-        "x": 1528653600000,
-        "y": 301051.32000000105,
+        "x": 1593904800000,
+        "y": null,
       },
       Object {
-        "x": 1528664400000,
-        "y": 291322.0499999998,
+        "x": 1593905400000,
+        "y": null,
       },
       Object {
-        "x": 1528675200000,
-        "y": 379855.2444444447,
+        "x": 1593906000000,
+        "y": 1028088,
       },
       Object {
-        "x": 1528686000000,
-        "y": 371175.2592000001,
+        "x": 1593906600000,
+        "y": null,
       },
       Object {
-        "x": 1528696800000,
-        "y": 498378.4238888898,
+        "x": 1593907200000,
+        "y": null,
       },
       Object {
-        "x": 1528707600000,
-        "y": 331118.6599999997,
+        "x": 1593907800000,
+        "y": null,
       },
       Object {
-        "x": 1528718400000,
-        "y": 328101.3999999988,
+        "x": 1593908400000,
+        "y": null,
       },
       Object {
-        "x": 1528729200000,
-        "y": 313951.54249999986,
+        "x": 1593909000000,
+        "y": null,
       },
       Object {
-        "x": 1528740000000,
-        "y": 323340.5274074075,
+        "x": 1593909600000,
+        "y": null,
       },
       Object {
-        "x": 1528750800000,
-        "y": 315055.5047619052,
+        "x": 1593910200000,
+        "y": 352128,
       },
       Object {
-        "x": 1528761600000,
-        "y": 330070.03599999985,
+        "x": 1593910800000,
+        "y": null,
       },
       Object {
-        "x": 1528772400000,
-        "y": 320531.54416666675,
+        "x": 1593911400000,
+        "y": null,
       },
       Object {
-        "x": 1528783200000,
-        "y": 315137.16628571344,
+        "x": 1593912000000,
+        "y": null,
       },
       Object {
-        "x": 1528794000000,
-        "y": 337251.4042424246,
+        "x": 1593912600000,
+        "y": null,
       },
       Object {
-        "x": 1528804800000,
-        "y": 327054.9243636365,
+        "x": 1593913200000,
+        "y": null,
       },
       Object {
-        "x": 1528815600000,
-        "y": 327653.0000000006,
+        "x": 1593913800000,
+        "y": null,
       },
       Object {
-        "x": 1528826400000,
-        "y": 324505.1399999999,
+        "x": 1593914400000,
+        "y": null,
       },
       Object {
-        "x": 1528837200000,
-        "y": 338040.3999999998,
+        "x": 1593915000000,
+        "y": null,
       },
       Object {
-        "x": 1528848000000,
-        "y": 328600.5173333335,
+        "x": 1593915600000,
+        "y": null,
       },
       Object {
-        "x": 1528858800000,
-        "y": 334060.93628571345,
+        "x": 1593916200000,
+        "y": null,
       },
       Object {
-        "x": 1528869600000,
-        "y": 328569.4964999998,
+        "x": 1593916800000,
+        "y": 348144,
       },
       Object {
-        "x": 1528880400000,
-        "y": 320227.32399999973,
+        "x": 1593917400000,
+        "y": null,
       },
       Object {
-        "x": 1528891200000,
-        "y": 292019.2899999998,
+        "x": 1593918000000,
+        "y": null,
       },
       Object {
-        "x": 1528902000000,
-        "y": 297757.72666666657,
+        "x": 1593918600000,
+        "y": null,
       },
       Object {
-        "x": 1528912800000,
-        "y": 308034.4466666669,
+        "x": 1593919200000,
+        "y": null,
       },
       Object {
-        "x": 1528923600000,
-        "y": 301128.4895238093,
+        "x": 1593919800000,
+        "y": null,
       },
       Object {
-        "x": 1528934400000,
-        "y": 447266.9,
+        "x": 1593920400000,
+        "y": null,
       },
       Object {
-        "x": 1528945200000,
-        "y": 409147.332500001,
+        "x": 1593921000000,
+        "y": null,
       },
       Object {
-        "x": 1528956000000,
-        "y": 423121.9773333328,
+        "x": 1593921600000,
+        "y": null,
       },
       Object {
-        "x": 1528966800000,
-        "y": 473485.4199999998,
+        "x": 1593922200000,
+        "y": null,
       },
       Object {
-        "x": 1528977600000,
+        "x": 1593922800000,
         "y": null,
       },
-    ],
-  },
-  "tpmBuckets": Array [
-    Object {
-      "avg": 112708,
-      "dataPoints": Array [
+      Object {
+        "x": 1593923400000,
+        "y": 270328,
+      },
+      Object {
+        "x": 1593924000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593924600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593925200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593925800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593926400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593927000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593927600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593928200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593928800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593929400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593930000000,
+        "y": 1687544,
+      },
+      Object {
+        "x": 1593930600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593931200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593931800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593932400000,
+        "y": 798656,
+      },
+      Object {
+        "x": 1593933000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593933600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593934200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593934800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593935400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593936000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593936600000,
+        "y": 3653624,
+      },
+      Object {
+        "x": 1593937200000,
+        "y": 3276768,
+      },
+      Object {
+        "x": 1593937800000,
+        "y": 522208,
+      },
+      Object {
+        "x": 1593938400000,
+        "y": 372728,
+      },
+    ],
+    "p99": Array [
+      Object {
+        "x": 1593852000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593852600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593853200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593853800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593854400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593855000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593855600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593856200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593856800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593857400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593858000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593858600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593859200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593859800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593860400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593861000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593861600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593862200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593862800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593863400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593864000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593864600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593865200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593865800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593866400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593867000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593867600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593868200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593868800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593869400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593870000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593870600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593871200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593871800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593872400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593873000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593873600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593874200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593874800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593875400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593876000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593876600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593877200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593877800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593878400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593879000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593879600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593880200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593880800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593881400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593882000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593882600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593883200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593883800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593884400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593885000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593885600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593886200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593886800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593887400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593888000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593888600000,
+        "y": 827384,
+      },
+      Object {
+        "x": 1593889200000,
+        "y": 2326520,
+      },
+      Object {
+        "x": 1593889800000,
+        "y": 1130488,
+      },
+      Object {
+        "x": 1593890400000,
+        "y": 1032184,
+      },
+      Object {
+        "x": 1593891000000,
+        "y": 770044,
+      },
+      Object {
+        "x": 1593891600000,
+        "y": 651256,
+      },
+      Object {
+        "x": 1593892200000,
+        "y": 667640,
+      },
+      Object {
+        "x": 1593892800000,
+        "y": 708600,
+      },
+      Object {
+        "x": 1593893400000,
+        "y": 815096,
+      },
+      Object {
+        "x": 1593894000000,
+        "y": 688120,
+      },
+      Object {
+        "x": 1593894600000,
+        "y": 978936,
+      },
+      Object {
+        "x": 1593895200000,
+        "y": 839672,
+      },
+      Object {
+        "x": 1593895800000,
+        "y": 757752,
+      },
+      Object {
+        "x": 1593896400000,
+        "y": 577532,
+      },
+      Object {
+        "x": 1593897000000,
+        "y": 618488,
+      },
+      Object {
+        "x": 1593897600000,
+        "y": 565240,
+      },
+      Object {
+        "x": 1593898200000,
+        "y": 618488,
+      },
+      Object {
+        "x": 1593898800000,
+        "y": 655352,
+      },
+      Object {
+        "x": 1593899400000,
+        "y": 843772,
+      },
+      Object {
+        "x": 1593900000000,
+        "y": 831484,
+      },
+      Object {
+        "x": 1593900600000,
+        "y": 430076,
+      },
+      Object {
+        "x": 1593901200000,
+        "y": 864248,
+      },
+      Object {
+        "x": 1593901800000,
+        "y": 655352,
+      },
+      Object {
+        "x": 1593902400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593903000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593903600000,
+        "y": 2883552,
+      },
+      Object {
+        "x": 1593904200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593904800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593905400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593906000000,
+        "y": 6094840,
+      },
+      Object {
+        "x": 1593906600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593907200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593907800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593908400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593909000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593909600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593910200000,
+        "y": 446336,
+      },
+      Object {
+        "x": 1593910800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593911400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593912000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593912600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593913200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593913800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593914400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593915000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593915600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593916200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593916800000,
+        "y": 3293168,
+      },
+      Object {
+        "x": 1593917400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593918000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593918600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593919200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593919800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593920400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593921000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593921600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593922200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593922800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593923400000,
+        "y": 299000,
+      },
+      Object {
+        "x": 1593924000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593924600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593925200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593925800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593926400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593927000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593927600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593928200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593928800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593929400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593930000000,
+        "y": 5046264,
+      },
+      Object {
+        "x": 1593930600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593931200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593931800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593932400000,
+        "y": 4292544,
+      },
+      Object {
+        "x": 1593933000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593933600000,
+        "y": null,
+      },
+      Object {
+        "x": 1593934200000,
+        "y": null,
+      },
+      Object {
+        "x": 1593934800000,
+        "y": null,
+      },
+      Object {
+        "x": 1593935400000,
+        "y": null,
+      },
+      Object {
+        "x": 1593936000000,
+        "y": null,
+      },
+      Object {
+        "x": 1593936600000,
+        "y": 5046264,
+      },
+      Object {
+        "x": 1593937200000,
+        "y": 4292576,
+      },
+      Object {
+        "x": 1593937800000,
+        "y": 4128736,
+      },
+      Object {
+        "x": 1593938400000,
+        "y": 843768,
+      },
+    ],
+  },
+  "tpmBuckets": Array [
+    Object {
+      "avg": 1215,
+      "dataPoints": Array [
+        Object {
+          "x": 1593852000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593852600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593853200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593853800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593854400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593855000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593855600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593856200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593856800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593857400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593858000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593858600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593859200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593859800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593860400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593861000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593861600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593862200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593862800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593863400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593864000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593864600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593865200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593865800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593866400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593867000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593867600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593868200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593868800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593869400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593870000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593870600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593871200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593871800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593872400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593873000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593873600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593874200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593874800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593875400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593876000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593876600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593877200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593877800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593878400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593879000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593879600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593880200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593880800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593881400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593882000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593882600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593883200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593883800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593884400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593885000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593885600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593886200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593886800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593887400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593888000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593888600000,
+          "y": 84.5,
+        },
+        Object {
+          "x": 1593889200000,
+          "y": 222,
+        },
+        Object {
+          "x": 1593889800000,
+          "y": 230,
+        },
+        Object {
+          "x": 1593890400000,
+          "y": 253,
+        },
+        Object {
+          "x": 1593891000000,
+          "y": 239.5,
+        },
+        Object {
+          "x": 1593891600000,
+          "y": 228.5,
+        },
+        Object {
+          "x": 1593892200000,
+          "y": 257,
+        },
+        Object {
+          "x": 1593892800000,
+          "y": 241,
+        },
+        Object {
+          "x": 1593893400000,
+          "y": 252,
+        },
+        Object {
+          "x": 1593894000000,
+          "y": 266,
+        },
+        Object {
+          "x": 1593894600000,
+          "y": 229,
+        },
+        Object {
+          "x": 1593895200000,
+          "y": 224,
+        },
+        Object {
+          "x": 1593895800000,
+          "y": 234,
+        },
+        Object {
+          "x": 1593896400000,
+          "y": 263,
+        },
+        Object {
+          "x": 1593897000000,
+          "y": 247.5,
+        },
+        Object {
+          "x": 1593897600000,
+          "y": 246,
+        },
+        Object {
+          "x": 1593898200000,
+          "y": 243.5,
+        },
+        Object {
+          "x": 1593898800000,
+          "y": 245.5,
+        },
+        Object {
+          "x": 1593899400000,
+          "y": 243,
+        },
+        Object {
+          "x": 1593900000000,
+          "y": 229,
+        },
+        Object {
+          "x": 1593900600000,
+          "y": 264,
+        },
+        Object {
+          "x": 1593901200000,
+          "y": 233.5,
+        },
+        Object {
+          "x": 1593901800000,
+          "y": 89.5,
+        },
+        Object {
+          "x": 1593902400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593903000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593903600000,
+          "y": 19.5,
+        },
+        Object {
+          "x": 1593904200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593904800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593905400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593906000000,
+          "y": 18,
+        },
+        Object {
+          "x": 1593906600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593907200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593907800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593908400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593909000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593909600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593910200000,
+          "y": 17,
+        },
+        Object {
+          "x": 1593910800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593911400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593912000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593912600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593913200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593913800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593914400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593915000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593915600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593916200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593916800000,
+          "y": 15.5,
+        },
+        Object {
+          "x": 1593917400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593918000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593918600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593919200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593919800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593920400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593921000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593921600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593922200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593922800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593923400000,
+          "y": 24.5,
+        },
+        Object {
+          "x": 1593924000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593924600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593925200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593925800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593926400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593927000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593927600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593928200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593928800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593929400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593930000000,
+          "y": 25,
+        },
+        Object {
+          "x": 1593930600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593931200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593931800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593932400000,
+          "y": 18.5,
+        },
+        Object {
+          "x": 1593933000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593933600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593934200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593934800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593935400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593936000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593936600000,
+          "y": 97,
+        },
+        Object {
+          "x": 1593937200000,
+          "y": 192.5,
+        },
+        Object {
+          "x": 1593937800000,
+          "y": 210.5,
+        },
+        Object {
+          "x": 1593938400000,
+          "y": 172,
+        },
+      ],
+      "key": "HTTP 2xx",
+    },
+    Object {
+      "avg": 382.8,
+      "dataPoints": Array [
+        Object {
+          "x": 1593852000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593852600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593853200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593853800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593854400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593855000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593855600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593856200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593856800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593857400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593858000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593858600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593859200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593859800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593860400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593861000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593861600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593862200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593862800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593863400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593864000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593864600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593865200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593865800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593866400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593867000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593867600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593868200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593868800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593869400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593870000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593870600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593871200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593871800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593872400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593873000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593873600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593874200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593874800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593875400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593876000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593876600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593877200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593877800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593878400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593879000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593879600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593880200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593880800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593881400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593882000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593882600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593883200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593883800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593884400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593885000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593885600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593886200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593886800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593887400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593888000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593888600000,
+          "y": 31,
+        },
+        Object {
+          "x": 1593889200000,
+          "y": 26,
+        },
+        Object {
+          "x": 1593889800000,
+          "y": 64,
+        },
+        Object {
+          "x": 1593890400000,
+          "y": 71.5,
+        },
+        Object {
+          "x": 1593891000000,
+          "y": 64.5,
+        },
+        Object {
+          "x": 1593891600000,
+          "y": 60.5,
+        },
+        Object {
+          "x": 1593892200000,
+          "y": 146,
+        },
+        Object {
+          "x": 1593892800000,
+          "y": 69.5,
+        },
+        Object {
+          "x": 1593893400000,
+          "y": 52,
+        },
+        Object {
+          "x": 1593894000000,
+          "y": 99,
+        },
+        Object {
+          "x": 1593894600000,
+          "y": 89.5,
+        },
+        Object {
+          "x": 1593895200000,
+          "y": 58.5,
+        },
+        Object {
+          "x": 1593895800000,
+          "y": 91.5,
+        },
+        Object {
+          "x": 1593896400000,
+          "y": 132,
+        },
+        Object {
+          "x": 1593897000000,
+          "y": 90,
+        },
+        Object {
+          "x": 1593897600000,
+          "y": 80,
+        },
+        Object {
+          "x": 1593898200000,
+          "y": 104,
+        },
+        Object {
+          "x": 1593898800000,
+          "y": 79,
+        },
+        Object {
+          "x": 1593899400000,
+          "y": 88,
+        },
+        Object {
+          "x": 1593900000000,
+          "y": 91.5,
+        },
+        Object {
+          "x": 1593900600000,
+          "y": 117,
+        },
+        Object {
+          "x": 1593901200000,
+          "y": 62.5,
+        },
+        Object {
+          "x": 1593901800000,
+          "y": 24,
+        },
+        Object {
+          "x": 1593902400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593903000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593903600000,
+          "y": 4.5,
+        },
+        Object {
+          "x": 1593904200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593904800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593905400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593906000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593906600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593907200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593907800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593908400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593909000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593909600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593910200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593910800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593911400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593912000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593912600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593913200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593913800000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593914400000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593915000000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593915600000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593916200000,
+          "y": 0,
+        },
+        Object {
+          "x": 1593916800000,
+          "y": 0,
+        },
         Object {
-          "x": 1528113600000,
-          "y": 8223,
+          "x": 1593917400000,
+          "y": 0,
         },
         Object {
-          "x": 1528124400000,
-          "y": 8146,
+          "x": 1593918000000,
+          "y": 0,
         },
         Object {
-          "x": 1528135200000,
-          "y": 8232,
+          "x": 1593918600000,
+          "y": 0,
         },
         Object {
-          "x": 1528146000000,
-          "y": 8248.5,
+          "x": 1593919200000,
+          "y": 0,
         },
         Object {
-          "x": 1528156800000,
-          "y": 8399.5,
+          "x": 1593919800000,
+          "y": 0,
         },
         Object {
-          "x": 1528167600000,
-          "y": 8280.5,
+          "x": 1593920400000,
+          "y": 0,
         },
         Object {
-          "x": 1528178400000,
-          "y": 8215.5,
+          "x": 1593921000000,
+          "y": 0,
         },
         Object {
-          "x": 1528189200000,
-          "y": 8191.5,
+          "x": 1593921600000,
+          "y": 0,
         },
         Object {
-          "x": 1528200000000,
-          "y": 8147.5,
+          "x": 1593922200000,
+          "y": 0,
         },
         Object {
-          "x": 1528210800000,
-          "y": 8351,
+          "x": 1593922800000,
+          "y": 0,
         },
         Object {
-          "x": 1528221600000,
-          "y": 8234.5,
+          "x": 1593923400000,
+          "y": 5.5,
         },
         Object {
-          "x": 1528232400000,
-          "y": 8233,
+          "x": 1593924000000,
+          "y": 0,
         },
         Object {
-          "x": 1528243200000,
-          "y": 8275.5,
+          "x": 1593924600000,
+          "y": 0,
         },
         Object {
-          "x": 1528254000000,
-          "y": 8337.5,
+          "x": 1593925200000,
+          "y": 0,
         },
         Object {
-          "x": 1528264800000,
-          "y": 8205,
+          "x": 1593925800000,
+          "y": 0,
         },
         Object {
-          "x": 1528275600000,
-          "y": 8123.5,
+          "x": 1593926400000,
+          "y": 0,
         },
         Object {
-          "x": 1528286400000,
-          "y": 7572.5,
+          "x": 1593927000000,
+          "y": 0,
         },
         Object {
-          "x": 1528297200000,
-          "y": 8089,
+          "x": 1593927600000,
+          "y": 0,
         },
         Object {
-          "x": 1528308000000,
-          "y": 8265,
+          "x": 1593928200000,
+          "y": 0,
         },
         Object {
-          "x": 1528318800000,
-          "y": 8105.5,
+          "x": 1593928800000,
+          "y": 0,
         },
         Object {
-          "x": 1528329600000,
-          "y": 8226.5,
+          "x": 1593929400000,
+          "y": 0,
         },
         Object {
-          "x": 1528340400000,
-          "y": 8251.5,
+          "x": 1593930000000,
+          "y": 14,
         },
         Object {
-          "x": 1528351200000,
-          "y": 8302,
+          "x": 1593930600000,
+          "y": 0,
         },
         Object {
-          "x": 1528362000000,
-          "y": 8261,
+          "x": 1593931200000,
+          "y": 0,
         },
         Object {
-          "x": 1528372800000,
-          "y": 8082,
+          "x": 1593931800000,
+          "y": 0,
         },
         Object {
-          "x": 1528383600000,
-          "y": 8260,
+          "x": 1593932400000,
+          "y": 1,
         },
         Object {
-          "x": 1528394400000,
-          "y": 8267,
+          "x": 1593933000000,
+          "y": 0,
         },
         Object {
-          "x": 1528405200000,
-          "y": 8155.5,
+          "x": 1593933600000,
+          "y": 0,
         },
         Object {
-          "x": 1528416000000,
-          "y": 8335,
+          "x": 1593934200000,
+          "y": 0,
         },
         Object {
-          "x": 1528426800000,
-          "y": 8096,
+          "x": 1593934800000,
+          "y": 0,
         },
         Object {
-          "x": 1528437600000,
-          "y": 8289.5,
+          "x": 1593935400000,
+          "y": 0,
         },
         Object {
-          "x": 1528448400000,
-          "y": 8165,
+          "x": 1593936000000,
+          "y": 0,
         },
         Object {
-          "x": 1528459200000,
-          "y": 8282.5,
+          "x": 1593936600000,
+          "y": 0,
         },
         Object {
-          "x": 1528470000000,
-          "y": 8271.5,
+          "x": 1593937200000,
+          "y": 31.5,
         },
         Object {
-          "x": 1528480800000,
-          "y": 8246,
+          "x": 1593937800000,
+          "y": 25,
         },
         Object {
-          "x": 1528491600000,
-          "y": 8202,
+          "x": 1593938400000,
+          "y": 41,
         },
+      ],
+      "key": "HTTP 3xx",
+    },
+    Object {
+      "avg": 68.3,
+      "dataPoints": Array [
         Object {
-          "x": 1528502400000,
-          "y": 2264,
+          "x": 1593852000000,
+          "y": 0,
         },
         Object {
-          "x": 1528513200000,
-          "y": 2278.5,
+          "x": 1593852600000,
+          "y": 0,
         },
         Object {
-          "x": 1528524000000,
-          "y": 2283,
+          "x": 1593853200000,
+          "y": 0,
         },
         Object {
-          "x": 1528534800000,
-          "y": 2293,
+          "x": 1593853800000,
+          "y": 0,
         },
         Object {
-          "x": 1528545600000,
-          "y": 2336,
+          "x": 1593854400000,
+          "y": 0,
         },
         Object {
-          "x": 1528556400000,
-          "y": 2342.5,
+          "x": 1593855000000,
+          "y": 0,
         },
         Object {
-          "x": 1528567200000,
-          "y": 2260.5,
+          "x": 1593855600000,
+          "y": 0,
         },
         Object {
-          "x": 1528578000000,
-          "y": 2306,
+          "x": 1593856200000,
+          "y": 0,
         },
         Object {
-          "x": 1528588800000,
-          "y": 2267.5,
+          "x": 1593856800000,
+          "y": 0,
         },
         Object {
-          "x": 1528599600000,
-          "y": 2303,
+          "x": 1593857400000,
+          "y": 0,
         },
         Object {
-          "x": 1528610400000,
-          "y": 2307,
+          "x": 1593858000000,
+          "y": 0,
         },
         Object {
-          "x": 1528621200000,
-          "y": 2253.5,
+          "x": 1593858600000,
+          "y": 0,
         },
         Object {
-          "x": 1528632000000,
-          "y": 2305.5,
+          "x": 1593859200000,
+          "y": 0,
         },
         Object {
-          "x": 1528642800000,
-          "y": 2293.5,
+          "x": 1593859800000,
+          "y": 0,
         },
         Object {
-          "x": 1528653600000,
-          "y": 2291,
+          "x": 1593860400000,
+          "y": 0,
         },
         Object {
-          "x": 1528664400000,
-          "y": 2307.5,
+          "x": 1593861000000,
+          "y": 0,
         },
         Object {
-          "x": 1528675200000,
-          "y": 8125.5,
+          "x": 1593861600000,
+          "y": 0,
         },
         Object {
-          "x": 1528686000000,
-          "y": 8412.5,
+          "x": 1593862200000,
+          "y": 0,
         },
         Object {
-          "x": 1528696800000,
-          "y": 8144,
+          "x": 1593862800000,
+          "y": 0,
         },
         Object {
-          "x": 1528707600000,
-          "y": 8246,
+          "x": 1593863400000,
+          "y": 0,
         },
         Object {
-          "x": 1528718400000,
-          "y": 8217,
+          "x": 1593864000000,
+          "y": 0,
         },
         Object {
-          "x": 1528729200000,
-          "y": 8501.5,
+          "x": 1593864600000,
+          "y": 0,
         },
         Object {
-          "x": 1528740000000,
-          "y": 8182,
+          "x": 1593865200000,
+          "y": 0,
         },
         Object {
-          "x": 1528750800000,
-          "y": 8322.5,
+          "x": 1593865800000,
+          "y": 0,
         },
         Object {
-          "x": 1528761600000,
-          "y": 8347.5,
+          "x": 1593866400000,
+          "y": 0,
         },
         Object {
-          "x": 1528772400000,
-          "y": 8249,
+          "x": 1593867000000,
+          "y": 0,
         },
         Object {
-          "x": 1528783200000,
-          "y": 8294,
+          "x": 1593867600000,
+          "y": 0,
         },
         Object {
-          "x": 1528794000000,
-          "y": 8342.5,
+          "x": 1593868200000,
+          "y": 0,
         },
         Object {
-          "x": 1528804800000,
-          "y": 8180.5,
+          "x": 1593868800000,
+          "y": 0,
         },
         Object {
-          "x": 1528815600000,
-          "y": 8329,
+          "x": 1593869400000,
+          "y": 0,
         },
         Object {
-          "x": 1528826400000,
-          "y": 8253.5,
+          "x": 1593870000000,
+          "y": 0,
         },
         Object {
-          "x": 1528837200000,
-          "y": 8209,
+          "x": 1593870600000,
+          "y": 0,
         },
         Object {
-          "x": 1528848000000,
-          "y": 8238.5,
+          "x": 1593871200000,
+          "y": 0,
         },
         Object {
-          "x": 1528858800000,
-          "y": 8377.5,
+          "x": 1593871800000,
+          "y": 0,
         },
         Object {
-          "x": 1528869600000,
-          "y": 8297,
+          "x": 1593872400000,
+          "y": 0,
         },
         Object {
-          "x": 1528880400000,
-          "y": 8406,
+          "x": 1593873000000,
+          "y": 0,
         },
         Object {
-          "x": 1528891200000,
-          "y": 8431.5,
+          "x": 1593873600000,
+          "y": 0,
         },
         Object {
-          "x": 1528902000000,
-          "y": 8327.5,
+          "x": 1593874200000,
+          "y": 0,
         },
         Object {
-          "x": 1528912800000,
-          "y": 8361.5,
+          "x": 1593874800000,
+          "y": 0,
         },
         Object {
-          "x": 1528923600000,
-          "y": 8288.5,
+          "x": 1593875400000,
+          "y": 0,
         },
         Object {
-          "x": 1528934400000,
-          "y": 7562.5,
+          "x": 1593876000000,
+          "y": 0,
         },
         Object {
-          "x": 1528945200000,
-          "y": 8216,
+          "x": 1593876600000,
+          "y": 0,
         },
         Object {
-          "x": 1528956000000,
-          "y": 8232,
+          "x": 1593877200000,
+          "y": 0,
         },
         Object {
-          "x": 1528966800000,
-          "y": 8184.5,
+          "x": 1593877800000,
+          "y": 0,
         },
         Object {
-          "x": 1528977600000,
+          "x": 1593878400000,
           "y": 0,
         },
-      ],
-      "key": "HTTP 2xx",
-    },
-    Object {
-      "avg": 665,
-      "dataPoints": Array [
         Object {
-          "x": 1528113600000,
+          "x": 1593879000000,
           "y": 0,
         },
         Object {
-          "x": 1528124400000,
+          "x": 1593879600000,
           "y": 0,
         },
         Object {
-          "x": 1528135200000,
+          "x": 1593880200000,
           "y": 0,
         },
         Object {
-          "x": 1528146000000,
+          "x": 1593880800000,
           "y": 0,
         },
         Object {
-          "x": 1528156800000,
+          "x": 1593881400000,
           "y": 0,
         },
         Object {
-          "x": 1528167600000,
+          "x": 1593882000000,
           "y": 0,
         },
         Object {
-          "x": 1528178400000,
+          "x": 1593882600000,
           "y": 0,
         },
         Object {
-          "x": 1528189200000,
+          "x": 1593883200000,
           "y": 0,
         },
         Object {
-          "x": 1528200000000,
+          "x": 1593883800000,
           "y": 0,
         },
         Object {
-          "x": 1528210800000,
+          "x": 1593884400000,
           "y": 0,
         },
         Object {
-          "x": 1528221600000,
+          "x": 1593885000000,
           "y": 0,
         },
         Object {
-          "x": 1528232400000,
+          "x": 1593885600000,
           "y": 0,
         },
         Object {
-          "x": 1528243200000,
+          "x": 1593886200000,
           "y": 0,
         },
         Object {
-          "x": 1528254000000,
+          "x": 1593886800000,
           "y": 0,
         },
         Object {
-          "x": 1528264800000,
+          "x": 1593887400000,
           "y": 0,
         },
         Object {
-          "x": 1528275600000,
+          "x": 1593888000000,
           "y": 0,
         },
         Object {
-          "x": 1528286400000,
-          "y": 2020.5,
+          "x": 1593888600000,
+          "y": 5.5,
         },
         Object {
-          "x": 1528297200000,
-          "y": 227,
+          "x": 1593889200000,
+          "y": 15.5,
         },
         Object {
-          "x": 1528308000000,
-          "y": 0,
+          "x": 1593889800000,
+          "y": 9.5,
         },
         Object {
-          "x": 1528318800000,
-          "y": 0,
+          "x": 1593890400000,
+          "y": 11.5,
         },
         Object {
-          "x": 1528329600000,
-          "y": 0,
+          "x": 1593891000000,
+          "y": 13,
         },
         Object {
-          "x": 1528340400000,
-          "y": 0,
+          "x": 1593891600000,
+          "y": 13.5,
         },
         Object {
-          "x": 1528351200000,
-          "y": 0,
+          "x": 1593892200000,
+          "y": 13.5,
         },
         Object {
-          "x": 1528362000000,
-          "y": 0,
+          "x": 1593892800000,
+          "y": 15,
         },
         Object {
-          "x": 1528372800000,
-          "y": 0,
+          "x": 1593893400000,
+          "y": 14,
         },
         Object {
-          "x": 1528383600000,
-          "y": 0,
+          "x": 1593894000000,
+          "y": 16.5,
         },
         Object {
-          "x": 1528394400000,
-          "y": 0,
+          "x": 1593894600000,
+          "y": 11.5,
         },
         Object {
-          "x": 1528405200000,
-          "y": 0,
+          "x": 1593895200000,
+          "y": 17.5,
         },
         Object {
-          "x": 1528416000000,
-          "y": 0,
+          "x": 1593895800000,
+          "y": 13,
         },
         Object {
-          "x": 1528426800000,
-          "y": 0,
+          "x": 1593896400000,
+          "y": 17.5,
         },
         Object {
-          "x": 1528437600000,
-          "y": 0,
+          "x": 1593897000000,
+          "y": 12.5,
         },
         Object {
-          "x": 1528448400000,
-          "y": 0,
+          "x": 1593897600000,
+          "y": 13,
         },
         Object {
-          "x": 1528459200000,
-          "y": 0,
+          "x": 1593898200000,
+          "y": 12.5,
         },
         Object {
-          "x": 1528470000000,
-          "y": 0,
+          "x": 1593898800000,
+          "y": 8.5,
         },
         Object {
-          "x": 1528480800000,
-          "y": 0,
+          "x": 1593899400000,
+          "y": 9.5,
         },
         Object {
-          "x": 1528491600000,
-          "y": 0,
+          "x": 1593900000000,
+          "y": 14,
         },
         Object {
-          "x": 1528502400000,
-          "y": 0,
+          "x": 1593900600000,
+          "y": 12,
         },
         Object {
-          "x": 1528513200000,
-          "y": 0,
+          "x": 1593901200000,
+          "y": 15,
         },
         Object {
-          "x": 1528524000000,
-          "y": 0,
+          "x": 1593901800000,
+          "y": 3,
         },
         Object {
-          "x": 1528534800000,
+          "x": 1593902400000,
           "y": 0,
         },
         Object {
-          "x": 1528545600000,
+          "x": 1593903000000,
           "y": 0,
         },
         Object {
-          "x": 1528556400000,
-          "y": 0,
+          "x": 1593903600000,
+          "y": 1,
         },
         Object {
-          "x": 1528567200000,
+          "x": 1593904200000,
           "y": 0,
         },
         Object {
-          "x": 1528578000000,
+          "x": 1593904800000,
           "y": 0,
         },
         Object {
-          "x": 1528588800000,
+          "x": 1593905400000,
           "y": 0,
         },
         Object {
-          "x": 1528599600000,
-          "y": 0,
+          "x": 1593906000000,
+          "y": 2,
         },
         Object {
-          "x": 1528610400000,
+          "x": 1593906600000,
           "y": 0,
         },
         Object {
-          "x": 1528621200000,
+          "x": 1593907200000,
           "y": 0,
         },
         Object {
-          "x": 1528632000000,
+          "x": 1593907800000,
           "y": 0,
         },
         Object {
-          "x": 1528642800000,
+          "x": 1593908400000,
           "y": 0,
         },
         Object {
-          "x": 1528653600000,
+          "x": 1593909000000,
           "y": 0,
         },
         Object {
-          "x": 1528664400000,
+          "x": 1593909600000,
           "y": 0,
         },
         Object {
-          "x": 1528675200000,
+          "x": 1593910200000,
           "y": 0,
         },
         Object {
-          "x": 1528686000000,
+          "x": 1593910800000,
           "y": 0,
         },
         Object {
-          "x": 1528696800000,
+          "x": 1593911400000,
           "y": 0,
         },
         Object {
-          "x": 1528707600000,
+          "x": 1593912000000,
           "y": 0,
         },
         Object {
-          "x": 1528718400000,
+          "x": 1593912600000,
           "y": 0,
         },
         Object {
-          "x": 1528729200000,
+          "x": 1593913200000,
           "y": 0,
         },
         Object {
-          "x": 1528740000000,
+          "x": 1593913800000,
           "y": 0,
         },
         Object {
-          "x": 1528750800000,
+          "x": 1593914400000,
           "y": 0,
         },
         Object {
-          "x": 1528761600000,
+          "x": 1593915000000,
           "y": 0,
         },
         Object {
-          "x": 1528772400000,
+          "x": 1593915600000,
           "y": 0,
         },
         Object {
-          "x": 1528783200000,
+          "x": 1593916200000,
           "y": 0,
         },
         Object {
-          "x": 1528794000000,
+          "x": 1593916800000,
+          "y": 1.5,
+        },
+        Object {
+          "x": 1593917400000,
           "y": 0,
         },
         Object {
-          "x": 1528804800000,
+          "x": 1593918000000,
           "y": 0,
         },
         Object {
-          "x": 1528815600000,
+          "x": 1593918600000,
           "y": 0,
         },
         Object {
-          "x": 1528826400000,
+          "x": 1593919200000,
           "y": 0,
         },
         Object {
-          "x": 1528837200000,
+          "x": 1593919800000,
           "y": 0,
         },
         Object {
-          "x": 1528848000000,
+          "x": 1593920400000,
           "y": 0,
         },
         Object {
-          "x": 1528858800000,
+          "x": 1593921000000,
           "y": 0,
         },
         Object {
-          "x": 1528869600000,
+          "x": 1593921600000,
           "y": 0,
         },
         Object {
-          "x": 1528880400000,
+          "x": 1593922200000,
           "y": 0,
         },
         Object {
-          "x": 1528891200000,
+          "x": 1593922800000,
           "y": 0,
         },
         Object {
-          "x": 1528902000000,
+          "x": 1593923400000,
+          "y": 1,
+        },
+        Object {
+          "x": 1593924000000,
           "y": 0,
         },
         Object {
-          "x": 1528912800000,
+          "x": 1593924600000,
           "y": 0,
         },
         Object {
-          "x": 1528923600000,
+          "x": 1593925200000,
           "y": 0,
         },
         Object {
-          "x": 1528934400000,
-          "y": 1077.5,
+          "x": 1593925800000,
+          "y": 0,
         },
         Object {
-          "x": 1528945200000,
+          "x": 1593926400000,
           "y": 0,
         },
         Object {
-          "x": 1528956000000,
+          "x": 1593927000000,
           "y": 0,
         },
         Object {
-          "x": 1528966800000,
+          "x": 1593927600000,
           "y": 0,
         },
         Object {
-          "x": 1528977600000,
+          "x": 1593928200000,
           "y": 0,
         },
-      ],
-      "key": "HTTP 3xx",
-    },
-    Object {
-      "avg": 8190.7,
-      "dataPoints": Array [
         Object {
-          "x": 1528113600000,
-          "y": 593,
+          "x": 1593928800000,
+          "y": 0,
         },
         Object {
-          "x": 1528124400000,
-          "y": 606.5,
+          "x": 1593929400000,
+          "y": 0,
         },
         Object {
-          "x": 1528135200000,
-          "y": 602.5,
+          "x": 1593930000000,
+          "y": 1.5,
         },
         Object {
-          "x": 1528146000000,
-          "y": 581,
+          "x": 1593930600000,
+          "y": 0,
         },
         Object {
-          "x": 1528156800000,
-          "y": 619,
+          "x": 1593931200000,
+          "y": 0,
         },
         Object {
-          "x": 1528167600000,
-          "y": 595.5,
+          "x": 1593931800000,
+          "y": 0,
         },
         Object {
-          "x": 1528178400000,
-          "y": 637,
+          "x": 1593932400000,
+          "y": 1,
         },
         Object {
-          "x": 1528189200000,
-          "y": 617,
+          "x": 1593933000000,
+          "y": 0,
         },
         Object {
-          "x": 1528200000000,
-          "y": 582,
+          "x": 1593933600000,
+          "y": 0,
         },
         Object {
-          "x": 1528210800000,
-          "y": 616.5,
+          "x": 1593934200000,
+          "y": 0,
         },
         Object {
-          "x": 1528221600000,
-          "y": 611.5,
+          "x": 1593934800000,
+          "y": 0,
         },
         Object {
-          "x": 1528232400000,
-          "y": 608,
+          "x": 1593935400000,
+          "y": 0,
         },
         Object {
-          "x": 1528243200000,
-          "y": 600,
+          "x": 1593936000000,
+          "y": 0,
         },
         Object {
-          "x": 1528254000000,
-          "y": 618.5,
+          "x": 1593936600000,
+          "y": 7.5,
         },
         Object {
-          "x": 1528264800000,
-          "y": 615.5,
+          "x": 1593937200000,
+          "y": 14.5,
         },
         Object {
-          "x": 1528275600000,
-          "y": 591,
+          "x": 1593937800000,
+          "y": 15.5,
         },
         Object {
-          "x": 1528286400000,
-          "y": 562.5,
+          "x": 1593938400000,
+          "y": 9,
         },
+      ],
+      "key": "HTTP 4xx",
+    },
+    Object {
+      "avg": 37.8,
+      "dataPoints": Array [
         Object {
-          "x": 1528297200000,
-          "y": 621.5,
+          "x": 1593852000000,
+          "y": 0,
         },
         Object {
-          "x": 1528308000000,
-          "y": 623.5,
+          "x": 1593852600000,
+          "y": 0,
         },
         Object {
-          "x": 1528318800000,
-          "y": 581.5,
+          "x": 1593853200000,
+          "y": 0,
         },
         Object {
-          "x": 1528329600000,
-          "y": 610,
+          "x": 1593853800000,
+          "y": 0,
         },
         Object {
-          "x": 1528340400000,
-          "y": 601,
+          "x": 1593854400000,
+          "y": 0,
         },
         Object {
-          "x": 1528351200000,
-          "y": 596,
+          "x": 1593855000000,
+          "y": 0,
         },
         Object {
-          "x": 1528362000000,
-          "y": 624,
+          "x": 1593855600000,
+          "y": 0,
         },
         Object {
-          "x": 1528372800000,
-          "y": 594.5,
+          "x": 1593856200000,
+          "y": 0,
         },
         Object {
-          "x": 1528383600000,
-          "y": 615,
+          "x": 1593856800000,
+          "y": 0,
         },
         Object {
-          "x": 1528394400000,
-          "y": 603,
+          "x": 1593857400000,
+          "y": 0,
         },
         Object {
-          "x": 1528405200000,
-          "y": 595,
+          "x": 1593858000000,
+          "y": 0,
         },
         Object {
-          "x": 1528416000000,
-          "y": 616,
+          "x": 1593858600000,
+          "y": 0,
         },
         Object {
-          "x": 1528426800000,
-          "y": 585.5,
+          "x": 1593859200000,
+          "y": 0,
         },
         Object {
-          "x": 1528437600000,
-          "y": 616,
+          "x": 1593859800000,
+          "y": 0,
         },
         Object {
-          "x": 1528448400000,
-          "y": 626.5,
+          "x": 1593860400000,
+          "y": 0,
         },
         Object {
-          "x": 1528459200000,
-          "y": 625,
+          "x": 1593861000000,
+          "y": 0,
         },
         Object {
-          "x": 1528470000000,
-          "y": 583.5,
+          "x": 1593861600000,
+          "y": 0,
         },
         Object {
-          "x": 1528480800000,
-          "y": 629,
+          "x": 1593862200000,
+          "y": 0,
         },
         Object {
-          "x": 1528491600000,
-          "y": 574,
+          "x": 1593862800000,
+          "y": 0,
         },
         Object {
-          "x": 1528502400000,
-          "y": 142,
+          "x": 1593863400000,
+          "y": 0,
         },
         Object {
-          "x": 1528513200000,
-          "y": 120,
+          "x": 1593864000000,
+          "y": 0,
         },
         Object {
-          "x": 1528524000000,
-          "y": 136.5,
+          "x": 1593864600000,
+          "y": 0,
         },
         Object {
-          "x": 1528534800000,
-          "y": 147.5,
+          "x": 1593865200000,
+          "y": 0,
         },
         Object {
-          "x": 1528545600000,
-          "y": 140.5,
+          "x": 1593865800000,
+          "y": 0,
         },
         Object {
-          "x": 1528556400000,
-          "y": 150,
+          "x": 1593866400000,
+          "y": 0,
         },
         Object {
-          "x": 1528567200000,
-          "y": 132,
+          "x": 1593867000000,
+          "y": 0,
         },
         Object {
-          "x": 1528578000000,
-          "y": 130,
+          "x": 1593867600000,
+          "y": 0,
         },
         Object {
-          "x": 1528588800000,
-          "y": 139.5,
+          "x": 1593868200000,
+          "y": 0,
         },
         Object {
-          "x": 1528599600000,
-          "y": 129.5,
+          "x": 1593868800000,
+          "y": 0,
         },
         Object {
-          "x": 1528610400000,
-          "y": 145.5,
+          "x": 1593869400000,
+          "y": 0,
         },
         Object {
-          "x": 1528621200000,
-          "y": 124,
+          "x": 1593870000000,
+          "y": 0,
         },
         Object {
-          "x": 1528632000000,
-          "y": 155.5,
+          "x": 1593870600000,
+          "y": 0,
         },
         Object {
-          "x": 1528642800000,
-          "y": 138.5,
+          "x": 1593871200000,
+          "y": 0,
         },
         Object {
-          "x": 1528653600000,
-          "y": 139.5,
+          "x": 1593871800000,
+          "y": 0,
         },
         Object {
-          "x": 1528664400000,
-          "y": 137.5,
+          "x": 1593872400000,
+          "y": 0,
         },
         Object {
-          "x": 1528675200000,
-          "y": 583.5,
+          "x": 1593873000000,
+          "y": 0,
         },
         Object {
-          "x": 1528686000000,
-          "y": 635,
+          "x": 1593873600000,
+          "y": 0,
         },
         Object {
-          "x": 1528696800000,
-          "y": 581.5,
+          "x": 1593874200000,
+          "y": 0,
         },
         Object {
-          "x": 1528707600000,
-          "y": 577.5,
+          "x": 1593874800000,
+          "y": 0,
         },
         Object {
-          "x": 1528718400000,
-          "y": 608.5,
+          "x": 1593875400000,
+          "y": 0,
         },
         Object {
-          "x": 1528729200000,
-          "y": 613.5,
+          "x": 1593876000000,
+          "y": 0,
         },
         Object {
-          "x": 1528740000000,
-          "y": 597,
+          "x": 1593876600000,
+          "y": 0,
         },
         Object {
-          "x": 1528750800000,
-          "y": 576.5,
+          "x": 1593877200000,
+          "y": 0,
         },
         Object {
-          "x": 1528761600000,
-          "y": 605.5,
+          "x": 1593877800000,
+          "y": 0,
         },
         Object {
-          "x": 1528772400000,
-          "y": 601.5,
+          "x": 1593878400000,
+          "y": 0,
         },
         Object {
-          "x": 1528783200000,
-          "y": 634.5,
+          "x": 1593879000000,
+          "y": 0,
         },
         Object {
-          "x": 1528794000000,
-          "y": 598.5,
+          "x": 1593879600000,
+          "y": 0,
         },
         Object {
-          "x": 1528804800000,
-          "y": 592,
+          "x": 1593880200000,
+          "y": 0,
         },
         Object {
-          "x": 1528815600000,
-          "y": 588,
+          "x": 1593880800000,
+          "y": 0,
         },
         Object {
-          "x": 1528826400000,
-          "y": 581,
+          "x": 1593881400000,
+          "y": 0,
         },
         Object {
-          "x": 1528837200000,
-          "y": 635,
+          "x": 1593882000000,
+          "y": 0,
         },
         Object {
-          "x": 1528848000000,
-          "y": 612,
+          "x": 1593882600000,
+          "y": 0,
         },
         Object {
-          "x": 1528858800000,
-          "y": 627.5,
+          "x": 1593883200000,
+          "y": 0,
         },
         Object {
-          "x": 1528869600000,
-          "y": 603.5,
+          "x": 1593883800000,
+          "y": 0,
         },
         Object {
-          "x": 1528880400000,
-          "y": 603,
+          "x": 1593884400000,
+          "y": 0,
         },
         Object {
-          "x": 1528891200000,
-          "y": 627,
+          "x": 1593885000000,
+          "y": 0,
         },
         Object {
-          "x": 1528902000000,
-          "y": 608,
+          "x": 1593885600000,
+          "y": 0,
         },
         Object {
-          "x": 1528912800000,
-          "y": 631.5,
+          "x": 1593886200000,
+          "y": 0,
         },
         Object {
-          "x": 1528923600000,
-          "y": 638.5,
+          "x": 1593886800000,
+          "y": 0,
         },
         Object {
-          "x": 1528934400000,
-          "y": 591.5,
+          "x": 1593887400000,
+          "y": 0,
         },
         Object {
-          "x": 1528945200000,
-          "y": 610.5,
+          "x": 1593888000000,
+          "y": 0,
         },
         Object {
-          "x": 1528956000000,
-          "y": 599,
+          "x": 1593888600000,
+          "y": 2.5,
         },
         Object {
-          "x": 1528966800000,
-          "y": 607,
+          "x": 1593889200000,
+          "y": 7.5,
         },
         Object {
-          "x": 1528977600000,
-          "y": 0,
+          "x": 1593889800000,
+          "y": 6,
         },
-      ],
-      "key": "HTTP 4xx",
-    },
-    Object {
-      "avg": 8203.6,
-      "dataPoints": Array [
         Object {
-          "x": 1528113600000,
-          "y": 604.5,
+          "x": 1593890400000,
+          "y": 8,
         },
         Object {
-          "x": 1528124400000,
-          "y": 601.5,
+          "x": 1593891000000,
+          "y": 6,
         },
         Object {
-          "x": 1528135200000,
-          "y": 598,
+          "x": 1593891600000,
+          "y": 8,
         },
         Object {
-          "x": 1528146000000,
-          "y": 615,
+          "x": 1593892200000,
+          "y": 11.5,
         },
         Object {
-          "x": 1528156800000,
-          "y": 616.5,
+          "x": 1593892800000,
+          "y": 5,
         },
         Object {
-          "x": 1528167600000,
-          "y": 636,
+          "x": 1593893400000,
+          "y": 5,
         },
         Object {
-          "x": 1528178400000,
-          "y": 609,
+          "x": 1593894000000,
+          "y": 9,
         },
         Object {
-          "x": 1528189200000,
-          "y": 608.5,
+          "x": 1593894600000,
+          "y": 5,
         },
         Object {
-          "x": 1528200000000,
-          "y": 617.5,
+          "x": 1593895200000,
+          "y": 8.5,
         },
         Object {
-          "x": 1528210800000,
-          "y": 624.5,
+          "x": 1593895800000,
+          "y": 6.5,
         },
         Object {
-          "x": 1528221600000,
-          "y": 579,
+          "x": 1593896400000,
+          "y": 9,
         },
         Object {
-          "x": 1528232400000,
-          "y": 607.5,
+          "x": 1593897000000,
+          "y": 8.5,
         },
         Object {
-          "x": 1528243200000,
-          "y": 595.5,
+          "x": 1593897600000,
+          "y": 8.5,
         },
         Object {
-          "x": 1528254000000,
-          "y": 617.5,
+          "x": 1593898200000,
+          "y": 5.5,
         },
         Object {
-          "x": 1528264800000,
-          "y": 606,
+          "x": 1593898800000,
+          "y": 5,
         },
         Object {
-          "x": 1528275600000,
-          "y": 590,
+          "x": 1593899400000,
+          "y": 9,
         },
         Object {
-          "x": 1528286400000,
-          "y": 545.5,
+          "x": 1593900000000,
+          "y": 8,
         },
         Object {
-          "x": 1528297200000,
-          "y": 588,
+          "x": 1593900600000,
+          "y": 6,
         },
         Object {
-          "x": 1528308000000,
-          "y": 621.5,
+          "x": 1593901200000,
+          "y": 9,
         },
         Object {
-          "x": 1528318800000,
-          "y": 604,
+          "x": 1593901800000,
+          "y": 4,
         },
         Object {
-          "x": 1528329600000,
-          "y": 601,
+          "x": 1593902400000,
+          "y": 0,
         },
         Object {
-          "x": 1528340400000,
-          "y": 644,
+          "x": 1593903000000,
+          "y": 0,
         },
         Object {
-          "x": 1528351200000,
-          "y": 620.5,
+          "x": 1593903600000,
+          "y": 0,
         },
         Object {
-          "x": 1528362000000,
-          "y": 607.5,
+          "x": 1593904200000,
+          "y": 0,
         },
         Object {
-          "x": 1528372800000,
-          "y": 576,
+          "x": 1593904800000,
+          "y": 0,
         },
         Object {
-          "x": 1528383600000,
-          "y": 620.5,
+          "x": 1593905400000,
+          "y": 0,
         },
         Object {
-          "x": 1528394400000,
-          "y": 588.5,
+          "x": 1593906000000,
+          "y": 0.5,
         },
         Object {
-          "x": 1528405200000,
-          "y": 621.5,
+          "x": 1593906600000,
+          "y": 0,
         },
         Object {
-          "x": 1528416000000,
-          "y": 627.5,
+          "x": 1593907200000,
+          "y": 0,
         },
         Object {
-          "x": 1528426800000,
-          "y": 594.5,
+          "x": 1593907800000,
+          "y": 0,
         },
         Object {
-          "x": 1528437600000,
-          "y": 591.5,
+          "x": 1593908400000,
+          "y": 0,
         },
         Object {
-          "x": 1528448400000,
-          "y": 607.5,
+          "x": 1593909000000,
+          "y": 0,
         },
         Object {
-          "x": 1528459200000,
-          "y": 641,
+          "x": 1593909600000,
+          "y": 0,
         },
         Object {
-          "x": 1528470000000,
-          "y": 588.5,
+          "x": 1593910200000,
+          "y": 1.5,
         },
         Object {
-          "x": 1528480800000,
-          "y": 599.5,
+          "x": 1593910800000,
+          "y": 0,
         },
         Object {
-          "x": 1528491600000,
-          "y": 617,
+          "x": 1593911400000,
+          "y": 0,
         },
         Object {
-          "x": 1528502400000,
-          "y": 142,
+          "x": 1593912000000,
+          "y": 0,
         },
         Object {
-          "x": 1528513200000,
-          "y": 153.5,
+          "x": 1593912600000,
+          "y": 0,
         },
         Object {
-          "x": 1528524000000,
-          "y": 141.5,
+          "x": 1593913200000,
+          "y": 0,
         },
         Object {
-          "x": 1528534800000,
-          "y": 151.5,
+          "x": 1593913800000,
+          "y": 0,
         },
         Object {
-          "x": 1528545600000,
-          "y": 163,
+          "x": 1593914400000,
+          "y": 0,
         },
         Object {
-          "x": 1528556400000,
-          "y": 134.5,
+          "x": 1593915000000,
+          "y": 0,
         },
         Object {
-          "x": 1528567200000,
-          "y": 148.5,
+          "x": 1593915600000,
+          "y": 0,
         },
         Object {
-          "x": 1528578000000,
-          "y": 139,
+          "x": 1593916200000,
+          "y": 0,
         },
         Object {
-          "x": 1528588800000,
-          "y": 144.5,
+          "x": 1593916800000,
+          "y": 1.5,
         },
         Object {
-          "x": 1528599600000,
-          "y": 136,
+          "x": 1593917400000,
+          "y": 0,
         },
         Object {
-          "x": 1528610400000,
-          "y": 139.5,
+          "x": 1593918000000,
+          "y": 0,
         },
         Object {
-          "x": 1528621200000,
-          "y": 119,
+          "x": 1593918600000,
+          "y": 0,
         },
         Object {
-          "x": 1528632000000,
-          "y": 144,
+          "x": 1593919200000,
+          "y": 0,
         },
         Object {
-          "x": 1528642800000,
-          "y": 129,
+          "x": 1593919800000,
+          "y": 0,
         },
         Object {
-          "x": 1528653600000,
-          "y": 132,
+          "x": 1593920400000,
+          "y": 0,
         },
         Object {
-          "x": 1528664400000,
-          "y": 148,
+          "x": 1593921000000,
+          "y": 0,
         },
         Object {
-          "x": 1528675200000,
-          "y": 606.5,
+          "x": 1593921600000,
+          "y": 0,
         },
         Object {
-          "x": 1528686000000,
-          "y": 627,
+          "x": 1593922200000,
+          "y": 0,
         },
         Object {
-          "x": 1528696800000,
-          "y": 567.5,
+          "x": 1593922800000,
+          "y": 0,
         },
         Object {
-          "x": 1528707600000,
-          "y": 620,
+          "x": 1593923400000,
+          "y": 1,
         },
         Object {
-          "x": 1528718400000,
-          "y": 607.5,
+          "x": 1593924000000,
+          "y": 0,
         },
         Object {
-          "x": 1528729200000,
-          "y": 619.5,
+          "x": 1593924600000,
+          "y": 0,
         },
         Object {
-          "x": 1528740000000,
-          "y": 604.5,
+          "x": 1593925200000,
+          "y": 0,
         },
         Object {
-          "x": 1528750800000,
-          "y": 604,
+          "x": 1593925800000,
+          "y": 0,
         },
         Object {
-          "x": 1528761600000,
-          "y": 588,
+          "x": 1593926400000,
+          "y": 0,
         },
         Object {
-          "x": 1528772400000,
-          "y": 603.5,
+          "x": 1593927000000,
+          "y": 0,
         },
         Object {
-          "x": 1528783200000,
-          "y": 599,
+          "x": 1593927600000,
+          "y": 0,
         },
         Object {
-          "x": 1528794000000,
-          "y": 582.5,
+          "x": 1593928200000,
+          "y": 0,
         },
         Object {
-          "x": 1528804800000,
-          "y": 594,
+          "x": 1593928800000,
+          "y": 0,
         },
         Object {
-          "x": 1528815600000,
-          "y": 622.5,
+          "x": 1593929400000,
+          "y": 0,
         },
         Object {
-          "x": 1528826400000,
-          "y": 619,
+          "x": 1593930000000,
+          "y": 1,
         },
         Object {
-          "x": 1528837200000,
-          "y": 641.5,
+          "x": 1593930600000,
+          "y": 0,
         },
         Object {
-          "x": 1528848000000,
-          "y": 599,
+          "x": 1593931200000,
+          "y": 0,
         },
         Object {
-          "x": 1528858800000,
-          "y": 586,
+          "x": 1593931800000,
+          "y": 0,
         },
         Object {
-          "x": 1528869600000,
-          "y": 614.5,
+          "x": 1593932400000,
+          "y": 0.5,
         },
         Object {
-          "x": 1528880400000,
-          "y": 619.5,
+          "x": 1593933000000,
+          "y": 0,
         },
         Object {
-          "x": 1528891200000,
-          "y": 615.5,
+          "x": 1593933600000,
+          "y": 0,
         },
         Object {
-          "x": 1528902000000,
-          "y": 624,
+          "x": 1593934200000,
+          "y": 0,
         },
         Object {
-          "x": 1528912800000,
-          "y": 610,
+          "x": 1593934800000,
+          "y": 0,
         },
         Object {
-          "x": 1528923600000,
-          "y": 612,
+          "x": 1593935400000,
+          "y": 0,
         },
         Object {
-          "x": 1528934400000,
-          "y": 544,
+          "x": 1593936000000,
+          "y": 0,
         },
         Object {
-          "x": 1528945200000,
-          "y": 617.5,
+          "x": 1593936600000,
+          "y": 3,
         },
         Object {
-          "x": 1528956000000,
-          "y": 580.5,
+          "x": 1593937200000,
+          "y": 8.5,
         },
         Object {
-          "x": 1528966800000,
-          "y": 591.5,
+          "x": 1593937800000,
+          "y": 8,
         },
         Object {
-          "x": 1528977600000,
-          "y": 0,
+          "x": 1593938400000,
+          "y": 2.5,
         },
       ],
       "key": "HTTP 5xx",
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.test.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.test.ts
index a7a740a239ea7..fdbd99bf274d6 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.test.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.test.ts
@@ -47,6 +47,7 @@ describe('timeseriesFetcher', () => {
           apmCustomLinkIndex: 'myIndex',
         },
       },
+      searchAggregatedTransactions: false,
     });
   });
 
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.ts
index f39529b59caa6..5a3948f577430 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.ts
@@ -4,11 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ProcessorEvent } from '../../../../../common/processor_event';
 import { ESFilter } from '../../../../../typings/elasticsearch';
 import {
   SERVICE_NAME,
-  TRANSACTION_DURATION,
   TRANSACTION_NAME,
   TRANSACTION_RESULT,
   TRANSACTION_TYPE,
@@ -21,6 +19,11 @@ import {
   SetupTimeRange,
   SetupUIFilters,
 } from '../../../helpers/setup_request';
+import {
+  getProcessorEventForAggregatedTransactions,
+  getTransactionDurationFieldForAggregatedTransactions,
+  getDocumentTypeFilterForAggregatedTransactions,
+} from '../../../helpers/aggregated_transactions';
 
 export type ESResponse = PromiseReturnType<typeof timeseriesFetcher>;
 export function timeseriesFetcher({
@@ -28,11 +31,13 @@ export function timeseriesFetcher({
   transactionType,
   transactionName,
   setup,
+  searchAggregatedTransactions,
 }: {
   serviceName: string;
   transactionType: string | undefined;
   transactionName: string | undefined;
   setup: Setup & SetupTimeRange & SetupUIFilters;
+  searchAggregatedTransactions: boolean;
 }) {
   const { start, end, uiFiltersES, apmEventClient } = setup;
   const { intervalString } = getBucketSize(start, end);
@@ -40,6 +45,9 @@ export function timeseriesFetcher({
   const filter: ESFilter[] = [
     { term: { [SERVICE_NAME]: serviceName } },
     { range: rangeFilter(start, end) },
+    ...getDocumentTypeFilterForAggregatedTransactions(
+      searchAggregatedTransactions
+    ),
     ...uiFiltersES,
   ];
 
@@ -54,7 +62,11 @@ export function timeseriesFetcher({
 
   const params = {
     apm: {
-      events: [ProcessorEvent.transaction as const],
+      events: [
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
+      ],
     },
     body: {
       size: 0,
@@ -68,17 +80,31 @@ export function timeseriesFetcher({
             extended_bounds: { min: start, max: end },
           },
           aggs: {
-            avg: { avg: { field: TRANSACTION_DURATION } },
+            avg: {
+              avg: {
+                field: getTransactionDurationFieldForAggregatedTransactions(
+                  searchAggregatedTransactions
+                ),
+              },
+            },
             pct: {
               percentiles: {
-                field: TRANSACTION_DURATION,
+                field: getTransactionDurationFieldForAggregatedTransactions(
+                  searchAggregatedTransactions
+                ),
                 percents: [95, 99],
                 hdr: { number_of_significant_value_digits: 2 },
               },
             },
           },
         },
-        overall_avg_duration: { avg: { field: TRANSACTION_DURATION } },
+        overall_avg_duration: {
+          avg: {
+            field: getTransactionDurationFieldForAggregatedTransactions(
+              searchAggregatedTransactions
+            ),
+          },
+        },
         transaction_results: {
           terms: { field: TRANSACTION_RESULT, missing: '' },
           aggs: {
@@ -89,6 +115,15 @@ export function timeseriesFetcher({
                 min_doc_count: 0,
                 extended_bounds: { min: start, max: end },
               },
+              aggs: {
+                count: {
+                  value_count: {
+                    field: getTransactionDurationFieldForAggregatedTransactions(
+                      searchAggregatedTransactions
+                    ),
+                  },
+                },
+              },
             },
           },
         },
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/index.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/index.ts
index ea06bd57bfff2..81dca447f16ca 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/index.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/index.ts
@@ -18,6 +18,7 @@ export async function getApmTimeseriesData(options: {
   transactionType: string | undefined;
   transactionName: string | undefined;
   setup: Setup & SetupTimeRange & SetupUIFilters;
+  searchAggregatedTransactions: boolean;
 }) {
   const { start, end } = options.setup;
   const { bucketSize } = getBucketSize(start, end);
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/mock_responses/timeseries_response.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/mock_responses/timeseries_response.ts
index cc30b256a4ffb..67084f8a42536 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/mock_responses/timeseries_response.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/mock_responses/timeseries_response.ts
@@ -7,17 +7,20 @@
 import { ESResponse } from '../fetcher';
 
 export const timeseriesResponse = ({
-  took: 368,
+  took: 206,
   timed_out: false,
   _shards: {
-    total: 90,
-    successful: 90,
+    total: 9,
+    successful: 9,
     skipped: 0,
     failed: 0,
   },
   hits: {
-    total: 1297673,
-    max_score: 0,
+    total: {
+      value: 10000,
+      relation: 'gte',
+    },
+    max_score: null,
     hits: [],
   },
   aggregations: {
@@ -32,2798 +35,6714 @@ export const timeseriesResponse = ({
         },
         {
           key: 'HTTP 2xx',
-          doc_count: 1127080,
+          doc_count: 12150,
           timeseries: {
             buckets: [
               {
-                key_as_string: '2018-06-04T12:00:00.000Z',
-                key: 1528113600000,
-                doc_count: 16446,
+                key_as_string: '2020-07-04T08:40:00.000Z',
+                key: 1593852000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T08:50:00.000Z',
+                key: 1593852600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T09:00:00.000Z',
+                key: 1593853200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T09:10:00.000Z',
+                key: 1593853800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T09:20:00.000Z',
+                key: 1593854400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T15:00:00.000Z',
-                key: 1528124400000,
-                doc_count: 16292,
+                key_as_string: '2020-07-04T09:30:00.000Z',
+                key: 1593855000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T18:00:00.000Z',
-                key: 1528135200000,
-                doc_count: 16464,
+                key_as_string: '2020-07-04T09:40:00.000Z',
+                key: 1593855600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T21:00:00.000Z',
-                key: 1528146000000,
-                doc_count: 16497,
+                key_as_string: '2020-07-04T09:50:00.000Z',
+                key: 1593856200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T00:00:00.000Z',
-                key: 1528156800000,
-                doc_count: 16799,
+                key_as_string: '2020-07-04T10:00:00.000Z',
+                key: 1593856800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T03:00:00.000Z',
-                key: 1528167600000,
-                doc_count: 16561,
+                key_as_string: '2020-07-04T10:10:00.000Z',
+                key: 1593857400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T06:00:00.000Z',
-                key: 1528178400000,
-                doc_count: 16431,
+                key_as_string: '2020-07-04T10:20:00.000Z',
+                key: 1593858000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T09:00:00.000Z',
-                key: 1528189200000,
-                doc_count: 16383,
+                key_as_string: '2020-07-04T10:30:00.000Z',
+                key: 1593858600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T12:00:00.000Z',
-                key: 1528200000000,
-                doc_count: 16295,
+                key_as_string: '2020-07-04T10:40:00.000Z',
+                key: 1593859200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T15:00:00.000Z',
-                key: 1528210800000,
-                doc_count: 16702,
+                key_as_string: '2020-07-04T10:50:00.000Z',
+                key: 1593859800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T18:00:00.000Z',
-                key: 1528221600000,
-                doc_count: 16469,
+                key_as_string: '2020-07-04T11:00:00.000Z',
+                key: 1593860400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T21:00:00.000Z',
-                key: 1528232400000,
-                doc_count: 16466,
+                key_as_string: '2020-07-04T11:10:00.000Z',
+                key: 1593861000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T00:00:00.000Z',
-                key: 1528243200000,
-                doc_count: 16551,
+                key_as_string: '2020-07-04T11:20:00.000Z',
+                key: 1593861600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T03:00:00.000Z',
-                key: 1528254000000,
-                doc_count: 16675,
+                key_as_string: '2020-07-04T11:30:00.000Z',
+                key: 1593862200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T06:00:00.000Z',
-                key: 1528264800000,
-                doc_count: 16410,
+                key_as_string: '2020-07-04T11:40:00.000Z',
+                key: 1593862800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T09:00:00.000Z',
-                key: 1528275600000,
-                doc_count: 16247,
+                key_as_string: '2020-07-04T11:50:00.000Z',
+                key: 1593863400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T12:00:00.000Z',
-                key: 1528286400000,
-                doc_count: 15145,
+                key_as_string: '2020-07-04T12:00:00.000Z',
+                key: 1593864000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T15:00:00.000Z',
-                key: 1528297200000,
-                doc_count: 16178,
+                key_as_string: '2020-07-04T12:10:00.000Z',
+                key: 1593864600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T18:00:00.000Z',
-                key: 1528308000000,
-                doc_count: 16530,
+                key_as_string: '2020-07-04T12:20:00.000Z',
+                key: 1593865200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T21:00:00.000Z',
-                key: 1528318800000,
-                doc_count: 16211,
+                key_as_string: '2020-07-04T12:30:00.000Z',
+                key: 1593865800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T00:00:00.000Z',
-                key: 1528329600000,
-                doc_count: 16453,
+                key_as_string: '2020-07-04T12:40:00.000Z',
+                key: 1593866400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T03:00:00.000Z',
-                key: 1528340400000,
-                doc_count: 16503,
+                key_as_string: '2020-07-04T12:50:00.000Z',
+                key: 1593867000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T06:00:00.000Z',
-                key: 1528351200000,
-                doc_count: 16604,
+                key_as_string: '2020-07-04T13:00:00.000Z',
+                key: 1593867600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T09:00:00.000Z',
-                key: 1528362000000,
-                doc_count: 16522,
+                key_as_string: '2020-07-04T13:10:00.000Z',
+                key: 1593868200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T12:00:00.000Z',
-                key: 1528372800000,
-                doc_count: 16164,
+                key_as_string: '2020-07-04T13:20:00.000Z',
+                key: 1593868800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T15:00:00.000Z',
-                key: 1528383600000,
-                doc_count: 16520,
+                key_as_string: '2020-07-04T13:30:00.000Z',
+                key: 1593869400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T18:00:00.000Z',
-                key: 1528394400000,
-                doc_count: 16534,
+                key_as_string: '2020-07-04T13:40:00.000Z',
+                key: 1593870000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T21:00:00.000Z',
-                key: 1528405200000,
-                doc_count: 16311,
+                key_as_string: '2020-07-04T13:50:00.000Z',
+                key: 1593870600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T00:00:00.000Z',
-                key: 1528416000000,
-                doc_count: 16670,
+                key_as_string: '2020-07-04T14:00:00.000Z',
+                key: 1593871200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T03:00:00.000Z',
-                key: 1528426800000,
-                doc_count: 16192,
+                key_as_string: '2020-07-04T14:10:00.000Z',
+                key: 1593871800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T06:00:00.000Z',
-                key: 1528437600000,
-                doc_count: 16579,
+                key_as_string: '2020-07-04T14:20:00.000Z',
+                key: 1593872400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T09:00:00.000Z',
-                key: 1528448400000,
-                doc_count: 16330,
+                key_as_string: '2020-07-04T14:30:00.000Z',
+                key: 1593873000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T12:00:00.000Z',
-                key: 1528459200000,
-                doc_count: 16565,
+                key_as_string: '2020-07-04T14:40:00.000Z',
+                key: 1593873600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T15:00:00.000Z',
-                key: 1528470000000,
-                doc_count: 16543,
+                key_as_string: '2020-07-04T14:50:00.000Z',
+                key: 1593874200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T18:00:00.000Z',
-                key: 1528480800000,
-                doc_count: 16492,
+                key_as_string: '2020-07-04T15:00:00.000Z',
+                key: 1593874800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T21:00:00.000Z',
-                key: 1528491600000,
-                doc_count: 16404,
+                key_as_string: '2020-07-04T15:10:00.000Z',
+                key: 1593875400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T00:00:00.000Z',
-                key: 1528502400000,
-                doc_count: 4528,
+                key_as_string: '2020-07-04T15:20:00.000Z',
+                key: 1593876000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T03:00:00.000Z',
-                key: 1528513200000,
-                doc_count: 4557,
+                key_as_string: '2020-07-04T15:30:00.000Z',
+                key: 1593876600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T06:00:00.000Z',
-                key: 1528524000000,
-                doc_count: 4566,
+                key_as_string: '2020-07-04T15:40:00.000Z',
+                key: 1593877200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T09:00:00.000Z',
-                key: 1528534800000,
-                doc_count: 4586,
+                key_as_string: '2020-07-04T15:50:00.000Z',
+                key: 1593877800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T12:00:00.000Z',
-                key: 1528545600000,
-                doc_count: 4672,
+                key_as_string: '2020-07-04T16:00:00.000Z',
+                key: 1593878400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T15:00:00.000Z',
-                key: 1528556400000,
-                doc_count: 4685,
+                key_as_string: '2020-07-04T16:10:00.000Z',
+                key: 1593879000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T18:00:00.000Z',
-                key: 1528567200000,
-                doc_count: 4521,
+                key_as_string: '2020-07-04T16:20:00.000Z',
+                key: 1593879600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T21:00:00.000Z',
-                key: 1528578000000,
-                doc_count: 4612,
+                key_as_string: '2020-07-04T16:30:00.000Z',
+                key: 1593880200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T00:00:00.000Z',
-                key: 1528588800000,
-                doc_count: 4535,
+                key_as_string: '2020-07-04T16:40:00.000Z',
+                key: 1593880800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T03:00:00.000Z',
-                key: 1528599600000,
-                doc_count: 4606,
+                key_as_string: '2020-07-04T16:50:00.000Z',
+                key: 1593881400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T06:00:00.000Z',
-                key: 1528610400000,
-                doc_count: 4614,
+                key_as_string: '2020-07-04T17:00:00.000Z',
+                key: 1593882000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T09:00:00.000Z',
-                key: 1528621200000,
-                doc_count: 4507,
+                key_as_string: '2020-07-04T17:10:00.000Z',
+                key: 1593882600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T12:00:00.000Z',
-                key: 1528632000000,
-                doc_count: 4611,
+                key_as_string: '2020-07-04T17:20:00.000Z',
+                key: 1593883200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T15:00:00.000Z',
-                key: 1528642800000,
-                doc_count: 4587,
+                key_as_string: '2020-07-04T17:30:00.000Z',
+                key: 1593883800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T18:00:00.000Z',
-                key: 1528653600000,
-                doc_count: 4582,
+                key_as_string: '2020-07-04T17:40:00.000Z',
+                key: 1593884400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T21:00:00.000Z',
-                key: 1528664400000,
-                doc_count: 4615,
+                key_as_string: '2020-07-04T17:50:00.000Z',
+                key: 1593885000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T00:00:00.000Z',
-                key: 1528675200000,
-                doc_count: 16251,
+                key_as_string: '2020-07-04T18:00:00.000Z',
+                key: 1593885600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T03:00:00.000Z',
-                key: 1528686000000,
-                doc_count: 16825,
+                key_as_string: '2020-07-04T18:10:00.000Z',
+                key: 1593886200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T06:00:00.000Z',
-                key: 1528696800000,
-                doc_count: 16288,
+                key_as_string: '2020-07-04T18:20:00.000Z',
+                key: 1593886800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T09:00:00.000Z',
-                key: 1528707600000,
-                doc_count: 16492,
+                key_as_string: '2020-07-04T18:30:00.000Z',
+                key: 1593887400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T12:00:00.000Z',
-                key: 1528718400000,
-                doc_count: 16434,
+                key_as_string: '2020-07-04T18:40:00.000Z',
+                key: 1593888000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T15:00:00.000Z',
-                key: 1528729200000,
-                doc_count: 17003,
+                key_as_string: '2020-07-04T18:50:00.000Z',
+                key: 1593888600000,
+                doc_count: 169,
+                count: {
+                  value: 169,
+                },
               },
               {
-                key_as_string: '2018-06-11T18:00:00.000Z',
-                key: 1528740000000,
-                doc_count: 16364,
+                key_as_string: '2020-07-04T19:00:00.000Z',
+                key: 1593889200000,
+                doc_count: 444,
+                count: {
+                  value: 444,
+                },
               },
               {
-                key_as_string: '2018-06-11T21:00:00.000Z',
-                key: 1528750800000,
-                doc_count: 16645,
+                key_as_string: '2020-07-04T19:10:00.000Z',
+                key: 1593889800000,
+                doc_count: 460,
+                count: {
+                  value: 460,
+                },
               },
               {
-                key_as_string: '2018-06-12T00:00:00.000Z',
-                key: 1528761600000,
-                doc_count: 16695,
+                key_as_string: '2020-07-04T19:20:00.000Z',
+                key: 1593890400000,
+                doc_count: 506,
+                count: {
+                  value: 506,
+                },
               },
               {
-                key_as_string: '2018-06-12T03:00:00.000Z',
-                key: 1528772400000,
-                doc_count: 16498,
+                key_as_string: '2020-07-04T19:30:00.000Z',
+                key: 1593891000000,
+                doc_count: 479,
+                count: {
+                  value: 479,
+                },
               },
               {
-                key_as_string: '2018-06-12T06:00:00.000Z',
-                key: 1528783200000,
-                doc_count: 16588,
+                key_as_string: '2020-07-04T19:40:00.000Z',
+                key: 1593891600000,
+                doc_count: 457,
+                count: {
+                  value: 457,
+                },
               },
               {
-                key_as_string: '2018-06-12T09:00:00.000Z',
-                key: 1528794000000,
-                doc_count: 16685,
+                key_as_string: '2020-07-04T19:50:00.000Z',
+                key: 1593892200000,
+                doc_count: 514,
+                count: {
+                  value: 514,
+                },
               },
               {
-                key_as_string: '2018-06-12T12:00:00.000Z',
-                key: 1528804800000,
-                doc_count: 16361,
+                key_as_string: '2020-07-04T20:00:00.000Z',
+                key: 1593892800000,
+                doc_count: 482,
+                count: {
+                  value: 482,
+                },
               },
               {
-                key_as_string: '2018-06-12T15:00:00.000Z',
-                key: 1528815600000,
-                doc_count: 16658,
+                key_as_string: '2020-07-04T20:10:00.000Z',
+                key: 1593893400000,
+                doc_count: 504,
+                count: {
+                  value: 504,
+                },
               },
               {
-                key_as_string: '2018-06-12T18:00:00.000Z',
-                key: 1528826400000,
-                doc_count: 16507,
+                key_as_string: '2020-07-04T20:20:00.000Z',
+                key: 1593894000000,
+                doc_count: 532,
+                count: {
+                  value: 532,
+                },
               },
               {
-                key_as_string: '2018-06-12T21:00:00.000Z',
-                key: 1528837200000,
-                doc_count: 16418,
+                key_as_string: '2020-07-04T20:30:00.000Z',
+                key: 1593894600000,
+                doc_count: 458,
+                count: {
+                  value: 458,
+                },
               },
               {
-                key_as_string: '2018-06-13T00:00:00.000Z',
-                key: 1528848000000,
-                doc_count: 16477,
+                key_as_string: '2020-07-04T20:40:00.000Z',
+                key: 1593895200000,
+                doc_count: 448,
+                count: {
+                  value: 448,
+                },
               },
               {
-                key_as_string: '2018-06-13T03:00:00.000Z',
-                key: 1528858800000,
-                doc_count: 16755,
+                key_as_string: '2020-07-04T20:50:00.000Z',
+                key: 1593895800000,
+                doc_count: 468,
+                count: {
+                  value: 468,
+                },
               },
               {
-                key_as_string: '2018-06-13T06:00:00.000Z',
-                key: 1528869600000,
-                doc_count: 16594,
+                key_as_string: '2020-07-04T21:00:00.000Z',
+                key: 1593896400000,
+                doc_count: 526,
+                count: {
+                  value: 526,
+                },
               },
               {
-                key_as_string: '2018-06-13T09:00:00.000Z',
-                key: 1528880400000,
-                doc_count: 16812,
+                key_as_string: '2020-07-04T21:10:00.000Z',
+                key: 1593897000000,
+                doc_count: 495,
+                count: {
+                  value: 495,
+                },
               },
               {
-                key_as_string: '2018-06-13T12:00:00.000Z',
-                key: 1528891200000,
-                doc_count: 16863,
+                key_as_string: '2020-07-04T21:20:00.000Z',
+                key: 1593897600000,
+                doc_count: 492,
+                count: {
+                  value: 492,
+                },
               },
               {
-                key_as_string: '2018-06-13T15:00:00.000Z',
-                key: 1528902000000,
-                doc_count: 16655,
+                key_as_string: '2020-07-04T21:30:00.000Z',
+                key: 1593898200000,
+                doc_count: 487,
+                count: {
+                  value: 487,
+                },
               },
               {
-                key_as_string: '2018-06-13T18:00:00.000Z',
-                key: 1528912800000,
-                doc_count: 16723,
+                key_as_string: '2020-07-04T21:40:00.000Z',
+                key: 1593898800000,
+                doc_count: 491,
+                count: {
+                  value: 491,
+                },
               },
               {
-                key_as_string: '2018-06-13T21:00:00.000Z',
-                key: 1528923600000,
-                doc_count: 16577,
+                key_as_string: '2020-07-04T21:50:00.000Z',
+                key: 1593899400000,
+                doc_count: 486,
+                count: {
+                  value: 486,
+                },
               },
               {
-                key_as_string: '2018-06-14T00:00:00.000Z',
-                key: 1528934400000,
-                doc_count: 15125,
+                key_as_string: '2020-07-04T22:00:00.000Z',
+                key: 1593900000000,
+                doc_count: 458,
+                count: {
+                  value: 458,
+                },
               },
               {
-                key_as_string: '2018-06-14T03:00:00.000Z',
-                key: 1528945200000,
-                doc_count: 16432,
+                key_as_string: '2020-07-04T22:10:00.000Z',
+                key: 1593900600000,
+                doc_count: 528,
+                count: {
+                  value: 528,
+                },
               },
               {
-                key_as_string: '2018-06-14T06:00:00.000Z',
-                key: 1528956000000,
-                doc_count: 16464,
+                key_as_string: '2020-07-04T22:20:00.000Z',
+                key: 1593901200000,
+                doc_count: 467,
+                count: {
+                  value: 467,
+                },
               },
               {
-                key_as_string: '2018-06-14T09:00:00.000Z',
-                key: 1528966800000,
-                doc_count: 16369,
+                key_as_string: '2020-07-04T22:30:00.000Z',
+                key: 1593901800000,
+                doc_count: 179,
+                count: {
+                  value: 179,
+                },
               },
               {
-                key_as_string: '2018-06-14T12:00:00.000Z',
-                key: 1528977600000,
+                key_as_string: '2020-07-04T22:40:00.000Z',
+                key: 1593902400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
-            ],
-          },
-        },
-        {
-          key: 'HTTP 5xx',
-          doc_count: 82036,
-          timeseries: {
-            buckets: [
               {
-                key_as_string: '2018-06-04T12:00:00.000Z',
-                key: 1528113600000,
-                doc_count: 1209,
+                key_as_string: '2020-07-04T22:50:00.000Z',
+                key: 1593903000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T15:00:00.000Z',
-                key: 1528124400000,
-                doc_count: 1203,
+                key_as_string: '2020-07-04T23:00:00.000Z',
+                key: 1593903600000,
+                doc_count: 39,
+                count: {
+                  value: 39,
+                },
               },
               {
-                key_as_string: '2018-06-04T18:00:00.000Z',
-                key: 1528135200000,
-                doc_count: 1196,
+                key_as_string: '2020-07-04T23:10:00.000Z',
+                key: 1593904200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T21:00:00.000Z',
-                key: 1528146000000,
-                doc_count: 1230,
+                key_as_string: '2020-07-04T23:20:00.000Z',
+                key: 1593904800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T00:00:00.000Z',
-                key: 1528156800000,
-                doc_count: 1233,
+                key_as_string: '2020-07-04T23:30:00.000Z',
+                key: 1593905400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T03:00:00.000Z',
-                key: 1528167600000,
-                doc_count: 1272,
+                key_as_string: '2020-07-04T23:40:00.000Z',
+                key: 1593906000000,
+                doc_count: 36,
+                count: {
+                  value: 36,
+                },
               },
               {
-                key_as_string: '2018-06-05T06:00:00.000Z',
-                key: 1528178400000,
-                doc_count: 1218,
+                key_as_string: '2020-07-04T23:50:00.000Z',
+                key: 1593906600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T09:00:00.000Z',
-                key: 1528189200000,
-                doc_count: 1217,
+                key_as_string: '2020-07-05T00:00:00.000Z',
+                key: 1593907200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T12:00:00.000Z',
-                key: 1528200000000,
-                doc_count: 1235,
+                key_as_string: '2020-07-05T00:10:00.000Z',
+                key: 1593907800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T15:00:00.000Z',
-                key: 1528210800000,
-                doc_count: 1249,
+                key_as_string: '2020-07-05T00:20:00.000Z',
+                key: 1593908400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T18:00:00.000Z',
-                key: 1528221600000,
-                doc_count: 1158,
+                key_as_string: '2020-07-05T00:30:00.000Z',
+                key: 1593909000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T21:00:00.000Z',
-                key: 1528232400000,
-                doc_count: 1215,
+                key_as_string: '2020-07-05T00:40:00.000Z',
+                key: 1593909600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T00:00:00.000Z',
-                key: 1528243200000,
-                doc_count: 1191,
+                key_as_string: '2020-07-05T00:50:00.000Z',
+                key: 1593910200000,
+                doc_count: 34,
+                count: {
+                  value: 34,
+                },
               },
               {
-                key_as_string: '2018-06-06T03:00:00.000Z',
-                key: 1528254000000,
-                doc_count: 1235,
+                key_as_string: '2020-07-05T01:00:00.000Z',
+                key: 1593910800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T06:00:00.000Z',
-                key: 1528264800000,
-                doc_count: 1212,
+                key_as_string: '2020-07-05T01:10:00.000Z',
+                key: 1593911400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T09:00:00.000Z',
-                key: 1528275600000,
-                doc_count: 1180,
+                key_as_string: '2020-07-05T01:20:00.000Z',
+                key: 1593912000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T12:00:00.000Z',
-                key: 1528286400000,
-                doc_count: 1091,
+                key_as_string: '2020-07-05T01:30:00.000Z',
+                key: 1593912600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T15:00:00.000Z',
-                key: 1528297200000,
-                doc_count: 1176,
+                key_as_string: '2020-07-05T01:40:00.000Z',
+                key: 1593913200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T18:00:00.000Z',
-                key: 1528308000000,
-                doc_count: 1243,
+                key_as_string: '2020-07-05T01:50:00.000Z',
+                key: 1593913800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T21:00:00.000Z',
-                key: 1528318800000,
-                doc_count: 1208,
+                key_as_string: '2020-07-05T02:00:00.000Z',
+                key: 1593914400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T00:00:00.000Z',
-                key: 1528329600000,
-                doc_count: 1202,
+                key_as_string: '2020-07-05T02:10:00.000Z',
+                key: 1593915000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T03:00:00.000Z',
-                key: 1528340400000,
-                doc_count: 1288,
+                key_as_string: '2020-07-05T02:20:00.000Z',
+                key: 1593915600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T06:00:00.000Z',
-                key: 1528351200000,
-                doc_count: 1241,
+                key_as_string: '2020-07-05T02:30:00.000Z',
+                key: 1593916200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T09:00:00.000Z',
-                key: 1528362000000,
-                doc_count: 1215,
+                key_as_string: '2020-07-05T02:40:00.000Z',
+                key: 1593916800000,
+                doc_count: 31,
+                count: {
+                  value: 31,
+                },
               },
               {
-                key_as_string: '2018-06-07T12:00:00.000Z',
-                key: 1528372800000,
-                doc_count: 1152,
+                key_as_string: '2020-07-05T02:50:00.000Z',
+                key: 1593917400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T15:00:00.000Z',
-                key: 1528383600000,
-                doc_count: 1241,
+                key_as_string: '2020-07-05T03:00:00.000Z',
+                key: 1593918000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T18:00:00.000Z',
-                key: 1528394400000,
-                doc_count: 1177,
+                key_as_string: '2020-07-05T03:10:00.000Z',
+                key: 1593918600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T21:00:00.000Z',
-                key: 1528405200000,
-                doc_count: 1243,
+                key_as_string: '2020-07-05T03:20:00.000Z',
+                key: 1593919200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T00:00:00.000Z',
-                key: 1528416000000,
-                doc_count: 1255,
+                key_as_string: '2020-07-05T03:30:00.000Z',
+                key: 1593919800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T03:00:00.000Z',
-                key: 1528426800000,
-                doc_count: 1189,
+                key_as_string: '2020-07-05T03:40:00.000Z',
+                key: 1593920400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T06:00:00.000Z',
-                key: 1528437600000,
-                doc_count: 1183,
+                key_as_string: '2020-07-05T03:50:00.000Z',
+                key: 1593921000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T09:00:00.000Z',
-                key: 1528448400000,
-                doc_count: 1215,
+                key_as_string: '2020-07-05T04:00:00.000Z',
+                key: 1593921600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T12:00:00.000Z',
-                key: 1528459200000,
-                doc_count: 1282,
+                key_as_string: '2020-07-05T04:10:00.000Z',
+                key: 1593922200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T15:00:00.000Z',
-                key: 1528470000000,
-                doc_count: 1177,
+                key_as_string: '2020-07-05T04:20:00.000Z',
+                key: 1593922800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T18:00:00.000Z',
-                key: 1528480800000,
-                doc_count: 1199,
+                key_as_string: '2020-07-05T04:30:00.000Z',
+                key: 1593923400000,
+                doc_count: 49,
+                count: {
+                  value: 49,
+                },
               },
               {
-                key_as_string: '2018-06-08T21:00:00.000Z',
-                key: 1528491600000,
-                doc_count: 1234,
+                key_as_string: '2020-07-05T04:40:00.000Z',
+                key: 1593924000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T00:00:00.000Z',
-                key: 1528502400000,
-                doc_count: 284,
+                key_as_string: '2020-07-05T04:50:00.000Z',
+                key: 1593924600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T03:00:00.000Z',
-                key: 1528513200000,
-                doc_count: 307,
+                key_as_string: '2020-07-05T05:00:00.000Z',
+                key: 1593925200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T06:00:00.000Z',
-                key: 1528524000000,
-                doc_count: 283,
+                key_as_string: '2020-07-05T05:10:00.000Z',
+                key: 1593925800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T09:00:00.000Z',
-                key: 1528534800000,
-                doc_count: 303,
+                key_as_string: '2020-07-05T05:20:00.000Z',
+                key: 1593926400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T12:00:00.000Z',
-                key: 1528545600000,
-                doc_count: 326,
+                key_as_string: '2020-07-05T05:30:00.000Z',
+                key: 1593927000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T15:00:00.000Z',
-                key: 1528556400000,
-                doc_count: 269,
+                key_as_string: '2020-07-05T05:40:00.000Z',
+                key: 1593927600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T18:00:00.000Z',
-                key: 1528567200000,
-                doc_count: 297,
+                key_as_string: '2020-07-05T05:50:00.000Z',
+                key: 1593928200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T21:00:00.000Z',
-                key: 1528578000000,
-                doc_count: 278,
+                key_as_string: '2020-07-05T06:00:00.000Z',
+                key: 1593928800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T00:00:00.000Z',
-                key: 1528588800000,
-                doc_count: 289,
+                key_as_string: '2020-07-05T06:10:00.000Z',
+                key: 1593929400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T03:00:00.000Z',
-                key: 1528599600000,
-                doc_count: 272,
+                key_as_string: '2020-07-05T06:20:00.000Z',
+                key: 1593930000000,
+                doc_count: 50,
+                count: {
+                  value: 50,
+                },
               },
               {
-                key_as_string: '2018-06-10T06:00:00.000Z',
-                key: 1528610400000,
-                doc_count: 279,
+                key_as_string: '2020-07-05T06:30:00.000Z',
+                key: 1593930600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T09:00:00.000Z',
-                key: 1528621200000,
-                doc_count: 238,
+                key_as_string: '2020-07-05T06:40:00.000Z',
+                key: 1593931200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T12:00:00.000Z',
-                key: 1528632000000,
-                doc_count: 288,
+                key_as_string: '2020-07-05T06:50:00.000Z',
+                key: 1593931800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T15:00:00.000Z',
-                key: 1528642800000,
-                doc_count: 258,
+                key_as_string: '2020-07-05T07:00:00.000Z',
+                key: 1593932400000,
+                doc_count: 37,
+                count: {
+                  value: 37,
+                },
               },
               {
-                key_as_string: '2018-06-10T18:00:00.000Z',
-                key: 1528653600000,
-                doc_count: 264,
+                key_as_string: '2020-07-05T07:10:00.000Z',
+                key: 1593933000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T21:00:00.000Z',
-                key: 1528664400000,
-                doc_count: 296,
+                key_as_string: '2020-07-05T07:20:00.000Z',
+                key: 1593933600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T00:00:00.000Z',
-                key: 1528675200000,
-                doc_count: 1213,
+                key_as_string: '2020-07-05T07:30:00.000Z',
+                key: 1593934200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T03:00:00.000Z',
-                key: 1528686000000,
-                doc_count: 1254,
+                key_as_string: '2020-07-05T07:40:00.000Z',
+                key: 1593934800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T06:00:00.000Z',
-                key: 1528696800000,
-                doc_count: 1135,
+                key_as_string: '2020-07-05T07:50:00.000Z',
+                key: 1593935400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T09:00:00.000Z',
-                key: 1528707600000,
-                doc_count: 1240,
+                key_as_string: '2020-07-05T08:00:00.000Z',
+                key: 1593936000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T12:00:00.000Z',
-                key: 1528718400000,
-                doc_count: 1215,
+                key_as_string: '2020-07-05T08:10:00.000Z',
+                key: 1593936600000,
+                doc_count: 194,
+                count: {
+                  value: 194,
+                },
               },
               {
-                key_as_string: '2018-06-11T15:00:00.000Z',
-                key: 1528729200000,
-                doc_count: 1239,
+                key_as_string: '2020-07-05T08:20:00.000Z',
+                key: 1593937200000,
+                doc_count: 385,
+                count: {
+                  value: 385,
+                },
               },
               {
-                key_as_string: '2018-06-11T18:00:00.000Z',
-                key: 1528740000000,
-                doc_count: 1209,
+                key_as_string: '2020-07-05T08:30:00.000Z',
+                key: 1593937800000,
+                doc_count: 421,
+                count: {
+                  value: 421,
+                },
               },
               {
-                key_as_string: '2018-06-11T21:00:00.000Z',
-                key: 1528750800000,
-                doc_count: 1208,
+                key_as_string: '2020-07-05T08:40:00.000Z',
+                key: 1593938400000,
+                doc_count: 344,
+                count: {
+                  value: 344,
+                },
               },
+            ],
+          },
+        },
+        {
+          key: 'HTTP 3xx',
+          doc_count: 3828,
+          timeseries: {
+            buckets: [
               {
-                key_as_string: '2018-06-12T00:00:00.000Z',
-                key: 1528761600000,
-                doc_count: 1176,
+                key_as_string: '2020-07-04T08:40:00.000Z',
+                key: 1593852000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T03:00:00.000Z',
-                key: 1528772400000,
-                doc_count: 1207,
+                key_as_string: '2020-07-04T08:50:00.000Z',
+                key: 1593852600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T06:00:00.000Z',
-                key: 1528783200000,
-                doc_count: 1198,
+                key_as_string: '2020-07-04T09:00:00.000Z',
+                key: 1593853200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T09:00:00.000Z',
-                key: 1528794000000,
-                doc_count: 1165,
+                key_as_string: '2020-07-04T09:10:00.000Z',
+                key: 1593853800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T12:00:00.000Z',
-                key: 1528804800000,
-                doc_count: 1188,
+                key_as_string: '2020-07-04T09:20:00.000Z',
+                key: 1593854400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T15:00:00.000Z',
-                key: 1528815600000,
-                doc_count: 1245,
+                key_as_string: '2020-07-04T09:30:00.000Z',
+                key: 1593855000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T18:00:00.000Z',
-                key: 1528826400000,
-                doc_count: 1238,
+                key_as_string: '2020-07-04T09:40:00.000Z',
+                key: 1593855600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T21:00:00.000Z',
-                key: 1528837200000,
-                doc_count: 1283,
+                key_as_string: '2020-07-04T09:50:00.000Z',
+                key: 1593856200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T00:00:00.000Z',
-                key: 1528848000000,
-                doc_count: 1198,
+                key_as_string: '2020-07-04T10:00:00.000Z',
+                key: 1593856800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T03:00:00.000Z',
-                key: 1528858800000,
-                doc_count: 1172,
+                key_as_string: '2020-07-04T10:10:00.000Z',
+                key: 1593857400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T06:00:00.000Z',
-                key: 1528869600000,
-                doc_count: 1229,
+                key_as_string: '2020-07-04T10:20:00.000Z',
+                key: 1593858000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T09:00:00.000Z',
-                key: 1528880400000,
-                doc_count: 1239,
+                key_as_string: '2020-07-04T10:30:00.000Z',
+                key: 1593858600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T12:00:00.000Z',
-                key: 1528891200000,
-                doc_count: 1231,
+                key_as_string: '2020-07-04T10:40:00.000Z',
+                key: 1593859200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T15:00:00.000Z',
-                key: 1528902000000,
-                doc_count: 1248,
+                key_as_string: '2020-07-04T10:50:00.000Z',
+                key: 1593859800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T18:00:00.000Z',
-                key: 1528912800000,
-                doc_count: 1220,
+                key_as_string: '2020-07-04T11:00:00.000Z',
+                key: 1593860400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T21:00:00.000Z',
-                key: 1528923600000,
-                doc_count: 1224,
+                key_as_string: '2020-07-04T11:10:00.000Z',
+                key: 1593861000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T00:00:00.000Z',
-                key: 1528934400000,
-                doc_count: 1088,
+                key_as_string: '2020-07-04T11:20:00.000Z',
+                key: 1593861600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T03:00:00.000Z',
-                key: 1528945200000,
-                doc_count: 1235,
+                key_as_string: '2020-07-04T11:30:00.000Z',
+                key: 1593862200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T06:00:00.000Z',
-                key: 1528956000000,
-                doc_count: 1161,
+                key_as_string: '2020-07-04T11:40:00.000Z',
+                key: 1593862800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T09:00:00.000Z',
-                key: 1528966800000,
-                doc_count: 1183,
+                key_as_string: '2020-07-04T11:50:00.000Z',
+                key: 1593863400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T12:00:00.000Z',
-                key: 1528977600000,
+                key_as_string: '2020-07-04T12:00:00.000Z',
+                key: 1593864000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
-            ],
-          },
-        },
-        {
-          key: 'HTTP 4xx',
-          doc_count: 81907,
-          timeseries: {
-            buckets: [
               {
-                key_as_string: '2018-06-04T12:00:00.000Z',
-                key: 1528113600000,
-                doc_count: 1186,
+                key_as_string: '2020-07-04T12:10:00.000Z',
+                key: 1593864600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T15:00:00.000Z',
-                key: 1528124400000,
-                doc_count: 1213,
+                key_as_string: '2020-07-04T12:20:00.000Z',
+                key: 1593865200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T18:00:00.000Z',
-                key: 1528135200000,
-                doc_count: 1205,
+                key_as_string: '2020-07-04T12:30:00.000Z',
+                key: 1593865800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T21:00:00.000Z',
-                key: 1528146000000,
-                doc_count: 1162,
+                key_as_string: '2020-07-04T12:40:00.000Z',
+                key: 1593866400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T00:00:00.000Z',
-                key: 1528156800000,
-                doc_count: 1238,
+                key_as_string: '2020-07-04T12:50:00.000Z',
+                key: 1593867000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T03:00:00.000Z',
-                key: 1528167600000,
-                doc_count: 1191,
+                key_as_string: '2020-07-04T13:00:00.000Z',
+                key: 1593867600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T06:00:00.000Z',
-                key: 1528178400000,
-                doc_count: 1274,
+                key_as_string: '2020-07-04T13:10:00.000Z',
+                key: 1593868200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T09:00:00.000Z',
-                key: 1528189200000,
-                doc_count: 1234,
+                key_as_string: '2020-07-04T13:20:00.000Z',
+                key: 1593868800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T12:00:00.000Z',
-                key: 1528200000000,
-                doc_count: 1164,
+                key_as_string: '2020-07-04T13:30:00.000Z',
+                key: 1593869400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T15:00:00.000Z',
-                key: 1528210800000,
-                doc_count: 1233,
+                key_as_string: '2020-07-04T13:40:00.000Z',
+                key: 1593870000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T18:00:00.000Z',
-                key: 1528221600000,
-                doc_count: 1223,
+                key_as_string: '2020-07-04T13:50:00.000Z',
+                key: 1593870600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T21:00:00.000Z',
-                key: 1528232400000,
-                doc_count: 1216,
+                key_as_string: '2020-07-04T14:00:00.000Z',
+                key: 1593871200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T00:00:00.000Z',
-                key: 1528243200000,
-                doc_count: 1200,
+                key_as_string: '2020-07-04T14:10:00.000Z',
+                key: 1593871800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T03:00:00.000Z',
-                key: 1528254000000,
-                doc_count: 1237,
+                key_as_string: '2020-07-04T14:20:00.000Z',
+                key: 1593872400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T06:00:00.000Z',
-                key: 1528264800000,
-                doc_count: 1231,
+                key_as_string: '2020-07-04T14:30:00.000Z',
+                key: 1593873000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T09:00:00.000Z',
-                key: 1528275600000,
-                doc_count: 1182,
+                key_as_string: '2020-07-04T14:40:00.000Z',
+                key: 1593873600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T12:00:00.000Z',
-                key: 1528286400000,
-                doc_count: 1125,
+                key_as_string: '2020-07-04T14:50:00.000Z',
+                key: 1593874200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T15:00:00.000Z',
-                key: 1528297200000,
-                doc_count: 1243,
+                key_as_string: '2020-07-04T15:00:00.000Z',
+                key: 1593874800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T18:00:00.000Z',
-                key: 1528308000000,
-                doc_count: 1247,
+                key_as_string: '2020-07-04T15:10:00.000Z',
+                key: 1593875400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T21:00:00.000Z',
-                key: 1528318800000,
-                doc_count: 1163,
+                key_as_string: '2020-07-04T15:20:00.000Z',
+                key: 1593876000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T00:00:00.000Z',
-                key: 1528329600000,
-                doc_count: 1220,
+                key_as_string: '2020-07-04T15:30:00.000Z',
+                key: 1593876600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T03:00:00.000Z',
-                key: 1528340400000,
-                doc_count: 1202,
+                key_as_string: '2020-07-04T15:40:00.000Z',
+                key: 1593877200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T06:00:00.000Z',
-                key: 1528351200000,
-                doc_count: 1192,
+                key_as_string: '2020-07-04T15:50:00.000Z',
+                key: 1593877800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T09:00:00.000Z',
-                key: 1528362000000,
-                doc_count: 1248,
+                key_as_string: '2020-07-04T16:00:00.000Z',
+                key: 1593878400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T12:00:00.000Z',
-                key: 1528372800000,
-                doc_count: 1189,
+                key_as_string: '2020-07-04T16:10:00.000Z',
+                key: 1593879000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T15:00:00.000Z',
-                key: 1528383600000,
-                doc_count: 1230,
+                key_as_string: '2020-07-04T16:20:00.000Z',
+                key: 1593879600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T18:00:00.000Z',
-                key: 1528394400000,
-                doc_count: 1206,
+                key_as_string: '2020-07-04T16:30:00.000Z',
+                key: 1593880200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T21:00:00.000Z',
-                key: 1528405200000,
-                doc_count: 1190,
+                key_as_string: '2020-07-04T16:40:00.000Z',
+                key: 1593880800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T00:00:00.000Z',
-                key: 1528416000000,
-                doc_count: 1232,
+                key_as_string: '2020-07-04T16:50:00.000Z',
+                key: 1593881400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T03:00:00.000Z',
-                key: 1528426800000,
-                doc_count: 1171,
+                key_as_string: '2020-07-04T17:00:00.000Z',
+                key: 1593882000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T06:00:00.000Z',
-                key: 1528437600000,
-                doc_count: 1232,
+                key_as_string: '2020-07-04T17:10:00.000Z',
+                key: 1593882600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T09:00:00.000Z',
-                key: 1528448400000,
-                doc_count: 1253,
+                key_as_string: '2020-07-04T17:20:00.000Z',
+                key: 1593883200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T12:00:00.000Z',
-                key: 1528459200000,
-                doc_count: 1250,
+                key_as_string: '2020-07-04T17:30:00.000Z',
+                key: 1593883800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T15:00:00.000Z',
-                key: 1528470000000,
-                doc_count: 1167,
+                key_as_string: '2020-07-04T17:40:00.000Z',
+                key: 1593884400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T18:00:00.000Z',
-                key: 1528480800000,
-                doc_count: 1258,
+                key_as_string: '2020-07-04T17:50:00.000Z',
+                key: 1593885000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T21:00:00.000Z',
-                key: 1528491600000,
-                doc_count: 1148,
+                key_as_string: '2020-07-04T18:00:00.000Z',
+                key: 1593885600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T00:00:00.000Z',
-                key: 1528502400000,
-                doc_count: 284,
+                key_as_string: '2020-07-04T18:10:00.000Z',
+                key: 1593886200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T03:00:00.000Z',
-                key: 1528513200000,
-                doc_count: 240,
+                key_as_string: '2020-07-04T18:20:00.000Z',
+                key: 1593886800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T06:00:00.000Z',
-                key: 1528524000000,
-                doc_count: 273,
+                key_as_string: '2020-07-04T18:30:00.000Z',
+                key: 1593887400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T09:00:00.000Z',
-                key: 1528534800000,
-                doc_count: 295,
+                key_as_string: '2020-07-04T18:40:00.000Z',
+                key: 1593888000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T12:00:00.000Z',
-                key: 1528545600000,
-                doc_count: 281,
+                key_as_string: '2020-07-04T18:50:00.000Z',
+                key: 1593888600000,
+                doc_count: 62,
+                count: {
+                  value: 62,
+                },
               },
               {
-                key_as_string: '2018-06-09T15:00:00.000Z',
-                key: 1528556400000,
-                doc_count: 300,
+                key_as_string: '2020-07-04T19:00:00.000Z',
+                key: 1593889200000,
+                doc_count: 52,
+                count: {
+                  value: 52,
+                },
               },
               {
-                key_as_string: '2018-06-09T18:00:00.000Z',
-                key: 1528567200000,
-                doc_count: 264,
+                key_as_string: '2020-07-04T19:10:00.000Z',
+                key: 1593889800000,
+                doc_count: 128,
+                count: {
+                  value: 128,
+                },
               },
               {
-                key_as_string: '2018-06-09T21:00:00.000Z',
-                key: 1528578000000,
-                doc_count: 260,
+                key_as_string: '2020-07-04T19:20:00.000Z',
+                key: 1593890400000,
+                doc_count: 143,
+                count: {
+                  value: 143,
+                },
               },
               {
-                key_as_string: '2018-06-10T00:00:00.000Z',
-                key: 1528588800000,
-                doc_count: 279,
+                key_as_string: '2020-07-04T19:30:00.000Z',
+                key: 1593891000000,
+                doc_count: 129,
+                count: {
+                  value: 129,
+                },
               },
               {
-                key_as_string: '2018-06-10T03:00:00.000Z',
-                key: 1528599600000,
-                doc_count: 259,
+                key_as_string: '2020-07-04T19:40:00.000Z',
+                key: 1593891600000,
+                doc_count: 121,
+                count: {
+                  value: 121,
+                },
               },
               {
-                key_as_string: '2018-06-10T06:00:00.000Z',
-                key: 1528610400000,
-                doc_count: 291,
+                key_as_string: '2020-07-04T19:50:00.000Z',
+                key: 1593892200000,
+                doc_count: 292,
+                count: {
+                  value: 292,
+                },
               },
               {
-                key_as_string: '2018-06-10T09:00:00.000Z',
-                key: 1528621200000,
-                doc_count: 248,
+                key_as_string: '2020-07-04T20:00:00.000Z',
+                key: 1593892800000,
+                doc_count: 139,
+                count: {
+                  value: 139,
+                },
               },
               {
-                key_as_string: '2018-06-10T12:00:00.000Z',
-                key: 1528632000000,
-                doc_count: 311,
+                key_as_string: '2020-07-04T20:10:00.000Z',
+                key: 1593893400000,
+                doc_count: 104,
+                count: {
+                  value: 104,
+                },
               },
               {
-                key_as_string: '2018-06-10T15:00:00.000Z',
-                key: 1528642800000,
-                doc_count: 277,
+                key_as_string: '2020-07-04T20:20:00.000Z',
+                key: 1593894000000,
+                doc_count: 198,
+                count: {
+                  value: 198,
+                },
               },
               {
-                key_as_string: '2018-06-10T18:00:00.000Z',
-                key: 1528653600000,
-                doc_count: 279,
+                key_as_string: '2020-07-04T20:30:00.000Z',
+                key: 1593894600000,
+                doc_count: 179,
+                count: {
+                  value: 179,
+                },
               },
               {
-                key_as_string: '2018-06-10T21:00:00.000Z',
-                key: 1528664400000,
-                doc_count: 275,
+                key_as_string: '2020-07-04T20:40:00.000Z',
+                key: 1593895200000,
+                doc_count: 117,
+                count: {
+                  value: 117,
+                },
               },
               {
-                key_as_string: '2018-06-11T00:00:00.000Z',
-                key: 1528675200000,
-                doc_count: 1167,
+                key_as_string: '2020-07-04T20:50:00.000Z',
+                key: 1593895800000,
+                doc_count: 183,
+                count: {
+                  value: 183,
+                },
               },
               {
-                key_as_string: '2018-06-11T03:00:00.000Z',
-                key: 1528686000000,
-                doc_count: 1270,
+                key_as_string: '2020-07-04T21:00:00.000Z',
+                key: 1593896400000,
+                doc_count: 264,
+                count: {
+                  value: 264,
+                },
               },
               {
-                key_as_string: '2018-06-11T06:00:00.000Z',
-                key: 1528696800000,
-                doc_count: 1163,
+                key_as_string: '2020-07-04T21:10:00.000Z',
+                key: 1593897000000,
+                doc_count: 180,
+                count: {
+                  value: 180,
+                },
               },
               {
-                key_as_string: '2018-06-11T09:00:00.000Z',
-                key: 1528707600000,
-                doc_count: 1155,
+                key_as_string: '2020-07-04T21:20:00.000Z',
+                key: 1593897600000,
+                doc_count: 160,
+                count: {
+                  value: 160,
+                },
               },
               {
-                key_as_string: '2018-06-11T12:00:00.000Z',
-                key: 1528718400000,
-                doc_count: 1217,
+                key_as_string: '2020-07-04T21:30:00.000Z',
+                key: 1593898200000,
+                doc_count: 208,
+                count: {
+                  value: 208,
+                },
               },
               {
-                key_as_string: '2018-06-11T15:00:00.000Z',
-                key: 1528729200000,
-                doc_count: 1227,
+                key_as_string: '2020-07-04T21:40:00.000Z',
+                key: 1593898800000,
+                doc_count: 158,
+                count: {
+                  value: 158,
+                },
               },
               {
-                key_as_string: '2018-06-11T18:00:00.000Z',
-                key: 1528740000000,
-                doc_count: 1194,
+                key_as_string: '2020-07-04T21:50:00.000Z',
+                key: 1593899400000,
+                doc_count: 176,
+                count: {
+                  value: 176,
+                },
               },
               {
-                key_as_string: '2018-06-11T21:00:00.000Z',
-                key: 1528750800000,
-                doc_count: 1153,
+                key_as_string: '2020-07-04T22:00:00.000Z',
+                key: 1593900000000,
+                doc_count: 183,
+                count: {
+                  value: 183,
+                },
               },
               {
-                key_as_string: '2018-06-12T00:00:00.000Z',
-                key: 1528761600000,
-                doc_count: 1211,
+                key_as_string: '2020-07-04T22:10:00.000Z',
+                key: 1593900600000,
+                doc_count: 234,
+                count: {
+                  value: 234,
+                },
               },
               {
-                key_as_string: '2018-06-12T03:00:00.000Z',
-                key: 1528772400000,
-                doc_count: 1203,
+                key_as_string: '2020-07-04T22:20:00.000Z',
+                key: 1593901200000,
+                doc_count: 125,
+                count: {
+                  value: 125,
+                },
               },
               {
-                key_as_string: '2018-06-12T06:00:00.000Z',
-                key: 1528783200000,
-                doc_count: 1269,
+                key_as_string: '2020-07-04T22:30:00.000Z',
+                key: 1593901800000,
+                doc_count: 48,
+                count: {
+                  value: 48,
+                },
               },
               {
-                key_as_string: '2018-06-12T09:00:00.000Z',
-                key: 1528794000000,
-                doc_count: 1197,
+                key_as_string: '2020-07-04T22:40:00.000Z',
+                key: 1593902400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T12:00:00.000Z',
-                key: 1528804800000,
-                doc_count: 1184,
+                key_as_string: '2020-07-04T22:50:00.000Z',
+                key: 1593903000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T15:00:00.000Z',
-                key: 1528815600000,
-                doc_count: 1176,
+                key_as_string: '2020-07-04T23:00:00.000Z',
+                key: 1593903600000,
+                doc_count: 9,
+                count: {
+                  value: 9,
+                },
               },
               {
-                key_as_string: '2018-06-12T18:00:00.000Z',
-                key: 1528826400000,
-                doc_count: 1162,
+                key_as_string: '2020-07-04T23:10:00.000Z',
+                key: 1593904200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T21:00:00.000Z',
-                key: 1528837200000,
-                doc_count: 1270,
+                key_as_string: '2020-07-04T23:20:00.000Z',
+                key: 1593904800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T00:00:00.000Z',
-                key: 1528848000000,
-                doc_count: 1224,
+                key_as_string: '2020-07-04T23:30:00.000Z',
+                key: 1593905400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T03:00:00.000Z',
-                key: 1528858800000,
-                doc_count: 1255,
+                key_as_string: '2020-07-04T23:40:00.000Z',
+                key: 1593906000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T06:00:00.000Z',
-                key: 1528869600000,
-                doc_count: 1207,
+                key_as_string: '2020-07-04T23:50:00.000Z',
+                key: 1593906600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T09:00:00.000Z',
-                key: 1528880400000,
-                doc_count: 1206,
+                key_as_string: '2020-07-05T00:00:00.000Z',
+                key: 1593907200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T12:00:00.000Z',
-                key: 1528891200000,
-                doc_count: 1254,
+                key_as_string: '2020-07-05T00:10:00.000Z',
+                key: 1593907800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T15:00:00.000Z',
-                key: 1528902000000,
-                doc_count: 1216,
+                key_as_string: '2020-07-05T00:20:00.000Z',
+                key: 1593908400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T18:00:00.000Z',
-                key: 1528912800000,
-                doc_count: 1263,
+                key_as_string: '2020-07-05T00:30:00.000Z',
+                key: 1593909000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T21:00:00.000Z',
-                key: 1528923600000,
-                doc_count: 1277,
+                key_as_string: '2020-07-05T00:40:00.000Z',
+                key: 1593909600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T00:00:00.000Z',
-                key: 1528934400000,
-                doc_count: 1183,
+                key_as_string: '2020-07-05T00:50:00.000Z',
+                key: 1593910200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T03:00:00.000Z',
-                key: 1528945200000,
-                doc_count: 1221,
+                key_as_string: '2020-07-05T01:00:00.000Z',
+                key: 1593910800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T06:00:00.000Z',
-                key: 1528956000000,
-                doc_count: 1198,
+                key_as_string: '2020-07-05T01:10:00.000Z',
+                key: 1593911400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T09:00:00.000Z',
-                key: 1528966800000,
-                doc_count: 1214,
+                key_as_string: '2020-07-05T01:20:00.000Z',
+                key: 1593912000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T12:00:00.000Z',
-                key: 1528977600000,
+                key_as_string: '2020-07-05T01:30:00.000Z',
+                key: 1593912600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
-            ],
-          },
-        },
-        {
-          key: 'HTTP 3xx',
-          doc_count: 6650,
-          timeseries: {
-            buckets: [
               {
-                key_as_string: '2018-06-04T12:00:00.000Z',
-                key: 1528113600000,
+                key_as_string: '2020-07-05T01:40:00.000Z',
+                key: 1593913200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T15:00:00.000Z',
-                key: 1528124400000,
+                key_as_string: '2020-07-05T01:50:00.000Z',
+                key: 1593913800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T18:00:00.000Z',
-                key: 1528135200000,
+                key_as_string: '2020-07-05T02:00:00.000Z',
+                key: 1593914400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-04T21:00:00.000Z',
-                key: 1528146000000,
+                key_as_string: '2020-07-05T02:10:00.000Z',
+                key: 1593915000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T00:00:00.000Z',
-                key: 1528156800000,
+                key_as_string: '2020-07-05T02:20:00.000Z',
+                key: 1593915600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T03:00:00.000Z',
-                key: 1528167600000,
+                key_as_string: '2020-07-05T02:30:00.000Z',
+                key: 1593916200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T06:00:00.000Z',
-                key: 1528178400000,
+                key_as_string: '2020-07-05T02:40:00.000Z',
+                key: 1593916800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T09:00:00.000Z',
-                key: 1528189200000,
+                key_as_string: '2020-07-05T02:50:00.000Z',
+                key: 1593917400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T12:00:00.000Z',
-                key: 1528200000000,
+                key_as_string: '2020-07-05T03:00:00.000Z',
+                key: 1593918000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T15:00:00.000Z',
-                key: 1528210800000,
+                key_as_string: '2020-07-05T03:10:00.000Z',
+                key: 1593918600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T18:00:00.000Z',
-                key: 1528221600000,
+                key_as_string: '2020-07-05T03:20:00.000Z',
+                key: 1593919200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-05T21:00:00.000Z',
-                key: 1528232400000,
+                key_as_string: '2020-07-05T03:30:00.000Z',
+                key: 1593919800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T00:00:00.000Z',
-                key: 1528243200000,
+                key_as_string: '2020-07-05T03:40:00.000Z',
+                key: 1593920400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T03:00:00.000Z',
-                key: 1528254000000,
+                key_as_string: '2020-07-05T03:50:00.000Z',
+                key: 1593921000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T06:00:00.000Z',
-                key: 1528264800000,
+                key_as_string: '2020-07-05T04:00:00.000Z',
+                key: 1593921600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T09:00:00.000Z',
-                key: 1528275600000,
+                key_as_string: '2020-07-05T04:10:00.000Z',
+                key: 1593922200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T12:00:00.000Z',
-                key: 1528286400000,
-                doc_count: 4041,
+                key_as_string: '2020-07-05T04:20:00.000Z',
+                key: 1593922800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T15:00:00.000Z',
-                key: 1528297200000,
-                doc_count: 454,
+                key_as_string: '2020-07-05T04:30:00.000Z',
+                key: 1593923400000,
+                doc_count: 11,
+                count: {
+                  value: 11,
+                },
               },
               {
-                key_as_string: '2018-06-06T18:00:00.000Z',
-                key: 1528308000000,
+                key_as_string: '2020-07-05T04:40:00.000Z',
+                key: 1593924000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-06T21:00:00.000Z',
-                key: 1528318800000,
+                key_as_string: '2020-07-05T04:50:00.000Z',
+                key: 1593924600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T00:00:00.000Z',
-                key: 1528329600000,
+                key_as_string: '2020-07-05T05:00:00.000Z',
+                key: 1593925200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T03:00:00.000Z',
-                key: 1528340400000,
+                key_as_string: '2020-07-05T05:10:00.000Z',
+                key: 1593925800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T06:00:00.000Z',
-                key: 1528351200000,
+                key_as_string: '2020-07-05T05:20:00.000Z',
+                key: 1593926400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T09:00:00.000Z',
-                key: 1528362000000,
+                key_as_string: '2020-07-05T05:30:00.000Z',
+                key: 1593927000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T12:00:00.000Z',
-                key: 1528372800000,
+                key_as_string: '2020-07-05T05:40:00.000Z',
+                key: 1593927600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T15:00:00.000Z',
-                key: 1528383600000,
+                key_as_string: '2020-07-05T05:50:00.000Z',
+                key: 1593928200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T18:00:00.000Z',
-                key: 1528394400000,
+                key_as_string: '2020-07-05T06:00:00.000Z',
+                key: 1593928800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-07T21:00:00.000Z',
-                key: 1528405200000,
+                key_as_string: '2020-07-05T06:10:00.000Z',
+                key: 1593929400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:20:00.000Z',
+                key: 1593930000000,
+                doc_count: 28,
+                count: {
+                  value: 28,
+                },
               },
               {
-                key_as_string: '2018-06-08T00:00:00.000Z',
-                key: 1528416000000,
+                key_as_string: '2020-07-05T06:30:00.000Z',
+                key: 1593930600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T03:00:00.000Z',
-                key: 1528426800000,
+                key_as_string: '2020-07-05T06:40:00.000Z',
+                key: 1593931200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T06:00:00.000Z',
-                key: 1528437600000,
+                key_as_string: '2020-07-05T06:50:00.000Z',
+                key: 1593931800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:00:00.000Z',
+                key: 1593932400000,
+                doc_count: 2,
+                count: {
+                  value: 2,
+                },
               },
               {
-                key_as_string: '2018-06-08T09:00:00.000Z',
-                key: 1528448400000,
+                key_as_string: '2020-07-05T07:10:00.000Z',
+                key: 1593933000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T12:00:00.000Z',
-                key: 1528459200000,
+                key_as_string: '2020-07-05T07:20:00.000Z',
+                key: 1593933600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T15:00:00.000Z',
-                key: 1528470000000,
+                key_as_string: '2020-07-05T07:30:00.000Z',
+                key: 1593934200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T18:00:00.000Z',
-                key: 1528480800000,
+                key_as_string: '2020-07-05T07:40:00.000Z',
+                key: 1593934800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-08T21:00:00.000Z',
-                key: 1528491600000,
+                key_as_string: '2020-07-05T07:50:00.000Z',
+                key: 1593935400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T00:00:00.000Z',
-                key: 1528502400000,
+                key_as_string: '2020-07-05T08:00:00.000Z',
+                key: 1593936000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T03:00:00.000Z',
-                key: 1528513200000,
+                key_as_string: '2020-07-05T08:10:00.000Z',
+                key: 1593936600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:20:00.000Z',
+                key: 1593937200000,
+                doc_count: 63,
+                count: {
+                  value: 63,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:30:00.000Z',
+                key: 1593937800000,
+                doc_count: 50,
+                count: {
+                  value: 50,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:40:00.000Z',
+                key: 1593938400000,
+                doc_count: 82,
+                count: {
+                  value: 82,
+                },
               },
+            ],
+          },
+        },
+        {
+          key: 'HTTP 4xx',
+          doc_count: 683,
+          timeseries: {
+            buckets: [
               {
-                key_as_string: '2018-06-09T06:00:00.000Z',
-                key: 1528524000000,
+                key_as_string: '2020-07-04T08:40:00.000Z',
+                key: 1593852000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T09:00:00.000Z',
-                key: 1528534800000,
+                key_as_string: '2020-07-04T08:50:00.000Z',
+                key: 1593852600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T12:00:00.000Z',
-                key: 1528545600000,
+                key_as_string: '2020-07-04T09:00:00.000Z',
+                key: 1593853200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T15:00:00.000Z',
-                key: 1528556400000,
+                key_as_string: '2020-07-04T09:10:00.000Z',
+                key: 1593853800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T18:00:00.000Z',
-                key: 1528567200000,
+                key_as_string: '2020-07-04T09:20:00.000Z',
+                key: 1593854400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-09T21:00:00.000Z',
-                key: 1528578000000,
+                key_as_string: '2020-07-04T09:30:00.000Z',
+                key: 1593855000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T00:00:00.000Z',
-                key: 1528588800000,
+                key_as_string: '2020-07-04T09:40:00.000Z',
+                key: 1593855600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T03:00:00.000Z',
-                key: 1528599600000,
+                key_as_string: '2020-07-04T09:50:00.000Z',
+                key: 1593856200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T06:00:00.000Z',
-                key: 1528610400000,
+                key_as_string: '2020-07-04T10:00:00.000Z',
+                key: 1593856800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T09:00:00.000Z',
-                key: 1528621200000,
+                key_as_string: '2020-07-04T10:10:00.000Z',
+                key: 1593857400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T12:00:00.000Z',
-                key: 1528632000000,
+                key_as_string: '2020-07-04T10:20:00.000Z',
+                key: 1593858000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T15:00:00.000Z',
-                key: 1528642800000,
+                key_as_string: '2020-07-04T10:30:00.000Z',
+                key: 1593858600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T18:00:00.000Z',
-                key: 1528653600000,
+                key_as_string: '2020-07-04T10:40:00.000Z',
+                key: 1593859200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-10T21:00:00.000Z',
-                key: 1528664400000,
+                key_as_string: '2020-07-04T10:50:00.000Z',
+                key: 1593859800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T00:00:00.000Z',
-                key: 1528675200000,
+                key_as_string: '2020-07-04T11:00:00.000Z',
+                key: 1593860400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T03:00:00.000Z',
-                key: 1528686000000,
+                key_as_string: '2020-07-04T11:10:00.000Z',
+                key: 1593861000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T06:00:00.000Z',
-                key: 1528696800000,
+                key_as_string: '2020-07-04T11:20:00.000Z',
+                key: 1593861600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T09:00:00.000Z',
-                key: 1528707600000,
+                key_as_string: '2020-07-04T11:30:00.000Z',
+                key: 1593862200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T12:00:00.000Z',
-                key: 1528718400000,
+                key_as_string: '2020-07-04T11:40:00.000Z',
+                key: 1593862800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T15:00:00.000Z',
-                key: 1528729200000,
+                key_as_string: '2020-07-04T11:50:00.000Z',
+                key: 1593863400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T18:00:00.000Z',
-                key: 1528740000000,
+                key_as_string: '2020-07-04T12:00:00.000Z',
+                key: 1593864000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-11T21:00:00.000Z',
-                key: 1528750800000,
+                key_as_string: '2020-07-04T12:10:00.000Z',
+                key: 1593864600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T00:00:00.000Z',
-                key: 1528761600000,
+                key_as_string: '2020-07-04T12:20:00.000Z',
+                key: 1593865200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T03:00:00.000Z',
-                key: 1528772400000,
+                key_as_string: '2020-07-04T12:30:00.000Z',
+                key: 1593865800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T06:00:00.000Z',
-                key: 1528783200000,
+                key_as_string: '2020-07-04T12:40:00.000Z',
+                key: 1593866400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T09:00:00.000Z',
-                key: 1528794000000,
+                key_as_string: '2020-07-04T12:50:00.000Z',
+                key: 1593867000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T12:00:00.000Z',
-                key: 1528804800000,
+                key_as_string: '2020-07-04T13:00:00.000Z',
+                key: 1593867600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T15:00:00.000Z',
-                key: 1528815600000,
+                key_as_string: '2020-07-04T13:10:00.000Z',
+                key: 1593868200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T18:00:00.000Z',
-                key: 1528826400000,
+                key_as_string: '2020-07-04T13:20:00.000Z',
+                key: 1593868800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-12T21:00:00.000Z',
-                key: 1528837200000,
+                key_as_string: '2020-07-04T13:30:00.000Z',
+                key: 1593869400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T00:00:00.000Z',
-                key: 1528848000000,
+                key_as_string: '2020-07-04T13:40:00.000Z',
+                key: 1593870000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T03:00:00.000Z',
-                key: 1528858800000,
+                key_as_string: '2020-07-04T13:50:00.000Z',
+                key: 1593870600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T06:00:00.000Z',
-                key: 1528869600000,
+                key_as_string: '2020-07-04T14:00:00.000Z',
+                key: 1593871200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T09:00:00.000Z',
-                key: 1528880400000,
+                key_as_string: '2020-07-04T14:10:00.000Z',
+                key: 1593871800000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T12:00:00.000Z',
-                key: 1528891200000,
+                key_as_string: '2020-07-04T14:20:00.000Z',
+                key: 1593872400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T15:00:00.000Z',
-                key: 1528902000000,
+                key_as_string: '2020-07-04T14:30:00.000Z',
+                key: 1593873000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T18:00:00.000Z',
-                key: 1528912800000,
+                key_as_string: '2020-07-04T14:40:00.000Z',
+                key: 1593873600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-13T21:00:00.000Z',
-                key: 1528923600000,
+                key_as_string: '2020-07-04T14:50:00.000Z',
+                key: 1593874200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T00:00:00.000Z',
-                key: 1528934400000,
-                doc_count: 2155,
+                key_as_string: '2020-07-04T15:00:00.000Z',
+                key: 1593874800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T03:00:00.000Z',
-                key: 1528945200000,
+                key_as_string: '2020-07-04T15:10:00.000Z',
+                key: 1593875400000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T06:00:00.000Z',
-                key: 1528956000000,
+                key_as_string: '2020-07-04T15:20:00.000Z',
+                key: 1593876000000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T09:00:00.000Z',
-                key: 1528966800000,
+                key_as_string: '2020-07-04T15:30:00.000Z',
+                key: 1593876600000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
               {
-                key_as_string: '2018-06-14T12:00:00.000Z',
-                key: 1528977600000,
+                key_as_string: '2020-07-04T15:40:00.000Z',
+                key: 1593877200000,
                 doc_count: 0,
+                count: {
+                  value: 0,
+                },
               },
-            ],
-          },
-        },
-      ],
-    },
-    response_times: {
-      buckets: [
-        {
-          key_as_string: '2018-06-04T12:00:00.000Z',
-          key: 1528113600000,
-          doc_count: 18841,
-          pct: {
-            values: {
-              '95.0': 82172.85648714812,
-              '99.0': 293866.3866666665,
-            },
+              {
+                key_as_string: '2020-07-04T15:50:00.000Z',
+                key: 1593877800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:00:00.000Z',
+                key: 1593878400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:10:00.000Z',
+                key: 1593879000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:20:00.000Z',
+                key: 1593879600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:30:00.000Z',
+                key: 1593880200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:40:00.000Z',
+                key: 1593880800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:50:00.000Z',
+                key: 1593881400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:00:00.000Z',
+                key: 1593882000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:10:00.000Z',
+                key: 1593882600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:20:00.000Z',
+                key: 1593883200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:30:00.000Z',
+                key: 1593883800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:40:00.000Z',
+                key: 1593884400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:50:00.000Z',
+                key: 1593885000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:00:00.000Z',
+                key: 1593885600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:10:00.000Z',
+                key: 1593886200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:20:00.000Z',
+                key: 1593886800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:30:00.000Z',
+                key: 1593887400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:40:00.000Z',
+                key: 1593888000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:50:00.000Z',
+                key: 1593888600000,
+                doc_count: 11,
+                count: {
+                  value: 11,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:00:00.000Z',
+                key: 1593889200000,
+                doc_count: 31,
+                count: {
+                  value: 31,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:10:00.000Z',
+                key: 1593889800000,
+                doc_count: 19,
+                count: {
+                  value: 19,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:20:00.000Z',
+                key: 1593890400000,
+                doc_count: 23,
+                count: {
+                  value: 23,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:30:00.000Z',
+                key: 1593891000000,
+                doc_count: 26,
+                count: {
+                  value: 26,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:40:00.000Z',
+                key: 1593891600000,
+                doc_count: 27,
+                count: {
+                  value: 27,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:50:00.000Z',
+                key: 1593892200000,
+                doc_count: 27,
+                count: {
+                  value: 27,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:00:00.000Z',
+                key: 1593892800000,
+                doc_count: 30,
+                count: {
+                  value: 30,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:10:00.000Z',
+                key: 1593893400000,
+                doc_count: 28,
+                count: {
+                  value: 28,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:20:00.000Z',
+                key: 1593894000000,
+                doc_count: 33,
+                count: {
+                  value: 33,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:30:00.000Z',
+                key: 1593894600000,
+                doc_count: 23,
+                count: {
+                  value: 23,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:40:00.000Z',
+                key: 1593895200000,
+                doc_count: 35,
+                count: {
+                  value: 35,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:50:00.000Z',
+                key: 1593895800000,
+                doc_count: 26,
+                count: {
+                  value: 26,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:00:00.000Z',
+                key: 1593896400000,
+                doc_count: 35,
+                count: {
+                  value: 35,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:10:00.000Z',
+                key: 1593897000000,
+                doc_count: 25,
+                count: {
+                  value: 25,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:20:00.000Z',
+                key: 1593897600000,
+                doc_count: 26,
+                count: {
+                  value: 26,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:30:00.000Z',
+                key: 1593898200000,
+                doc_count: 25,
+                count: {
+                  value: 25,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:40:00.000Z',
+                key: 1593898800000,
+                doc_count: 17,
+                count: {
+                  value: 17,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:50:00.000Z',
+                key: 1593899400000,
+                doc_count: 19,
+                count: {
+                  value: 19,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:00:00.000Z',
+                key: 1593900000000,
+                doc_count: 28,
+                count: {
+                  value: 28,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:10:00.000Z',
+                key: 1593900600000,
+                doc_count: 24,
+                count: {
+                  value: 24,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:20:00.000Z',
+                key: 1593901200000,
+                doc_count: 30,
+                count: {
+                  value: 30,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:30:00.000Z',
+                key: 1593901800000,
+                doc_count: 6,
+                count: {
+                  value: 6,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:40:00.000Z',
+                key: 1593902400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:50:00.000Z',
+                key: 1593903000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:00:00.000Z',
+                key: 1593903600000,
+                doc_count: 2,
+                count: {
+                  value: 2,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:10:00.000Z',
+                key: 1593904200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:20:00.000Z',
+                key: 1593904800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:30:00.000Z',
+                key: 1593905400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:40:00.000Z',
+                key: 1593906000000,
+                doc_count: 4,
+                count: {
+                  value: 4,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:50:00.000Z',
+                key: 1593906600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:00:00.000Z',
+                key: 1593907200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:10:00.000Z',
+                key: 1593907800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:20:00.000Z',
+                key: 1593908400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:30:00.000Z',
+                key: 1593909000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:40:00.000Z',
+                key: 1593909600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:50:00.000Z',
+                key: 1593910200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:00:00.000Z',
+                key: 1593910800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:10:00.000Z',
+                key: 1593911400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:20:00.000Z',
+                key: 1593912000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:30:00.000Z',
+                key: 1593912600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:40:00.000Z',
+                key: 1593913200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:50:00.000Z',
+                key: 1593913800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:00:00.000Z',
+                key: 1593914400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:10:00.000Z',
+                key: 1593915000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:20:00.000Z',
+                key: 1593915600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:30:00.000Z',
+                key: 1593916200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:40:00.000Z',
+                key: 1593916800000,
+                doc_count: 3,
+                count: {
+                  value: 3,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:50:00.000Z',
+                key: 1593917400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:00:00.000Z',
+                key: 1593918000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:10:00.000Z',
+                key: 1593918600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:20:00.000Z',
+                key: 1593919200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:30:00.000Z',
+                key: 1593919800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:40:00.000Z',
+                key: 1593920400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:50:00.000Z',
+                key: 1593921000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:00:00.000Z',
+                key: 1593921600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:10:00.000Z',
+                key: 1593922200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:20:00.000Z',
+                key: 1593922800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:30:00.000Z',
+                key: 1593923400000,
+                doc_count: 2,
+                count: {
+                  value: 2,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:40:00.000Z',
+                key: 1593924000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:50:00.000Z',
+                key: 1593924600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:00:00.000Z',
+                key: 1593925200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:10:00.000Z',
+                key: 1593925800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:20:00.000Z',
+                key: 1593926400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:30:00.000Z',
+                key: 1593927000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:40:00.000Z',
+                key: 1593927600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:50:00.000Z',
+                key: 1593928200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:00:00.000Z',
+                key: 1593928800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:10:00.000Z',
+                key: 1593929400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:20:00.000Z',
+                key: 1593930000000,
+                doc_count: 3,
+                count: {
+                  value: 3,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:30:00.000Z',
+                key: 1593930600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:40:00.000Z',
+                key: 1593931200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:50:00.000Z',
+                key: 1593931800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:00:00.000Z',
+                key: 1593932400000,
+                doc_count: 2,
+                count: {
+                  value: 2,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:10:00.000Z',
+                key: 1593933000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:20:00.000Z',
+                key: 1593933600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:30:00.000Z',
+                key: 1593934200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:40:00.000Z',
+                key: 1593934800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:50:00.000Z',
+                key: 1593935400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:00:00.000Z',
+                key: 1593936000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:10:00.000Z',
+                key: 1593936600000,
+                doc_count: 15,
+                count: {
+                  value: 15,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:20:00.000Z',
+                key: 1593937200000,
+                doc_count: 29,
+                count: {
+                  value: 29,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:30:00.000Z',
+                key: 1593937800000,
+                doc_count: 31,
+                count: {
+                  value: 31,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:40:00.000Z',
+                key: 1593938400000,
+                doc_count: 18,
+                count: {
+                  value: 18,
+                },
+              },
+            ],
+          },
+        },
+        {
+          key: 'HTTP 5xx',
+          doc_count: 378,
+          timeseries: {
+            buckets: [
+              {
+                key_as_string: '2020-07-04T08:40:00.000Z',
+                key: 1593852000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T08:50:00.000Z',
+                key: 1593852600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T09:00:00.000Z',
+                key: 1593853200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T09:10:00.000Z',
+                key: 1593853800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T09:20:00.000Z',
+                key: 1593854400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T09:30:00.000Z',
+                key: 1593855000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T09:40:00.000Z',
+                key: 1593855600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T09:50:00.000Z',
+                key: 1593856200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T10:00:00.000Z',
+                key: 1593856800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T10:10:00.000Z',
+                key: 1593857400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T10:20:00.000Z',
+                key: 1593858000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T10:30:00.000Z',
+                key: 1593858600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T10:40:00.000Z',
+                key: 1593859200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T10:50:00.000Z',
+                key: 1593859800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T11:00:00.000Z',
+                key: 1593860400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T11:10:00.000Z',
+                key: 1593861000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T11:20:00.000Z',
+                key: 1593861600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T11:30:00.000Z',
+                key: 1593862200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T11:40:00.000Z',
+                key: 1593862800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T11:50:00.000Z',
+                key: 1593863400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T12:00:00.000Z',
+                key: 1593864000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T12:10:00.000Z',
+                key: 1593864600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T12:20:00.000Z',
+                key: 1593865200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T12:30:00.000Z',
+                key: 1593865800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T12:40:00.000Z',
+                key: 1593866400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T12:50:00.000Z',
+                key: 1593867000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T13:00:00.000Z',
+                key: 1593867600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T13:10:00.000Z',
+                key: 1593868200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T13:20:00.000Z',
+                key: 1593868800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T13:30:00.000Z',
+                key: 1593869400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T13:40:00.000Z',
+                key: 1593870000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T13:50:00.000Z',
+                key: 1593870600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T14:00:00.000Z',
+                key: 1593871200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T14:10:00.000Z',
+                key: 1593871800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T14:20:00.000Z',
+                key: 1593872400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T14:30:00.000Z',
+                key: 1593873000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T14:40:00.000Z',
+                key: 1593873600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T14:50:00.000Z',
+                key: 1593874200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T15:00:00.000Z',
+                key: 1593874800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T15:10:00.000Z',
+                key: 1593875400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T15:20:00.000Z',
+                key: 1593876000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T15:30:00.000Z',
+                key: 1593876600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T15:40:00.000Z',
+                key: 1593877200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T15:50:00.000Z',
+                key: 1593877800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:00:00.000Z',
+                key: 1593878400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:10:00.000Z',
+                key: 1593879000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:20:00.000Z',
+                key: 1593879600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:30:00.000Z',
+                key: 1593880200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:40:00.000Z',
+                key: 1593880800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T16:50:00.000Z',
+                key: 1593881400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:00:00.000Z',
+                key: 1593882000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:10:00.000Z',
+                key: 1593882600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:20:00.000Z',
+                key: 1593883200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:30:00.000Z',
+                key: 1593883800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:40:00.000Z',
+                key: 1593884400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T17:50:00.000Z',
+                key: 1593885000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:00:00.000Z',
+                key: 1593885600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:10:00.000Z',
+                key: 1593886200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:20:00.000Z',
+                key: 1593886800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:30:00.000Z',
+                key: 1593887400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:40:00.000Z',
+                key: 1593888000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T18:50:00.000Z',
+                key: 1593888600000,
+                doc_count: 5,
+                count: {
+                  value: 5,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:00:00.000Z',
+                key: 1593889200000,
+                doc_count: 15,
+                count: {
+                  value: 15,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:10:00.000Z',
+                key: 1593889800000,
+                doc_count: 12,
+                count: {
+                  value: 12,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:20:00.000Z',
+                key: 1593890400000,
+                doc_count: 16,
+                count: {
+                  value: 16,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:30:00.000Z',
+                key: 1593891000000,
+                doc_count: 12,
+                count: {
+                  value: 12,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:40:00.000Z',
+                key: 1593891600000,
+                doc_count: 16,
+                count: {
+                  value: 16,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T19:50:00.000Z',
+                key: 1593892200000,
+                doc_count: 23,
+                count: {
+                  value: 23,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:00:00.000Z',
+                key: 1593892800000,
+                doc_count: 10,
+                count: {
+                  value: 10,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:10:00.000Z',
+                key: 1593893400000,
+                doc_count: 10,
+                count: {
+                  value: 10,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:20:00.000Z',
+                key: 1593894000000,
+                doc_count: 18,
+                count: {
+                  value: 18,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:30:00.000Z',
+                key: 1593894600000,
+                doc_count: 10,
+                count: {
+                  value: 10,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:40:00.000Z',
+                key: 1593895200000,
+                doc_count: 17,
+                count: {
+                  value: 17,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T20:50:00.000Z',
+                key: 1593895800000,
+                doc_count: 13,
+                count: {
+                  value: 13,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:00:00.000Z',
+                key: 1593896400000,
+                doc_count: 18,
+                count: {
+                  value: 18,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:10:00.000Z',
+                key: 1593897000000,
+                doc_count: 17,
+                count: {
+                  value: 17,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:20:00.000Z',
+                key: 1593897600000,
+                doc_count: 17,
+                count: {
+                  value: 17,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:30:00.000Z',
+                key: 1593898200000,
+                doc_count: 11,
+                count: {
+                  value: 11,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:40:00.000Z',
+                key: 1593898800000,
+                doc_count: 10,
+                count: {
+                  value: 10,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T21:50:00.000Z',
+                key: 1593899400000,
+                doc_count: 18,
+                count: {
+                  value: 18,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:00:00.000Z',
+                key: 1593900000000,
+                doc_count: 16,
+                count: {
+                  value: 16,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:10:00.000Z',
+                key: 1593900600000,
+                doc_count: 12,
+                count: {
+                  value: 12,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:20:00.000Z',
+                key: 1593901200000,
+                doc_count: 18,
+                count: {
+                  value: 18,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:30:00.000Z',
+                key: 1593901800000,
+                doc_count: 8,
+                count: {
+                  value: 8,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:40:00.000Z',
+                key: 1593902400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T22:50:00.000Z',
+                key: 1593903000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:00:00.000Z',
+                key: 1593903600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:10:00.000Z',
+                key: 1593904200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:20:00.000Z',
+                key: 1593904800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:30:00.000Z',
+                key: 1593905400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:40:00.000Z',
+                key: 1593906000000,
+                doc_count: 1,
+                count: {
+                  value: 1,
+                },
+              },
+              {
+                key_as_string: '2020-07-04T23:50:00.000Z',
+                key: 1593906600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:00:00.000Z',
+                key: 1593907200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:10:00.000Z',
+                key: 1593907800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:20:00.000Z',
+                key: 1593908400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:30:00.000Z',
+                key: 1593909000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:40:00.000Z',
+                key: 1593909600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T00:50:00.000Z',
+                key: 1593910200000,
+                doc_count: 3,
+                count: {
+                  value: 3,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:00:00.000Z',
+                key: 1593910800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:10:00.000Z',
+                key: 1593911400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:20:00.000Z',
+                key: 1593912000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:30:00.000Z',
+                key: 1593912600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:40:00.000Z',
+                key: 1593913200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T01:50:00.000Z',
+                key: 1593913800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:00:00.000Z',
+                key: 1593914400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:10:00.000Z',
+                key: 1593915000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:20:00.000Z',
+                key: 1593915600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:30:00.000Z',
+                key: 1593916200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:40:00.000Z',
+                key: 1593916800000,
+                doc_count: 3,
+                count: {
+                  value: 3,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T02:50:00.000Z',
+                key: 1593917400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:00:00.000Z',
+                key: 1593918000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:10:00.000Z',
+                key: 1593918600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:20:00.000Z',
+                key: 1593919200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:30:00.000Z',
+                key: 1593919800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:40:00.000Z',
+                key: 1593920400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T03:50:00.000Z',
+                key: 1593921000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:00:00.000Z',
+                key: 1593921600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:10:00.000Z',
+                key: 1593922200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:20:00.000Z',
+                key: 1593922800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:30:00.000Z',
+                key: 1593923400000,
+                doc_count: 2,
+                count: {
+                  value: 2,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:40:00.000Z',
+                key: 1593924000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T04:50:00.000Z',
+                key: 1593924600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:00:00.000Z',
+                key: 1593925200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:10:00.000Z',
+                key: 1593925800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:20:00.000Z',
+                key: 1593926400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:30:00.000Z',
+                key: 1593927000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:40:00.000Z',
+                key: 1593927600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T05:50:00.000Z',
+                key: 1593928200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:00:00.000Z',
+                key: 1593928800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:10:00.000Z',
+                key: 1593929400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:20:00.000Z',
+                key: 1593930000000,
+                doc_count: 2,
+                count: {
+                  value: 2,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:30:00.000Z',
+                key: 1593930600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:40:00.000Z',
+                key: 1593931200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T06:50:00.000Z',
+                key: 1593931800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:00:00.000Z',
+                key: 1593932400000,
+                doc_count: 1,
+                count: {
+                  value: 1,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:10:00.000Z',
+                key: 1593933000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:20:00.000Z',
+                key: 1593933600000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:30:00.000Z',
+                key: 1593934200000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:40:00.000Z',
+                key: 1593934800000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T07:50:00.000Z',
+                key: 1593935400000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:00:00.000Z',
+                key: 1593936000000,
+                doc_count: 0,
+                count: {
+                  value: 0,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:10:00.000Z',
+                key: 1593936600000,
+                doc_count: 6,
+                count: {
+                  value: 6,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:20:00.000Z',
+                key: 1593937200000,
+                doc_count: 17,
+                count: {
+                  value: 17,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:30:00.000Z',
+                key: 1593937800000,
+                doc_count: 16,
+                count: {
+                  value: 16,
+                },
+              },
+              {
+                key_as_string: '2020-07-05T08:40:00.000Z',
+                key: 1593938400000,
+                doc_count: 5,
+                count: {
+                  value: 5,
+                },
+              },
+            ],
+          },
+        },
+      ],
+    },
+    response_times: {
+      buckets: [
+        {
+          key_as_string: '2020-07-04T08:40:00.000Z',
+          key: 1593852000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T08:50:00.000Z',
+          key: 1593852600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T09:00:00.000Z',
+          key: 1593853200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T09:10:00.000Z',
+          key: 1593853800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T09:20:00.000Z',
+          key: 1593854400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T09:30:00.000Z',
+          key: 1593855000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T09:40:00.000Z',
+          key: 1593855600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T09:50:00.000Z',
+          key: 1593856200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T10:00:00.000Z',
+          key: 1593856800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T10:10:00.000Z',
+          key: 1593857400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T10:20:00.000Z',
+          key: 1593858000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T10:30:00.000Z',
+          key: 1593858600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T10:40:00.000Z',
+          key: 1593859200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T10:50:00.000Z',
+          key: 1593859800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T11:00:00.000Z',
+          key: 1593860400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T11:10:00.000Z',
+          key: 1593861000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T11:20:00.000Z',
+          key: 1593861600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T11:30:00.000Z',
+          key: 1593862200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T11:40:00.000Z',
+          key: 1593862800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T11:50:00.000Z',
+          key: 1593863400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T12:00:00.000Z',
+          key: 1593864000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T12:10:00.000Z',
+          key: 1593864600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T12:20:00.000Z',
+          key: 1593865200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T12:30:00.000Z',
+          key: 1593865800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T12:40:00.000Z',
+          key: 1593866400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T12:50:00.000Z',
+          key: 1593867000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T13:00:00.000Z',
+          key: 1593867600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T13:10:00.000Z',
+          key: 1593868200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T13:20:00.000Z',
+          key: 1593868800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T13:30:00.000Z',
+          key: 1593869400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T13:40:00.000Z',
+          key: 1593870000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T13:50:00.000Z',
+          key: 1593870600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T14:00:00.000Z',
+          key: 1593871200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T14:10:00.000Z',
+          key: 1593871800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T14:20:00.000Z',
+          key: 1593872400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T14:30:00.000Z',
+          key: 1593873000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T14:40:00.000Z',
+          key: 1593873600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T14:50:00.000Z',
+          key: 1593874200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T15:00:00.000Z',
+          key: 1593874800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T15:10:00.000Z',
+          key: 1593875400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T15:20:00.000Z',
+          key: 1593876000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T15:30:00.000Z',
+          key: 1593876600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T15:40:00.000Z',
+          key: 1593877200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T15:50:00.000Z',
+          key: 1593877800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T16:00:00.000Z',
+          key: 1593878400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T16:10:00.000Z',
+          key: 1593879000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T16:20:00.000Z',
+          key: 1593879600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T16:30:00.000Z',
+          key: 1593880200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T16:40:00.000Z',
+          key: 1593880800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T16:50:00.000Z',
+          key: 1593881400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T17:00:00.000Z',
+          key: 1593882000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T17:10:00.000Z',
+          key: 1593882600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T17:20:00.000Z',
+          key: 1593883200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T17:30:00.000Z',
+          key: 1593883800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T17:40:00.000Z',
+          key: 1593884400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T17:50:00.000Z',
+          key: 1593885000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T18:00:00.000Z',
+          key: 1593885600000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T18:10:00.000Z',
+          key: 1593886200000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T18:20:00.000Z',
+          key: 1593886800000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T18:30:00.000Z',
+          key: 1593887400000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
+          },
+          avg: {
+            value: null,
+          },
+        },
+        {
+          key_as_string: '2020-07-04T18:40:00.000Z',
+          key: 1593888000000,
+          doc_count: 0,
+          pct: {
+            values: {
+              '95.0': null,
+              '99.0': null,
+            },
           },
           avg: {
-            value: 26310.63483891513,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-04T15:00:00.000Z',
-          key: 1528124400000,
-          doc_count: 18708,
+          key_as_string: '2020-07-04T18:50:00.000Z',
+          key: 1593888600000,
+          doc_count: 247,
           pct: {
             values: {
-              '95.0': 80738.78571428556,
-              '99.0': 293257.27333333343,
+              '95.0': 114680.0,
+              '99.0': 827384.0,
             },
           },
           avg: {
-            value: 26193.277795595466,
+            value: 43364.46153846154,
           },
         },
         {
-          key_as_string: '2018-06-04T18:00:00.000Z',
-          key: 1528135200000,
-          doc_count: 18865,
+          key_as_string: '2020-07-04T19:00:00.000Z',
+          key: 1593889200000,
+          doc_count: 542,
           pct: {
             values: {
-              '95.0': 77058.03529411761,
-              '99.0': 290195.8800000004,
+              '95.0': 659448.0,
+              '99.0': 2326520.0,
             },
           },
           avg: {
-            value: 25291.787065995228,
+            value: 147903.58671586716,
           },
         },
         {
-          key_as_string: '2018-06-04T21:00:00.000Z',
-          key: 1528146000000,
-          doc_count: 18889,
+          key_as_string: '2020-07-04T19:10:00.000Z',
+          key: 1593889800000,
+          doc_count: 619,
           pct: {
             values: {
-              '95.0': 77892.20721980717,
-              '99.0': 278548.1649999994,
+              '95.0': 122360.0,
+              '99.0': 1130488.0,
             },
           },
           avg: {
-            value: 24690.306474667796,
+            value: 57370.52342487884,
           },
         },
         {
-          key_as_string: '2018-06-05T00:00:00.000Z',
-          key: 1528156800000,
-          doc_count: 19270,
+          key_as_string: '2020-07-04T19:20:00.000Z',
+          key: 1593890400000,
+          doc_count: 688,
           pct: {
             values: {
-              '95.0': 77085.86687499998,
-              '99.0': 290701.8973333341,
+              '95.0': 121336.0,
+              '99.0': 1032184.0,
             },
           },
           avg: {
-            value: 24809.8953814219,
+            value: 59687.82558139535,
           },
         },
         {
-          key_as_string: '2018-06-05T03:00:00.000Z',
-          key: 1528167600000,
-          doc_count: 19024,
+          key_as_string: '2020-07-04T19:30:00.000Z',
+          key: 1593891000000,
+          doc_count: 646,
           pct: {
             values: {
-              '95.0': 80048.3462981744,
-              '99.0': 286839.5897777779,
+              '95.0': 120828.0,
+              '99.0': 770044.0,
             },
           },
           avg: {
-            value: 25460.0394764508,
+            value: 51810.68111455108,
           },
         },
         {
-          key_as_string: '2018-06-05T06:00:00.000Z',
-          key: 1528178400000,
-          doc_count: 18923,
+          key_as_string: '2020-07-04T19:40:00.000Z',
+          key: 1593891600000,
+          doc_count: 621,
           pct: {
             values: {
-              '95.0': 84089.21370223971,
-              '99.0': 287979.5149999999,
+              '95.0': 139256.0,
+              '99.0': 651256.0,
             },
           },
           avg: {
-            value: 26360.440733498916,
+            value: 51736.59420289855,
           },
         },
         {
-          key_as_string: '2018-06-05T09:00:00.000Z',
-          key: 1528189200000,
-          doc_count: 18834,
+          key_as_string: '2020-07-04T19:50:00.000Z',
+          key: 1593892200000,
+          doc_count: 856,
           pct: {
             values: {
-              '95.0': 84880.90143416924,
-              '99.0': 300107.5009999992,
+              '95.0': 76792.0,
+              '99.0': 667640.0,
             },
           },
           avg: {
-            value: 27050.95205479452,
+            value: 37241.293224299065,
           },
         },
         {
-          key_as_string: '2018-06-05T12:00:00.000Z',
-          key: 1528200000000,
-          doc_count: 18694,
+          key_as_string: '2020-07-04T20:00:00.000Z',
+          key: 1593892800000,
+          doc_count: 661,
           pct: {
             values: {
-              '95.0': 84554.8884781166,
-              '99.0': 294402.2179999999,
+              '95.0': 129528.0,
+              '99.0': 708600.0,
             },
           },
           avg: {
-            value: 26555.857333903925,
+            value: 49444.90771558245,
           },
         },
         {
-          key_as_string: '2018-06-05T15:00:00.000Z',
-          key: 1528210800000,
-          doc_count: 19184,
+          key_as_string: '2020-07-04T20:10:00.000Z',
+          key: 1593893400000,
+          doc_count: 646,
           pct: {
             values: {
-              '95.0': 81839.39583333326,
-              '99.0': 289849.459333332,
+              '95.0': 378872.0,
+              '99.0': 815096.0,
             },
           },
           avg: {
-            value: 26164.343359049206,
+            value: 56807.80495356037,
           },
         },
         {
-          key_as_string: '2018-06-05T18:00:00.000Z',
-          key: 1528221600000,
-          doc_count: 18850,
+          key_as_string: '2020-07-04T20:20:00.000Z',
+          key: 1593894000000,
+          doc_count: 781,
           pct: {
             values: {
-              '95.0': 85993.55410163336,
-              '99.0': 296942.86299999955,
+              '95.0': 97272.0,
+              '99.0': 688120.0,
             },
           },
           avg: {
-            value: 26989.84546419098,
+            value: 43238.74519846351,
           },
         },
         {
-          key_as_string: '2018-06-05T21:00:00.000Z',
-          key: 1528232400000,
-          doc_count: 18897,
+          key_as_string: '2020-07-04T20:30:00.000Z',
+          key: 1593894600000,
+          doc_count: 670,
           pct: {
             values: {
-              '95.0': 85001.44588628765,
-              '99.0': 292048.20571428596,
+              '95.0': 102904.0,
+              '99.0': 978936.0,
             },
           },
           avg: {
-            value: 26314.409430068266,
+            value: 51754.80149253731,
           },
         },
         {
-          key_as_string: '2018-06-06T00:00:00.000Z',
-          key: 1528243200000,
-          doc_count: 18942,
+          key_as_string: '2020-07-04T20:40:00.000Z',
+          key: 1593895200000,
+          doc_count: 617,
           pct: {
             values: {
-              '95.0': 86980.16445312503,
-              '99.0': 299308.7371666667,
+              '95.0': 100856.0,
+              '99.0': 839672.0,
             },
           },
           avg: {
-            value: 27460.774575018477,
+            value: 47166.5964343598,
           },
         },
         {
-          key_as_string: '2018-06-06T03:00:00.000Z',
-          key: 1528254000000,
-          doc_count: 19147,
+          key_as_string: '2020-07-04T20:50:00.000Z',
+          key: 1593895800000,
+          doc_count: 690,
           pct: {
             values: {
-              '95.0': 84961.8710743802,
-              '99.0': 292151.2377777781,
+              '95.0': 97784.0,
+              '99.0': 757752.0,
             },
           },
           avg: {
-            value: 26461.469107431974,
+            value: 41854.688405797104,
           },
         },
         {
-          key_as_string: '2018-06-06T06:00:00.000Z',
-          key: 1528264800000,
-          doc_count: 18853,
+          key_as_string: '2020-07-04T21:00:00.000Z',
+          key: 1593896400000,
+          doc_count: 843,
           pct: {
             values: {
-              '95.0': 88906.54601889332,
-              '99.0': 302274.4192592592,
+              '95.0': 72700.0,
+              '99.0': 577532.0,
             },
           },
           avg: {
-            value: 27657.584946692834,
+            value: 30464.317912218266,
           },
         },
         {
-          key_as_string: '2018-06-06T09:00:00.000Z',
-          key: 1528275600000,
-          doc_count: 18609,
+          key_as_string: '2020-07-04T21:10:00.000Z',
+          key: 1593897000000,
+          doc_count: 717,
           pct: {
             values: {
-              '95.0': 90198.34708994703,
-              '99.0': 299457.1612121209,
+              '95.0': 98296.0,
+              '99.0': 618488.0,
             },
           },
           avg: {
-            value: 27940.445967005213,
+            value: 41558.531380753135,
           },
         },
         {
-          key_as_string: '2018-06-06T12:00:00.000Z',
-          key: 1528286400000,
-          doc_count: 21402,
+          key_as_string: '2020-07-04T21:20:00.000Z',
+          key: 1593897600000,
+          doc_count: 695,
           pct: {
             values: {
-              '95.0': 135627.71242424246,
-              '99.0': 350398.59259259375,
+              '95.0': 112120.0,
+              '99.0': 565240.0,
             },
           },
           avg: {
-            value: 34454.377581534434,
+            value: 41159.68345323741,
           },
         },
         {
-          key_as_string: '2018-06-06T15:00:00.000Z',
-          key: 1528297200000,
-          doc_count: 19051,
+          key_as_string: '2020-07-04T21:30:00.000Z',
+          key: 1593898200000,
+          doc_count: 731,
           pct: {
             values: {
-              '95.0': 167037.1993837535,
-              '99.0': 421204.23333333334,
+              '95.0': 91640.0,
+              '99.0': 618488.0,
             },
           },
           avg: {
-            value: 44024.31809353839,
+            value: 34211.03967168263,
           },
         },
         {
-          key_as_string: '2018-06-06T18:00:00.000Z',
-          key: 1528308000000,
-          doc_count: 19020,
+          key_as_string: '2020-07-04T21:40:00.000Z',
+          key: 1593898800000,
+          doc_count: 676,
           pct: {
             values: {
-              '95.0': 128293.12184873945,
-              '99.0': 368166.68976190523,
+              '95.0': 83448.0,
+              '99.0': 655352.0,
             },
           },
           avg: {
-            value: 36374.53333333333,
+            value: 41322.30621301775,
           },
         },
         {
-          key_as_string: '2018-06-06T21:00:00.000Z',
-          key: 1528318800000,
-          doc_count: 18582,
+          key_as_string: '2020-07-04T21:50:00.000Z',
+          key: 1593899400000,
+          doc_count: 699,
           pct: {
             values: {
-              '95.0': 130653.54236263742,
-              '99.0': 367193.6128571426,
+              '95.0': 84476.0,
+              '99.0': 843772.0,
             },
           },
           avg: {
-            value: 36991.29442471209,
+            value: 42301.523605150214,
           },
         },
         {
-          key_as_string: '2018-06-07T00:00:00.000Z',
-          key: 1528329600000,
-          doc_count: 18875,
+          key_as_string: '2020-07-04T22:00:00.000Z',
+          key: 1593900000000,
+          doc_count: 685,
           pct: {
             values: {
-              '95.0': 131630.8902645502,
-              '99.0': 375658.10190476174,
+              '95.0': 117756.0,
+              '99.0': 831484.0,
             },
           },
           avg: {
-            value: 37178.002701986756,
+            value: 59615.69343065693,
           },
         },
         {
-          key_as_string: '2018-06-07T03:00:00.000Z',
-          key: 1528340400000,
-          doc_count: 18993,
+          key_as_string: '2020-07-04T22:10:00.000Z',
+          key: 1593900600000,
+          doc_count: 798,
           pct: {
             values: {
-              '95.0': 133581.33541666638,
-              '99.0': 368152.03822222137,
+              '95.0': 66556.0,
+              '99.0': 430076.0,
             },
           },
           avg: {
-            value: 37605.57078923814,
+            value: 29567.520050125313,
           },
         },
         {
-          key_as_string: '2018-06-07T06:00:00.000Z',
-          key: 1528351200000,
-          doc_count: 19037,
+          key_as_string: '2020-07-04T22:20:00.000Z',
+          key: 1593901200000,
+          doc_count: 640,
           pct: {
             values: {
-              '95.0': 132697.92762266204,
-              '99.0': 365705.8319999995,
+              '95.0': 130552.0,
+              '99.0': 864248.0,
             },
           },
           avg: {
-            value: 37319.89767295267,
+            value: 56104.7484375,
           },
         },
         {
-          key_as_string: '2018-06-07T09:00:00.000Z',
-          key: 1528362000000,
-          doc_count: 18985,
+          key_as_string: '2020-07-04T22:30:00.000Z',
+          key: 1593901800000,
+          doc_count: 241,
           pct: {
             values: {
-              '95.0': 140003.6918918918,
-              '99.0': 380075.48533333326,
+              '95.0': 111608.0,
+              '99.0': 655352.0,
             },
           },
           avg: {
-            value: 38709.5041348433,
+            value: 40900.70954356847,
           },
         },
         {
-          key_as_string: '2018-06-07T12:00:00.000Z',
-          key: 1528372800000,
-          doc_count: 18505,
+          key_as_string: '2020-07-04T22:40:00.000Z',
+          key: 1593902400000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 138149.5673529411,
-              '99.0': 375697.1923809518,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 38140.131856255066,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-07T15:00:00.000Z',
-          key: 1528383600000,
-          doc_count: 18991,
+          key_as_string: '2020-07-04T22:50:00.000Z',
+          key: 1593903000000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 121872.37504835591,
-              '99.0': 351080.94111111073,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 34564.81091043125,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-07T18:00:00.000Z',
-          key: 1528394400000,
-          doc_count: 18917,
+          key_as_string: '2020-07-04T23:00:00.000Z',
+          key: 1593903600000,
+          doc_count: 50,
           pct: {
             values: {
-              '95.0': 116378.03873517792,
-              '99.0': 339294.12799999997,
+              '95.0': 276448.0,
+              '99.0': 2883552.0,
             },
           },
           avg: {
-            value: 33256.37743828302,
+            value: 141618.04,
           },
         },
         {
-          key_as_string: '2018-06-07T21:00:00.000Z',
-          key: 1528405200000,
-          doc_count: 18744,
+          key_as_string: '2020-07-04T23:10:00.000Z',
+          key: 1593904200000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 131545.40999999995,
-              '99.0': 378902.90649999987,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 37251.5625266752,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-08T00:00:00.000Z',
-          key: 1528416000000,
-          doc_count: 19157,
+          key_as_string: '2020-07-04T23:20:00.000Z',
+          key: 1593904800000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 133111.25804878055,
-              '99.0': 384483.3233333327,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 38681.89084929791,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-08T03:00:00.000Z',
-          key: 1528426800000,
-          doc_count: 18552,
+          key_as_string: '2020-07-04T23:30:00.000Z',
+          key: 1593905400000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 144821.9855278593,
-              '99.0': 394692.25000000105,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 40677.801045709355,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-08T06:00:00.000Z',
-          key: 1528437600000,
-          doc_count: 18994,
+          key_as_string: '2020-07-04T23:40:00.000Z',
+          key: 1593906000000,
+          doc_count: 41,
           pct: {
             values: {
-              '95.0': 134737.3997727272,
-              '99.0': 403362.50399999996,
+              '95.0': 1028088.0,
+              '99.0': 6094840.0,
             },
           },
           avg: {
-            value: 39987.86453616932,
+            value: 380742.48780487804,
           },
         },
         {
-          key_as_string: '2018-06-08T09:00:00.000Z',
-          key: 1528448400000,
-          doc_count: 18798,
+          key_as_string: '2020-07-04T23:50:00.000Z',
+          key: 1593906600000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 141206.57726666646,
-              '99.0': 396559.0274999993,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 41059.392914139804,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-08T12:00:00.000Z',
-          key: 1528459200000,
-          doc_count: 19097,
+          key_as_string: '2020-07-05T00:00:00.000Z',
+          key: 1593907200000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 137731.8994082841,
-              '99.0': 371815.8320000008,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 39630.710111535845,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-08T15:00:00.000Z',
-          key: 1528470000000,
-          doc_count: 18887,
+          key_as_string: '2020-07-05T00:10:00.000Z',
+          key: 1593907800000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 141476.23189033198,
-              '99.0': 405477.6133333326,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 41561.81331074284,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-08T18:00:00.000Z',
-          key: 1528480800000,
-          doc_count: 18949,
+          key_as_string: '2020-07-05T00:20:00.000Z',
+          key: 1593908400000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 149636.31340909077,
-              '99.0': 413542.18133333366,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 43079.490738297536,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-08T21:00:00.000Z',
-          key: 1528491600000,
-          doc_count: 18786,
+          key_as_string: '2020-07-05T00:30:00.000Z',
+          key: 1593909000000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 151934.55000000002,
-              '99.0': 424399.340000001,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 43925.39609283509,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-09T00:00:00.000Z',
-          key: 1528502400000,
-          doc_count: 5096,
+          key_as_string: '2020-07-05T00:40:00.000Z',
+          key: 1593909600000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 82198.17857142858,
-              '99.0': 303815.9000000001,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 25821.91424646782,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-09T03:00:00.000Z',
-          key: 1528513200000,
-          doc_count: 5104,
+          key_as_string: '2020-07-05T00:50:00.000Z',
+          key: 1593910200000,
+          doc_count: 37,
           pct: {
             values: {
-              '95.0': 85946.43199999983,
-              '99.0': 306305.0800000006,
+              '95.0': 352128.0,
+              '99.0': 446336.0,
             },
           },
           avg: {
-            value: 27343.60011755486,
+            value: 122524.7027027027,
           },
         },
         {
-          key_as_string: '2018-06-09T06:00:00.000Z',
-          key: 1528524000000,
-          doc_count: 5122,
+          key_as_string: '2020-07-05T01:00:00.000Z',
+          key: 1593910800000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 78617.66249999996,
-              '99.0': 297521.94999999984,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 25249.95060523233,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-09T09:00:00.000Z',
-          key: 1528534800000,
-          doc_count: 5184,
+          key_as_string: '2020-07-05T01:10:00.000Z',
+          key: 1593911400000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 79606.48333333322,
-              '99.0': 317938.0900000003,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 25492.77199074074,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-09T12:00:00.000Z',
-          key: 1528545600000,
-          doc_count: 5279,
+          key_as_string: '2020-07-05T01:20:00.000Z',
+          key: 1593912000000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 76297.93999999986,
-              '99.0': 312262.3000000003,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 25991.647281682137,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-09T15:00:00.000Z',
-          key: 1528556400000,
-          doc_count: 5254,
+          key_as_string: '2020-07-05T01:30:00.000Z',
+          key: 1593912600000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 80742.63333333324,
-              '99.0': 318428.8700000002,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 26273.31290445375,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-09T18:00:00.000Z',
-          key: 1528567200000,
-          doc_count: 5082,
+          key_as_string: '2020-07-05T01:40:00.000Z',
+          key: 1593913200000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 81291.45969696966,
-              '99.0': 295421.4099999999,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 26234.98976780795,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-09T21:00:00.000Z',
-          key: 1528578000000,
-          doc_count: 5150,
+          key_as_string: '2020-07-05T01:50:00.000Z',
+          key: 1593913800000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 73467.02500000004,
-              '99.0': 293067.86000000004,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 23494.54873786408,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-10T00:00:00.000Z',
-          key: 1528588800000,
-          doc_count: 5103,
+          key_as_string: '2020-07-05T02:00:00.000Z',
+          key: 1593914400000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 69177.66999999993,
-              '99.0': 264935.71999999933,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 22008.80482069371,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-10T03:00:00.000Z',
-          key: 1528599600000,
-          doc_count: 5137,
+          key_as_string: '2020-07-05T02:10:00.000Z',
+          key: 1593915000000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 71956.06111111109,
-              '99.0': 282795.0400000003,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 22828.136655635586,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-10T06:00:00.000Z',
-          key: 1528610400000,
-          doc_count: 5184,
+          key_as_string: '2020-07-05T02:20:00.000Z',
+          key: 1593915600000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 68480.91142857139,
-              '99.0': 285390.8400000001,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 22138.7081404321,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-10T09:00:00.000Z',
-          key: 1528621200000,
-          doc_count: 4993,
+          key_as_string: '2020-07-05T02:30:00.000Z',
+          key: 1593916200000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 68957.0999999999,
-              '99.0': 290402.24,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 22634.985579811735,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-10T12:00:00.000Z',
-          key: 1528632000000,
-          doc_count: 5210,
+          key_as_string: '2020-07-05T02:40:00.000Z',
+          key: 1593916800000,
+          doc_count: 37,
           pct: {
             values: {
-              '95.0': 67489.50416666668,
-              '99.0': 293655.53,
+              '95.0': 348144.0,
+              '99.0': 3293168.0,
             },
           },
           avg: {
-            value: 22202.780998080616,
+            value: 160060.1081081081,
           },
         },
         {
-          key_as_string: '2018-06-10T15:00:00.000Z',
-          key: 1528642800000,
-          doc_count: 5122,
+          key_as_string: '2020-07-05T02:50:00.000Z',
+          key: 1593917400000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 71556.91249999998,
-              '99.0': 292723.56999999995,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 23084.082780163997,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-10T18:00:00.000Z',
-          key: 1528653600000,
-          doc_count: 5125,
+          key_as_string: '2020-07-05T03:00:00.000Z',
+          key: 1593918000000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 72157.65128205132,
-              '99.0': 301051.32000000105,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 23109.666146341464,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-10T21:00:00.000Z',
-          key: 1528664400000,
-          doc_count: 5186,
+          key_as_string: '2020-07-05T03:10:00.000Z',
+          key: 1593918600000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 76124.5625,
-              '99.0': 291322.0499999998,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 23306.89028152719,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-11T00:00:00.000Z',
-          key: 1528675200000,
-          doc_count: 18631,
+          key_as_string: '2020-07-05T03:20:00.000Z',
+          key: 1593919200000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 141709.34661835746,
-              '99.0': 379855.2444444447,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 39341.022704095325,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-11T03:00:00.000Z',
-          key: 1528686000000,
-          doc_count: 19349,
+          key_as_string: '2020-07-05T03:30:00.000Z',
+          key: 1593919800000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 132371.48641975303,
-              '99.0': 371175.2592000001,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 37467.17153341258,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-11T06:00:00.000Z',
-          key: 1528696800000,
-          doc_count: 18586,
+          key_as_string: '2020-07-05T03:40:00.000Z',
+          key: 1593920400000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 186783.51503759398,
-              '99.0': 498378.4238888898,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 52457.50554180566,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-11T09:00:00.000Z',
-          key: 1528707600000,
-          doc_count: 18887,
+          key_as_string: '2020-07-05T03:50:00.000Z',
+          key: 1593921000000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 99540.17819499348,
-              '99.0': 331118.6599999997,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 31327.95780166252,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-11T12:00:00.000Z',
-          key: 1528718400000,
-          doc_count: 18866,
+          key_as_string: '2020-07-05T04:00:00.000Z',
+          key: 1593921600000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 95982.62454212455,
-              '99.0': 328101.3999999988,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 30695.334941163997,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-11T15:00:00.000Z',
-          key: 1528729200000,
-          doc_count: 19469,
+          key_as_string: '2020-07-05T04:10:00.000Z',
+          key: 1593922200000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 89559.3525925925,
-              '99.0': 313951.54249999986,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 28895.042785967435,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-11T18:00:00.000Z',
-          key: 1528740000000,
-          doc_count: 18767,
+          key_as_string: '2020-07-05T04:20:00.000Z',
+          key: 1593922800000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 95769.83153735634,
-              '99.0': 323340.5274074075,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 30649.363989982416,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-11T21:00:00.000Z',
-          key: 1528750800000,
-          doc_count: 19006,
+          key_as_string: '2020-07-05T04:30:00.000Z',
+          key: 1593923400000,
+          doc_count: 64,
           pct: {
             values: {
-              '95.0': 94063.90833755062,
-              '99.0': 315055.5047619052,
+              '95.0': 270328.0,
+              '99.0': 299000.0,
             },
           },
           avg: {
-            value: 29802.63622014101,
+            value: 70357.234375,
           },
         },
         {
-          key_as_string: '2018-06-12T00:00:00.000Z',
-          key: 1528761600000,
-          doc_count: 19082,
+          key_as_string: '2020-07-05T04:40:00.000Z',
+          key: 1593924000000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 96399.67269119772,
-              '99.0': 330070.03599999985,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 30759.03002829892,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-12T03:00:00.000Z',
-          key: 1528772400000,
-          doc_count: 18908,
+          key_as_string: '2020-07-05T04:50:00.000Z',
+          key: 1593924600000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 96436.42520161276,
-              '99.0': 320531.54416666675,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 30399.76549608631,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-12T06:00:00.000Z',
-          key: 1528783200000,
-          doc_count: 19055,
+          key_as_string: '2020-07-05T05:00:00.000Z',
+          key: 1593925200000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 91860.16988095238,
-              '99.0': 315137.16628571344,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 29421.610233534506,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-12T09:00:00.000Z',
-          key: 1528794000000,
-          doc_count: 19047,
+          key_as_string: '2020-07-05T05:10:00.000Z',
+          key: 1593925800000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 105989.8333333334,
-              '99.0': 337251.4042424246,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 32641.679897096656,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-12T12:00:00.000Z',
-          key: 1528804800000,
-          doc_count: 18733,
+          key_as_string: '2020-07-05T05:20:00.000Z',
+          key: 1593926400000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 97937.60342555979,
-              '99.0': 327054.9243636365,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 30621.65440666204,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-12T15:00:00.000Z',
-          key: 1528815600000,
-          doc_count: 19079,
+          key_as_string: '2020-07-05T05:30:00.000Z',
+          key: 1593927000000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 98967.2249999999,
-              '99.0': 327653.0000000006,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 31039.60391005818,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-12T18:00:00.000Z',
-          key: 1528826400000,
-          doc_count: 18907,
+          key_as_string: '2020-07-05T05:40:00.000Z',
+          key: 1593927600000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 97561.02469135808,
-              '99.0': 324505.1399999999,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 30954.760723541545,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-12T21:00:00.000Z',
-          key: 1528837200000,
-          doc_count: 18971,
+          key_as_string: '2020-07-05T05:50:00.000Z',
+          key: 1593928200000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 102557.78813357186,
-              '99.0': 338040.3999999998,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 31902.050234568553,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-13T00:00:00.000Z',
-          key: 1528848000000,
-          doc_count: 18899,
+          key_as_string: '2020-07-05T06:00:00.000Z',
+          key: 1593928800000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 100137.87578595306,
-              '99.0': 328600.5173333335,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 31594.350653473728,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-13T03:00:00.000Z',
-          key: 1528858800000,
-          doc_count: 19182,
+          key_as_string: '2020-07-05T06:10:00.000Z',
+          key: 1593929400000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 98412.97120445351,
-              '99.0': 334060.93628571345,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 31343.87243248879,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-13T06:00:00.000Z',
-          key: 1528869600000,
-          doc_count: 19030,
+          key_as_string: '2020-07-05T06:20:00.000Z',
+          key: 1593930000000,
+          doc_count: 83,
           pct: {
             values: {
-              '95.0': 101607.8328012912,
-              '99.0': 328569.4964999998,
+              '95.0': 1687544.0,
+              '99.0': 5046264.0,
             },
           },
           avg: {
-            value: 31200.14450867052,
+            value: 269745.9036144578,
           },
         },
         {
-          key_as_string: '2018-06-13T09:00:00.000Z',
-          key: 1528880400000,
-          doc_count: 19257,
+          key_as_string: '2020-07-05T06:30:00.000Z',
+          key: 1593930600000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 92000.51368421057,
-              '99.0': 320227.32399999973,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 28560.946668743833,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-13T12:00:00.000Z',
-          key: 1528891200000,
-          doc_count: 19348,
+          key_as_string: '2020-07-05T06:40:00.000Z',
+          key: 1593931200000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 78027.29473684198,
-              '99.0': 292019.2899999998,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 24700.216146371717,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-13T15:00:00.000Z',
-          key: 1528902000000,
-          doc_count: 19119,
+          key_as_string: '2020-07-05T06:50:00.000Z',
+          key: 1593931800000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 80762.078801789,
-              '99.0': 297757.72666666657,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 25261.025210523563,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-13T18:00:00.000Z',
-          key: 1528912800000,
-          doc_count: 19206,
+          key_as_string: '2020-07-05T07:00:00.000Z',
+          key: 1593932400000,
+          doc_count: 42,
           pct: {
             values: {
-              '95.0': 81160.83425925927,
-              '99.0': 308034.4466666669,
+              '95.0': 798656.0,
+              '99.0': 4292544.0,
             },
           },
           avg: {
-            value: 26041.39789649068,
+            value: 313349.95238095237,
           },
         },
         {
-          key_as_string: '2018-06-13T21:00:00.000Z',
-          key: 1528923600000,
-          doc_count: 19078,
+          key_as_string: '2020-07-05T07:10:00.000Z',
+          key: 1593933000000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 84215.58945578222,
-              '99.0': 301128.4895238093,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 26123.556295209142,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-14T00:00:00.000Z',
-          key: 1528934400000,
-          doc_count: 19551,
+          key_as_string: '2020-07-05T07:20:00.000Z',
+          key: 1593933600000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 194188.21428571426,
-              '99.0': 447266.9,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 46231.36177177638,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-14T03:00:00.000Z',
-          key: 1528945200000,
-          doc_count: 18888,
+          key_as_string: '2020-07-05T07:30:00.000Z',
+          key: 1593934200000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 172616.2293896504,
-              '99.0': 409147.332500001,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 45350.42005506141,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-14T06:00:00.000Z',
-          key: 1528956000000,
-          doc_count: 18823,
+          key_as_string: '2020-07-05T07:40:00.000Z',
+          key: 1593934800000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 182653.81858220184,
-              '99.0': 423121.9773333328,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 48256.049354513096,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-14T09:00:00.000Z',
-          key: 1528966800000,
-          doc_count: 18766,
+          key_as_string: '2020-07-05T07:50:00.000Z',
+          key: 1593935400000,
+          doc_count: 0,
           pct: {
             values: {
-              '95.0': 194970.75667682925,
-              '99.0': 473485.4199999998,
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
-            value: 52360.30017052116,
+            value: null,
           },
         },
         {
-          key_as_string: '2018-06-14T12:00:00.000Z',
-          key: 1528977600000,
+          key_as_string: '2020-07-05T08:00:00.000Z',
+          key: 1593936000000,
           doc_count: 0,
           pct: {
             values: {
-              '95.0': 'NaN',
-              '99.0': 'NaN',
+              '95.0': null,
+              '99.0': null,
             },
           },
           avg: {
             value: null,
           },
         },
+        {
+          key_as_string: '2020-07-05T08:10:00.000Z',
+          key: 1593936600000,
+          doc_count: 215,
+          pct: {
+            values: {
+              '95.0': 3653624.0,
+              '99.0': 5046264.0,
+            },
+          },
+          avg: {
+            value: 397251.288372093,
+          },
+        },
+        {
+          key_as_string: '2020-07-05T08:20:00.000Z',
+          key: 1593937200000,
+          doc_count: 494,
+          pct: {
+            values: {
+              '95.0': 3276768.0,
+              '99.0': 4292576.0,
+            },
+          },
+          avg: {
+            value: 361953.5931174089,
+          },
+        },
+        {
+          key_as_string: '2020-07-05T08:30:00.000Z',
+          key: 1593937800000,
+          doc_count: 518,
+          pct: {
+            values: {
+              '95.0': 522208.0,
+              '99.0': 4128736.0,
+            },
+          },
+          avg: {
+            value: 259173.0694980695,
+          },
+        },
+        {
+          key_as_string: '2020-07-05T08:40:00.000Z',
+          key: 1593938400000,
+          doc_count: 449,
+          pct: {
+            values: {
+              '95.0': 372728.0,
+              '99.0': 843768.0,
+            },
+          },
+          avg: {
+            value: 79648.20935412026,
+          },
+        },
       ],
     },
     overall_avg_duration: {
-      value: 32861.15660262639,
+      value: 73065.05176360115,
     },
   },
 } as unknown) as ESResponse;
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/transform.test.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/transform.test.ts
index d0d0875be388f..bda3bfcdf769c 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/transform.test.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/transform.test.ts
@@ -48,21 +48,33 @@ describe('getTpmBuckets', () => {
               key_as_string: '',
               key: 0,
               doc_count: 0,
+              count: {
+                value: 0,
+              },
             },
             {
               key_as_string: '',
               key: 1,
               doc_count: 200,
+              count: {
+                value: 200,
+              },
             },
             {
               key_as_string: '',
               key: 2,
               doc_count: 300,
+              count: {
+                value: 300,
+              },
             },
             {
               key_as_string: '',
               key: 3,
               doc_count: 400,
+              count: {
+                value: 400,
+              },
             },
           ],
         },
@@ -76,21 +88,33 @@ describe('getTpmBuckets', () => {
               key_as_string: '',
               key: 0,
               doc_count: 0,
+              count: {
+                value: 0,
+              },
             },
             {
               key_as_string: '',
               key: 1,
               doc_count: 100,
+              count: {
+                value: 100,
+              },
             },
             {
               key_as_string: '',
               key: 2,
               doc_count: 100,
+              count: {
+                value: 100,
+              },
             },
             {
               key_as_string: '',
               key: 3,
               doc_count: 300,
+              count: {
+                value: 300,
+              },
             },
           ],
         },
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/transform.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/transform.ts
index f68c069253b99..7afb7427c210f 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/transform.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_timeseries_data/transform.ts
@@ -60,7 +60,7 @@ export function getTpmBuckets({
       const dataPoints = timeseries.buckets.map((bucket) => {
         // calculate request/minute. Avoid up-scaling numbers if bucketSize is below 60s (1 minute).
         // Eg. 1 request during a 10 second window should be displayed as "1 rpm" instead of "6 rpm".
-        const tmpValue = bucket.doc_count * (60 / Math.max(60, bucketSize));
+        const tmpValue = bucket.count.value * (60 / Math.max(60, bucketSize));
         return {
           x: bucket.key,
           y: tmpValue,
@@ -72,7 +72,7 @@ export function getTpmBuckets({
         resultKey === '' ? NOT_AVAILABLE_LABEL : (resultKey as string);
 
       const docCountTotal = timeseries.buckets
-        .map((bucket) => bucket.doc_count)
+        .map((bucket) => bucket.count.value)
         .reduce((a, b) => a + b, 0);
 
       // calculate request/minute
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/index.ts b/x-pack/plugins/apm/server/lib/transactions/charts/index.ts
index e862982145f77..43abf0b1a1d33 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/index.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/index.ts
@@ -28,6 +28,7 @@ export async function getTransactionCharts(options: {
   transactionType: string | undefined;
   transactionName: string | undefined;
   setup: Setup & SetupTimeRange & SetupUIFilters;
+  searchAggregatedTransactions: boolean;
   logger: Logger;
   uiFilters: UIFilters;
 }) {
diff --git a/x-pack/plugins/apm/server/lib/transactions/queries.test.ts b/x-pack/plugins/apm/server/lib/transactions/queries.test.ts
index 8c8dbe1a3460a..1c1d30c2d4d6d 100644
--- a/x-pack/plugins/apm/server/lib/transactions/queries.test.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/queries.test.ts
@@ -54,6 +54,7 @@ describe('transaction queries', () => {
         transactionName: undefined,
         transactionType: undefined,
         setup,
+        searchAggregatedTransactions: false,
         logger: loggerMock.create(),
         uiFilters: {},
       })
@@ -68,6 +69,7 @@ describe('transaction queries', () => {
         transactionName: 'bar',
         transactionType: undefined,
         setup,
+        searchAggregatedTransactions: false,
         logger: loggerMock.create(),
         uiFilters: {},
       })
@@ -82,6 +84,7 @@ describe('transaction queries', () => {
         transactionName: 'bar',
         transactionType: 'baz',
         setup,
+        searchAggregatedTransactions: false,
         logger: loggerMock.create(),
         uiFilters: {},
       })
diff --git a/x-pack/plugins/apm/server/lib/ui_filters/get_environments.ts b/x-pack/plugins/apm/server/lib/ui_filters/get_environments.ts
index 7d3af4caa2ca3..e72cc7e2483ad 100644
--- a/x-pack/plugins/apm/server/lib/ui_filters/get_environments.ts
+++ b/x-pack/plugins/apm/server/lib/ui_filters/get_environments.ts
@@ -13,11 +13,17 @@ import { rangeFilter } from '../../../common/utils/range_filter';
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
 import { ENVIRONMENT_NOT_DEFINED } from '../../../common/environment_filter_values';
 import { ESFilter } from '../../../typings/elasticsearch';
+import { getProcessorEventForAggregatedTransactions } from '../helpers/aggregated_transactions';
 
-export async function getEnvironments(
-  setup: Setup & SetupTimeRange,
-  serviceName?: string
-) {
+export async function getEnvironments({
+  setup,
+  serviceName,
+  searchAggregatedTransactions,
+}: {
+  setup: Setup & SetupTimeRange;
+  serviceName?: string;
+  searchAggregatedTransactions: boolean;
+}) {
   const { start, end, apmEventClient } = setup;
 
   const filter: ESFilter[] = [{ range: rangeFilter(start, end) }];
@@ -31,7 +37,9 @@ export async function getEnvironments(
   const params = {
     apm: {
       events: [
-        ProcessorEvent.transaction,
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
         ProcessorEvent.metric,
         ProcessorEvent.error,
       ],
diff --git a/x-pack/plugins/apm/server/lib/ui_filters/local_ui_filters/queries.test.ts b/x-pack/plugins/apm/server/lib/ui_filters/local_ui_filters/queries.test.ts
index 4cbb9efe012e6..22fa20e255f6e 100644
--- a/x-pack/plugins/apm/server/lib/ui_filters/local_ui_filters/queries.test.ts
+++ b/x-pack/plugins/apm/server/lib/ui_filters/local_ui_filters/queries.test.ts
@@ -29,7 +29,10 @@ describe('local ui filter queries', () => {
       getLocalUIFilters({
         setup,
         localFilterNames: ['transactionResult', 'host'],
-        projection: getServicesProjection({ setup }),
+        projection: getServicesProjection({
+          setup,
+          searchAggregatedTransactions: false,
+        }),
         uiFilters: {
           transactionResult: ['2xx'],
         },
diff --git a/x-pack/plugins/apm/server/lib/ui_filters/queries.test.ts b/x-pack/plugins/apm/server/lib/ui_filters/queries.test.ts
index 24e1c1a7f654c..18bdfe6e351d7 100644
--- a/x-pack/plugins/apm/server/lib/ui_filters/queries.test.ts
+++ b/x-pack/plugins/apm/server/lib/ui_filters/queries.test.ts
@@ -18,13 +18,24 @@ describe('ui filter queries', () => {
   });
 
   it('fetches environments', async () => {
-    mock = await inspectSearchParams((setup) => getEnvironments(setup, 'foo'));
+    mock = await inspectSearchParams((setup) =>
+      getEnvironments({
+        setup,
+        serviceName: 'foo',
+        searchAggregatedTransactions: false,
+      })
+    );
 
     expect(mock.params).toMatchSnapshot();
   });
 
   it('fetches environments without a service name', async () => {
-    mock = await inspectSearchParams((setup) => getEnvironments(setup));
+    mock = await inspectSearchParams((setup) =>
+      getEnvironments({
+        setup,
+        searchAggregatedTransactions: false,
+      })
+    );
 
     expect(mock.params).toMatchSnapshot();
   });
diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index f25e37927f094..b417f8689b229 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -26,11 +26,7 @@ import { MlPluginSetup } from '../../ml/server';
 import { ObservabilityPluginSetup } from '../../observability/server';
 import { SecurityPluginSetup } from '../../security/server';
 import { TaskManagerSetupContract } from '../../task_manager/server';
-import {
-  APM_FEATURE,
-  APM_SERVICE_MAPS_FEATURE_NAME,
-  APM_SERVICE_MAPS_LICENSE_TYPE,
-} from './feature';
+import { APM_FEATURE, registerFeaturesUsage } from './feature';
 import { registerApmAlerts } from './lib/alerts/register_apm_alerts';
 import { createApmTelemetry } from './lib/apm_telemetry';
 import { getInternalSavedObjectsClient } from './lib/helpers/get_internal_saved_objects_client';
@@ -128,10 +124,8 @@ export class APMPlugin implements Plugin<APMPluginSetup> {
     });
 
     plugins.features.registerKibanaFeature(APM_FEATURE);
-    plugins.licensing.featureUsage.register(
-      APM_SERVICE_MAPS_FEATURE_NAME,
-      APM_SERVICE_MAPS_LICENSE_TYPE
-    );
+
+    registerFeaturesUsage({ licensingPlugin: plugins.licensing });
 
     createApmApi().init(core, {
       config$: mergedConfig$,
diff --git a/x-pack/plugins/apm/server/projections/rum_overview.ts b/x-pack/plugins/apm/server/projections/rum_page_load_transactions.ts
similarity index 86%
rename from x-pack/plugins/apm/server/projections/rum_overview.ts
rename to x-pack/plugins/apm/server/projections/rum_page_load_transactions.ts
index ac5a7df235267..27cd9b53f8349 100644
--- a/x-pack/plugins/apm/server/projections/rum_overview.ts
+++ b/x-pack/plugins/apm/server/projections/rum_page_load_transactions.ts
@@ -15,8 +15,9 @@ import {
 } from '../../common/elasticsearch_fieldnames';
 import { rangeFilter } from '../../common/utils/range_filter';
 import { ProcessorEvent } from '../../common/processor_event';
+import { TRANSACTION_PAGE_LOAD } from '../../common/transaction_types';
 
-export function getRumOverviewProjection({
+export function getRumPageLoadTransactionsProjection({
   setup,
 }: {
   setup: Setup & SetupTimeRange & SetupUIFilters;
@@ -26,9 +27,10 @@ export function getRumOverviewProjection({
   const bool = {
     filter: [
       { range: rangeFilter(start, end) },
-      { term: { [TRANSACTION_TYPE]: 'page-load' } },
+      { term: { [TRANSACTION_TYPE]: TRANSACTION_PAGE_LOAD } },
       {
         // Adding this filter to cater for some inconsistent rum data
+        // not available on aggregated transactions
         exists: {
           field: 'transaction.marks.navigationTiming.fetchStart',
         },
diff --git a/x-pack/plugins/apm/server/projections/services.ts b/x-pack/plugins/apm/server/projections/services.ts
index 18fa79f31d6f3..ba61f72519a23 100644
--- a/x-pack/plugins/apm/server/projections/services.ts
+++ b/x-pack/plugins/apm/server/projections/services.ts
@@ -12,20 +12,25 @@ import {
 import { SERVICE_NAME } from '../../common/elasticsearch_fieldnames';
 import { rangeFilter } from '../../common/utils/range_filter';
 import { ProcessorEvent } from '../../common/processor_event';
+import { getProcessorEventForAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
 
 export function getServicesProjection({
   setup,
+  searchAggregatedTransactions,
 }: {
   setup: Setup & SetupTimeRange & SetupUIFilters;
+  searchAggregatedTransactions: boolean;
 }) {
   const { start, end, uiFiltersES } = setup;
 
   return {
     apm: {
       events: [
-        ProcessorEvent.transaction,
-        ProcessorEvent.metric,
-        ProcessorEvent.error,
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
+        ProcessorEvent.metric as const,
+        ProcessorEvent.error as const,
       ],
     },
     body: {
diff --git a/x-pack/plugins/apm/server/projections/transaction_groups.ts b/x-pack/plugins/apm/server/projections/transaction_groups.ts
index 8aa085cccf82a..0cc3a7a35d214 100644
--- a/x-pack/plugins/apm/server/projections/transaction_groups.ts
+++ b/x-pack/plugins/apm/server/projections/transaction_groups.ts
@@ -12,6 +12,7 @@ import {
 import {
   TRANSACTION_NAME,
   PARENT_ID,
+  TRANSACTION_ROOT,
 } from '../../common/elasticsearch_fieldnames';
 import { Options } from '../../server/lib/transaction_groups/fetcher';
 import { getTransactionsProjection } from './transactions';
@@ -29,18 +30,27 @@ export function getTransactionGroupsProjection({
     ...(omit(options, 'type') as Omit<typeof options, 'type'>),
   });
 
-  const bool =
-    options.type === 'top_traces'
-      ? {
-          must_not: [{ exists: { field: PARENT_ID } }],
-        }
-      : {};
+  if (options.type === 'top_traces') {
+    if (options.searchAggregatedTransactions) {
+      transactionsProjection.body.query.bool.filter.push({
+        term: {
+          [TRANSACTION_ROOT]: true,
+        },
+      });
+    } else {
+      // @ts-expect-error: Property 'must_not' does not exist on type '{ filter: ESFilter[]; }'.
+      transactionsProjection.body.query.bool.must_not = [
+        {
+          exists: {
+            field: PARENT_ID,
+          },
+        },
+      ];
+    }
+  }
 
   return mergeProjection(transactionsProjection, {
     body: {
-      query: {
-        bool,
-      },
       aggs: {
         transactions: {
           terms: {
diff --git a/x-pack/plugins/apm/server/projections/transactions.ts b/x-pack/plugins/apm/server/projections/transactions.ts
index f428a76a8b0cb..8e9bb3bf321f6 100644
--- a/x-pack/plugins/apm/server/projections/transactions.ts
+++ b/x-pack/plugins/apm/server/projections/transactions.ts
@@ -15,18 +15,23 @@ import {
   TRANSACTION_NAME,
 } from '../../common/elasticsearch_fieldnames';
 import { rangeFilter } from '../../common/utils/range_filter';
-import { ProcessorEvent } from '../../common/processor_event';
+import {
+  getProcessorEventForAggregatedTransactions,
+  getDocumentTypeFilterForAggregatedTransactions,
+} from '../lib/helpers/aggregated_transactions';
 
 export function getTransactionsProjection({
   setup,
   serviceName,
   transactionName,
   transactionType,
+  searchAggregatedTransactions,
 }: {
   setup: Setup & SetupTimeRange & SetupUIFilters;
   serviceName?: string;
   transactionName?: string;
   transactionType?: string;
+  searchAggregatedTransactions: boolean;
 }) {
   const { start, end, uiFiltersES } = setup;
 
@@ -47,12 +52,19 @@ export function getTransactionsProjection({
       ...transactionTypeFilter,
       ...serviceNameFilter,
       ...uiFiltersES,
+      ...getDocumentTypeFilterForAggregatedTransactions(
+        searchAggregatedTransactions
+      ),
     ],
   };
 
   return {
     apm: {
-      events: [ProcessorEvent.transaction as const],
+      events: [
+        getProcessorEventForAggregatedTransactions(
+          searchAggregatedTransactions
+        ),
+      ],
     },
     body: {
       query: {
diff --git a/x-pack/plugins/apm/server/routes/create_apm_api.ts b/x-pack/plugins/apm/server/routes/create_apm_api.ts
index a15b37945ce01..1230e8aa05c9f 100644
--- a/x-pack/plugins/apm/server/routes/create_apm_api.ts
+++ b/x-pack/plugins/apm/server/routes/create_apm_api.ts
@@ -48,6 +48,7 @@ import {
   transactionGroupsRoute,
   transactionGroupsAvgDurationByCountry,
   transactionGroupsAvgDurationByBrowser,
+  transactionSampleForGroupRoute,
   transactionGroupsErrorRateRoute,
 } from './transaction_groups';
 import {
@@ -140,6 +141,7 @@ const createApmApi = () => {
     .add(transactionGroupsRoute)
     .add(transactionGroupsAvgDurationByBrowser)
     .add(transactionGroupsAvgDurationByCountry)
+    .add(transactionSampleForGroupRoute)
     .add(transactionGroupsErrorRateRoute)
 
     // UI filters
diff --git a/x-pack/plugins/apm/server/routes/observability_overview.ts b/x-pack/plugins/apm/server/routes/observability_overview.ts
index d5bb3b49c2f4c..498e8b4792de1 100644
--- a/x-pack/plugins/apm/server/routes/observability_overview.ts
+++ b/x-pack/plugins/apm/server/routes/observability_overview.ts
@@ -10,6 +10,7 @@ import { getTransactionCoordinates } from '../lib/observability_overview/get_tra
 import { hasData } from '../lib/observability_overview/has_data';
 import { createRoute } from './create_route';
 import { rangeRt } from './default_api_types';
+import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
 
 export const observabilityOverviewHasDataRoute = createRoute(() => ({
   path: '/api/apm/observability_overview/has_data',
@@ -27,11 +28,20 @@ export const observabilityOverviewRoute = createRoute(() => ({
   handler: async ({ context, request }) => {
     const setup = await setupRequest(context, request);
     const { bucketSize } = context.params.query;
-    const serviceCountPromise = getServiceCount({ setup });
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
+    const serviceCountPromise = getServiceCount({
+      setup,
+      searchAggregatedTransactions,
+    });
     const transactionCoordinatesPromise = getTransactionCoordinates({
       setup,
       bucketSize,
+      searchAggregatedTransactions,
     });
+
     const [serviceCount, transactionCoordinates] = await Promise.all([
       serviceCountPromise,
       transactionCoordinatesPromise,
diff --git a/x-pack/plugins/apm/server/routes/rum_client.ts b/x-pack/plugins/apm/server/routes/rum_client.ts
index d4adca6a6658f..179279b6f2d8a 100644
--- a/x-pack/plugins/apm/server/routes/rum_client.ts
+++ b/x-pack/plugins/apm/server/routes/rum_client.ts
@@ -67,12 +67,12 @@ export const rumPageLoadDistBreakdownRoute = createRoute(() => ({
       query: { minPercentile, maxPercentile, breakdown },
     } = context.params;
 
-    return getPageLoadDistBreakdown(
+    return getPageLoadDistBreakdown({
       setup,
-      Number(minPercentile),
-      Number(maxPercentile),
-      breakdown
-    );
+      minDuration: Number(minPercentile),
+      maxDuration: Number(maxPercentile),
+      breakdown,
+    });
   },
 }));
 
diff --git a/x-pack/plugins/apm/server/routes/service_map.ts b/x-pack/plugins/apm/server/routes/service_map.ts
index 8533d54ed6277..1996d4d4a262d 100644
--- a/x-pack/plugins/apm/server/routes/service_map.ts
+++ b/x-pack/plugins/apm/server/routes/service_map.ts
@@ -15,7 +15,8 @@ import { getServiceMap } from '../lib/service_map/get_service_map';
 import { getServiceMapServiceNodeInfo } from '../lib/service_map/get_service_map_service_node_info';
 import { createRoute } from './create_route';
 import { rangeRt, uiFiltersRt } from './default_api_types';
-import { APM_SERVICE_MAPS_FEATURE_NAME } from '../feature';
+import { notifyFeatureUsage } from '../feature';
+import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
 import { getParsedUiFilters } from '../lib/helpers/convert_ui_filters/get_parsed_ui_filters';
 
 export const serviceMapRoute = createRoute(() => ({
@@ -36,14 +37,28 @@ export const serviceMapRoute = createRoute(() => ({
     if (!isActivePlatinumLicense(context.licensing.license)) {
       throw Boom.forbidden(invalidLicenseMessage);
     }
-    context.licensing.featureUsage.notifyUsage(APM_SERVICE_MAPS_FEATURE_NAME);
+
+    notifyFeatureUsage({
+      licensingPlugin: context.licensing,
+      featureName: 'serviceMaps',
+    });
 
     const logger = context.logger;
     const setup = await setupRequest(context, request);
     const {
       query: { serviceName, environment },
     } = context.params;
-    return getServiceMap({ setup, serviceName, environment, logger });
+
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+    return getServiceMap({
+      setup,
+      serviceName,
+      environment,
+      searchAggregatedTransactions,
+      logger,
+    });
   },
 }));
 
@@ -70,11 +85,15 @@ export const serviceMapServiceNodeRoute = createRoute(() => ({
       path: { serviceName },
     } = context.params;
 
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
     const uiFilters = getParsedUiFilters({ uiFilters: uiFiltersJson, logger });
 
     return getServiceMapServiceNodeInfo({
       setup,
       serviceName,
+      searchAggregatedTransactions,
       uiFilters,
     });
   },
diff --git a/x-pack/plugins/apm/server/routes/services.ts b/x-pack/plugins/apm/server/routes/services.ts
index cc7f25867df2c..4bb10f31ba6a1 100644
--- a/x-pack/plugins/apm/server/routes/services.ts
+++ b/x-pack/plugins/apm/server/routes/services.ts
@@ -16,6 +16,7 @@ import { createRoute } from './create_route';
 import { uiFiltersRt, rangeRt } from './default_api_types';
 import { getServiceAnnotations } from '../lib/services/annotations';
 import { dateAsStringRt } from '../../common/runtime_types/date_as_string_rt';
+import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
 import { getParsedUiFilters } from '../lib/helpers/convert_ui_filters/get_parsed_ui_filters';
 
 export const servicesRoute = createRoute(() => ({
@@ -31,8 +32,13 @@ export const servicesRoute = createRoute(() => ({
 
     const setup = await setupRequest(context, request);
 
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
     const services = await getServices({
       setup,
+      searchAggregatedTransactions,
       mlAnomaliesEnvironment: environment,
     });
 
@@ -51,7 +57,15 @@ export const serviceAgentNameRoute = createRoute(() => ({
   handler: async ({ context, request }) => {
     const setup = await setupRequest(context, request);
     const { serviceName } = context.params.path;
-    return getServiceAgentName(serviceName, setup);
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
+    return getServiceAgentName({
+      serviceName,
+      setup,
+      searchAggregatedTransactions,
+    });
   },
 }));
 
@@ -66,7 +80,13 @@ export const serviceTransactionTypesRoute = createRoute(() => ({
   handler: async ({ context, request }) => {
     const setup = await setupRequest(context, request);
     const { serviceName } = context.params.path;
-    return getServiceTransactionTypes(serviceName, setup);
+    return getServiceTransactionTypes({
+      serviceName,
+      setup,
+      searchAggregatedTransactions: await getSearchAggregatedTransactions(
+        setup
+      ),
+    });
   },
 }));
 
@@ -104,13 +124,20 @@ export const serviceAnnotationsRoute = createRoute(() => ({
     const { serviceName } = context.params.path;
     const { environment } = context.params.query;
 
-    const annotationsClient = await context.plugins.observability?.getScopedAnnotationsClient(
-      context,
-      request
-    );
+    const [
+      annotationsClient,
+      searchAggregatedTransactions,
+    ] = await Promise.all([
+      context.plugins.observability?.getScopedAnnotationsClient(
+        context,
+        request
+      ),
+      getSearchAggregatedTransactions(setup),
+    ]);
 
     return getServiceAnnotations({
       setup,
+      searchAggregatedTransactions,
       serviceName,
       environment,
       annotationsClient,
diff --git a/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts b/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
index 0350ebfb9196c..beab6b6c850e3 100644
--- a/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
+++ b/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
@@ -22,6 +22,7 @@ import {
   agentConfigurationIntakeRt,
 } from '../../../common/agent_configuration/runtime_types/agent_configuration_intake_rt';
 import { jsonRt } from '../../../common/runtime_types/json_rt';
+import { getSearchAggregatedTransactions } from '../../lib/helpers/aggregated_transactions';
 
 // get list of configurations
 export const agentConfigurationRoute = createRoute(() => ({
@@ -199,8 +200,12 @@ export const listAgentConfigurationServicesRoute = createRoute(() => ({
   path: '/api/apm/settings/agent-configuration/services',
   handler: async ({ context, request }) => {
     const setup = await setupRequest(context, request);
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
     return await getServiceNames({
       setup,
+      searchAggregatedTransactions,
     });
   },
 }));
@@ -214,7 +219,15 @@ export const listAgentConfigurationEnvironmentsRoute = createRoute(() => ({
   handler: async ({ context, request }) => {
     const setup = await setupRequest(context, request);
     const { serviceName } = context.params.query;
-    return await getEnvironments({ serviceName, setup });
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
+    return await getEnvironments({
+      serviceName,
+      setup,
+      searchAggregatedTransactions,
+    });
   },
 }));
 
diff --git a/x-pack/plugins/apm/server/routes/settings/anomaly_detection.ts b/x-pack/plugins/apm/server/routes/settings/anomaly_detection.ts
index 290e81bd29973..f0a22356d074b 100644
--- a/x-pack/plugins/apm/server/routes/settings/anomaly_detection.ts
+++ b/x-pack/plugins/apm/server/routes/settings/anomaly_detection.ts
@@ -14,6 +14,8 @@ import { createAnomalyDetectionJobs } from '../../lib/anomaly_detection/create_a
 import { setupRequest } from '../../lib/helpers/setup_request';
 import { getAllEnvironments } from '../../lib/environments/get_all_environments';
 import { hasLegacyJobs } from '../../lib/anomaly_detection/has_legacy_jobs';
+import { getSearchAggregatedTransactions } from '../../lib/helpers/aggregated_transactions';
+import { notifyFeatureUsage } from '../../feature';
 
 // get ML anomaly detection jobs for each environment
 export const anomalyDetectionJobsRoute = createRoute(() => ({
@@ -61,6 +63,10 @@ export const createAnomalyDetectionJobsRoute = createRoute(() => ({
     }
 
     await createAnomalyDetectionJobs(setup, environments, context.logger);
+    notifyFeatureUsage({
+      licensingPlugin: context.licensing,
+      featureName: 'ml',
+    });
   },
 }));
 
@@ -70,6 +76,15 @@ export const anomalyDetectionEnvironmentsRoute = createRoute(() => ({
   path: '/api/apm/settings/anomaly-detection/environments',
   handler: async ({ context, request }) => {
     const setup = await setupRequest(context, request);
-    return await getAllEnvironments({ setup, includeMissing: true });
+
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
+    return await getAllEnvironments({
+      setup,
+      searchAggregatedTransactions,
+      includeMissing: true,
+    });
   },
 }));
diff --git a/x-pack/plugins/apm/server/routes/settings/custom_link.ts b/x-pack/plugins/apm/server/routes/settings/custom_link.ts
index 83c23a75e999d..7882383d78ab0 100644
--- a/x-pack/plugins/apm/server/routes/settings/custom_link.ts
+++ b/x-pack/plugins/apm/server/routes/settings/custom_link.ts
@@ -3,9 +3,14 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
+import Boom from 'boom';
 import * as t from 'io-ts';
 import { pick } from 'lodash';
+import { INVALID_LICENSE } from '../../../common/custom_link';
+import { ILicense } from '../../../../licensing/common/types';
 import { FILTER_OPTIONS } from '../../../common/custom_link/custom_link_filter_options';
+import { notifyFeatureUsage } from '../../feature';
 import { setupRequest } from '../../lib/helpers/setup_request';
 import { createOrUpdateCustomLink } from '../../lib/settings/custom_link/create_or_update_custom_link';
 import {
@@ -17,6 +22,10 @@ import { getTransaction } from '../../lib/settings/custom_link/get_transaction';
 import { listCustomLinks } from '../../lib/settings/custom_link/list_custom_links';
 import { createRoute } from '../create_route';
 
+function isActiveGoldLicense(license: ILicense) {
+  return license.isActive && license.hasAtLeast('gold');
+}
+
 export const customLinkTransactionRoute = createRoute(() => ({
   path: '/api/apm/settings/custom_links/transaction',
   params: {
@@ -37,6 +46,9 @@ export const listCustomLinksRoute = createRoute(() => ({
     query: filterOptionsRt,
   },
   handler: async ({ context, request }) => {
+    if (!isActiveGoldLicense(context.licensing.license)) {
+      throw Boom.forbidden(INVALID_LICENSE);
+    }
     const setup = await setupRequest(context, request);
     const { query } = context.params;
     // picks only the items listed in FILTER_OPTIONS
@@ -55,9 +67,17 @@ export const createCustomLinkRoute = createRoute(() => ({
     tags: ['access:apm', 'access:apm_write'],
   },
   handler: async ({ context, request }) => {
+    if (!isActiveGoldLicense(context.licensing.license)) {
+      throw Boom.forbidden(INVALID_LICENSE);
+    }
     const setup = await setupRequest(context, request);
     const customLink = context.params.body;
     const res = await createOrUpdateCustomLink({ customLink, setup });
+
+    notifyFeatureUsage({
+      licensingPlugin: context.licensing,
+      featureName: 'customLinks',
+    });
     return res;
   },
 }));
@@ -75,6 +95,9 @@ export const updateCustomLinkRoute = createRoute(() => ({
     tags: ['access:apm', 'access:apm_write'],
   },
   handler: async ({ context, request }) => {
+    if (!isActiveGoldLicense(context.licensing.license)) {
+      throw Boom.forbidden(INVALID_LICENSE);
+    }
     const setup = await setupRequest(context, request);
     const { id } = context.params.path;
     const customLink = context.params.body;
@@ -99,6 +122,9 @@ export const deleteCustomLinkRoute = createRoute(() => ({
     tags: ['access:apm', 'access:apm_write'],
   },
   handler: async ({ context, request }) => {
+    if (!isActiveGoldLicense(context.licensing.license)) {
+      throw Boom.forbidden(INVALID_LICENSE);
+    }
     const setup = await setupRequest(context, request);
     const { id } = context.params.path;
     const res = await deleteCustomLink({
diff --git a/x-pack/plugins/apm/server/routes/traces.ts b/x-pack/plugins/apm/server/routes/traces.ts
index 354dafe536c43..45b334a7f06d2 100644
--- a/x-pack/plugins/apm/server/routes/traces.ts
+++ b/x-pack/plugins/apm/server/routes/traces.ts
@@ -10,6 +10,7 @@ import { getTrace } from '../lib/traces/get_trace';
 import { getTransactionGroupList } from '../lib/transaction_groups';
 import { createRoute } from './create_route';
 import { rangeRt, uiFiltersRt } from './default_api_types';
+import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
 
 export const tracesRoute = createRoute(() => ({
   path: '/api/apm/traces',
@@ -18,7 +19,13 @@ export const tracesRoute = createRoute(() => ({
   },
   handler: async ({ context, request }) => {
     const setup = await setupRequest(context, request);
-    return getTransactionGroupList({ type: 'top_traces' }, setup);
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+    return getTransactionGroupList(
+      { type: 'top_traces', searchAggregatedTransactions },
+      setup
+    );
   },
 }));
 
diff --git a/x-pack/plugins/apm/server/routes/transaction_groups.ts b/x-pack/plugins/apm/server/routes/transaction_groups.ts
index c667ce4f07e93..3c512c1fe5278 100644
--- a/x-pack/plugins/apm/server/routes/transaction_groups.ts
+++ b/x-pack/plugins/apm/server/routes/transaction_groups.ts
@@ -14,6 +14,8 @@ import { createRoute } from './create_route';
 import { uiFiltersRt, rangeRt } from './default_api_types';
 import { getTransactionAvgDurationByBrowser } from '../lib/transactions/avg_duration_by_browser';
 import { getTransactionAvgDurationByCountry } from '../lib/transactions/avg_duration_by_country';
+import { getTransactionSampleForGroup } from '../lib/transaction_groups/get_transaction_sample_for_group';
+import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
 import { getErrorRate } from '../lib/transaction_groups/get_error_rate';
 import { getParsedUiFilters } from '../lib/helpers/convert_ui_filters/get_parsed_ui_filters';
 
@@ -36,11 +38,16 @@ export const transactionGroupsRoute = createRoute(() => ({
     const { serviceName } = context.params.path;
     const { transactionType } = context.params.query;
 
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
     return getTransactionGroupList(
       {
         type: 'top_transactions',
         serviceName,
         transactionType,
+        searchAggregatedTransactions,
       },
       setup
     );
@@ -74,11 +81,16 @@ export const transactionGroupsChartsRoute = createRoute(() => ({
 
     const uiFilters = getParsedUiFilters({ uiFilters: uiFiltersJson, logger });
 
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
     return getTransactionCharts({
       serviceName,
       transactionType,
       transactionName,
       setup,
+      searchAggregatedTransactions,
       logger,
       uiFilters,
     });
@@ -175,9 +187,14 @@ export const transactionGroupsAvgDurationByBrowser = createRoute(() => ({
     const { serviceName } = context.params.path;
     const { transactionName } = context.params.query;
 
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
     return getTransactionAvgDurationByBrowser({
       serviceName,
       setup,
+      searchAggregatedTransactions,
       transactionName,
     });
   },
@@ -200,14 +217,43 @@ export const transactionGroupsAvgDurationByCountry = createRoute(() => ({
     const { serviceName } = context.params.path;
     const { transactionName } = context.params.query;
 
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
     return getTransactionAvgDurationByCountry({
       serviceName,
       transactionName,
       setup,
+      searchAggregatedTransactions,
     });
   },
 }));
 
+export const transactionSampleForGroupRoute = createRoute(() => ({
+  path: `/api/apm/transaction_sample`,
+  params: {
+    query: t.intersection([
+      uiFiltersRt,
+      rangeRt,
+      t.type({ serviceName: t.string, transactionName: t.string }),
+    ]),
+  },
+  handler: async ({ context, request }) => {
+    const setup = await setupRequest(context, request);
+
+    const { transactionName, serviceName } = context.params.query;
+
+    return {
+      transaction: await getTransactionSampleForGroup({
+        setup,
+        serviceName,
+        transactionName,
+      }),
+    };
+  },
+}));
+
 export const transactionGroupsErrorRateRoute = createRoute(() => ({
   path: '/api/apm/services/{serviceName}/transaction_groups/error_rate',
   params: {
diff --git a/x-pack/plugins/apm/server/routes/ui_filters.ts b/x-pack/plugins/apm/server/routes/ui_filters.ts
index 864f5033c9d62..8bdd83a8ddda6 100644
--- a/x-pack/plugins/apm/server/routes/ui_filters.ts
+++ b/x-pack/plugins/apm/server/routes/ui_filters.ts
@@ -29,7 +29,9 @@ import { createRoute } from './create_route';
 import { uiFiltersRt, rangeRt } from './default_api_types';
 import { jsonRt } from '../../common/runtime_types/json_rt';
 import { getServiceNodesProjection } from '../projections/service_nodes';
-import { getRumOverviewProjection } from '../projections/rum_overview';
+import { getRumPageLoadTransactionsProjection } from '../projections/rum_page_load_transactions';
+import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
+import { APMRequestHandlerContext } from './typings';
 
 export const uiFiltersEnvironmentsRoute = createRoute(() => ({
   path: '/api/apm/ui_filters/environments',
@@ -44,7 +46,15 @@ export const uiFiltersEnvironmentsRoute = createRoute(() => ({
   handler: async ({ context, request }) => {
     const setup = await setupRequest(context, request);
     const { serviceName } = context.params.query;
-    return getEnvironments(setup, serviceName);
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
+    return getEnvironments({
+      setup,
+      serviceName,
+      searchAggregatedTransactions,
+    });
   },
 }));
 
@@ -93,8 +103,9 @@ function createLocalFiltersRoute<
 
       const { uiFilters, filterNames } = query;
       const parsedUiFilters = JSON.parse(uiFilters);
-      const projection = getProjection({
+      const projection = await getProjection({
         query,
+        context,
         setup: {
           ...setup,
           uiFiltersES: getUiFiltersES(omit(parsedUiFilters, filterNames)),
@@ -113,14 +124,25 @@ function createLocalFiltersRoute<
 
 export const servicesLocalFiltersRoute = createLocalFiltersRoute({
   path: `/api/apm/ui_filters/local_filters/services`,
-  getProjection: ({ setup }) => getServicesProjection({ setup }),
+  getProjection: async ({ context, setup }) => {
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
+    return getServicesProjection({ setup, searchAggregatedTransactions });
+  },
   queryRt: t.type({}),
 });
 
 export const transactionGroupsLocalFiltersRoute = createLocalFiltersRoute({
   path: '/api/apm/ui_filters/local_filters/transactionGroups',
-  getProjection: ({ setup, query }) => {
+  getProjection: async ({ context, setup, query }) => {
     const { transactionType, serviceName, transactionName } = query;
+
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
     return getTransactionGroupsProjection({
       setup,
       options: {
@@ -128,6 +150,7 @@ export const transactionGroupsLocalFiltersRoute = createLocalFiltersRoute({
         transactionType,
         serviceName,
         transactionName,
+        searchAggregatedTransactions,
       },
     });
   },
@@ -144,10 +167,14 @@ export const transactionGroupsLocalFiltersRoute = createLocalFiltersRoute({
 
 export const tracesLocalFiltersRoute = createLocalFiltersRoute({
   path: '/api/apm/ui_filters/local_filters/traces',
-  getProjection: ({ setup }) => {
+  getProjection: async ({ setup, context }) => {
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
     return getTransactionGroupsProjection({
       setup,
-      options: { type: 'top_traces' },
+      options: { type: 'top_traces', searchAggregatedTransactions },
     });
   },
   queryRt: t.type({}),
@@ -155,13 +182,19 @@ export const tracesLocalFiltersRoute = createLocalFiltersRoute({
 
 export const transactionsLocalFiltersRoute = createLocalFiltersRoute({
   path: '/api/apm/ui_filters/local_filters/transactions',
-  getProjection: ({ setup, query }) => {
+  getProjection: async ({ context, setup, query }) => {
     const { transactionType, serviceName, transactionName } = query;
+
+    const searchAggregatedTransactions = await getSearchAggregatedTransactions(
+      setup
+    );
+
     return getTransactionsProjection({
       setup,
       transactionType,
       serviceName,
       transactionName,
+      searchAggregatedTransactions,
     });
   },
   queryRt: t.type({
@@ -221,8 +254,8 @@ export const serviceNodesLocalFiltersRoute = createLocalFiltersRoute({
 
 export const rumOverviewLocalFiltersRoute = createLocalFiltersRoute({
   path: '/api/apm/ui_filters/local_filters/rumOverview',
-  getProjection: ({ setup }) => {
-    return getRumOverviewProjection({
+  getProjection: async ({ setup }) => {
+    return getRumPageLoadTransactionsProjection({
       setup,
     });
   },
@@ -237,7 +270,9 @@ type GetProjection<
 > = ({
   query,
   setup,
+  context,
 }: {
   query: t.TypeOf<TQueryRT>;
   setup: Setup & SetupUIFilters & SetupTimeRange;
-}) => TProjection;
+  context: APMRequestHandlerContext;
+}) => Promise<TProjection> | TProjection;
diff --git a/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts b/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
index 44211601204cd..93f8b115256b4 100644
--- a/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
+++ b/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
@@ -176,7 +176,7 @@ export interface AggregationInputMap {
   [key: string]: AggregationOptionsMap;
 }
 
-type BucketSubAggregationResponse<
+type SubAggregationResponseOf<
   TAggregationInputMap extends AggregationInputMap | undefined,
   TDocument
 > = TAggregationInputMap extends AggregationInputMap
@@ -192,10 +192,7 @@ interface AggregationResponsePart<
       {
         doc_count: number;
         key: string | number;
-      } & BucketSubAggregationResponse<
-        TAggregationOptionsMap['aggs'],
-        TDocument
-      >
+      } & SubAggregationResponseOf<TAggregationOptionsMap['aggs'], TDocument>
     >;
   };
   histogram: {
@@ -203,23 +200,20 @@ interface AggregationResponsePart<
       {
         doc_count: number;
         key: number;
-      } & BucketSubAggregationResponse<
-        TAggregationOptionsMap['aggs'],
-        TDocument
-      >
+      } & SubAggregationResponseOf<TAggregationOptionsMap['aggs'], TDocument>
     >;
   };
   date_histogram: {
     buckets: Array<
       DateHistogramBucket &
-        BucketSubAggregationResponse<TAggregationOptionsMap['aggs'], TDocument>
+        SubAggregationResponseOf<TAggregationOptionsMap['aggs'], TDocument>
     >;
   };
   avg: MetricsAggregationResponsePart;
   sum: MetricsAggregationResponsePart;
   max: MetricsAggregationResponsePart;
   min: MetricsAggregationResponsePart;
-  value_count: MetricsAggregationResponsePart;
+  value_count: { value: number };
   cardinality: {
     value: number;
   };
@@ -261,7 +255,7 @@ interface AggregationResponsePart<
   };
   filter: {
     doc_count: number;
-  } & AggregationResponseMap<TAggregationOptionsMap['aggs'], TDocument>;
+  } & SubAggregationResponseOf<TAggregationOptionsMap['aggs'], TDocument>;
   filters: TAggregationOptionsMap extends { filters: { filters: any[] } }
     ? Array<
         { doc_count: number } & AggregationResponseMap<
@@ -278,13 +272,16 @@ interface AggregationResponsePart<
         buckets: {
           [key in keyof TAggregationOptionsMap['filters']['filters']]: {
             doc_count: number;
-          } & AggregationResponseMap<TAggregationOptionsMap['aggs'], TDocument>;
+          } & SubAggregationResponseOf<
+            TAggregationOptionsMap['aggs'],
+            TDocument
+          >;
         };
       }
     : never;
   sampler: {
     doc_count: number;
-  } & AggregationResponseMap<TAggregationOptionsMap['aggs'], TDocument>;
+  } & SubAggregationResponseOf<TAggregationOptionsMap['aggs'], TDocument>;
   derivative:
     | {
         value: number;
@@ -303,10 +300,7 @@ interface AggregationResponsePart<
       {
         key: Record<GetCompositeKeys<TAggregationOptionsMap>, string | number>;
         doc_count: number;
-      } & BucketSubAggregationResponse<
-        TAggregationOptionsMap['aggs'],
-        TDocument
-      >
+      } & SubAggregationResponseOf<TAggregationOptionsMap['aggs'], TDocument>
     >;
   };
   diversified_sampler: {
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/__stories__/__snapshots__/palette.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/__stories__/__snapshots__/palette.stories.storyshot
index 385b16d3d8e8e..c0d3256eb9eb7 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/__stories__/__snapshots__/palette.stories.storyshot
+++ b/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/__stories__/__snapshots__/palette.stories.storyshot
@@ -48,12 +48,10 @@ exports[`Storyshots arguments/Palette default 1`] = `
           <button
             aria-haspopup="true"
             aria-labelledby="undefined generated-id"
-            aria-selected={true}
             className="euiSuperSelectControl euiSuperSelectControl--compressed"
             onClick={[Function]}
             onKeyDown={[Function]}
             readOnly={false}
-            role="option"
             type="button"
           >
             <div
diff --git a/x-pack/plugins/canvas/public/components/font_picker/__stories__/__snapshots__/font_picker.stories.storyshot b/x-pack/plugins/canvas/public/components/font_picker/__stories__/__snapshots__/font_picker.stories.storyshot
index 856d4b12f164a..f4b3b9ed8546a 100644
--- a/x-pack/plugins/canvas/public/components/font_picker/__stories__/__snapshots__/font_picker.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/font_picker/__stories__/__snapshots__/font_picker.stories.storyshot
@@ -32,11 +32,9 @@ exports[`Storyshots components/FontPicker default 1`] = `
         <button
           aria-haspopup="true"
           aria-labelledby="undefined generated-id"
-          aria-selected={true}
           className="euiSuperSelectControl euiSuperSelectControl--compressed"
           onClick={[Function]}
           onKeyDown={[Function]}
-          role="option"
           type="button"
         />
         <div
@@ -99,11 +97,9 @@ exports[`Storyshots components/FontPicker with value 1`] = `
         <button
           aria-haspopup="true"
           aria-labelledby="undefined generated-id"
-          aria-selected={true}
           className="euiSuperSelectControl euiSuperSelectControl--compressed"
           onClick={[Function]}
           onKeyDown={[Function]}
-          role="option"
           type="button"
         >
           <div
diff --git a/x-pack/plugins/canvas/public/components/palette_picker/__stories__/__snapshots__/palette_picker.stories.storyshot b/x-pack/plugins/canvas/public/components/palette_picker/__stories__/__snapshots__/palette_picker.stories.storyshot
index d3809b4c3979f..978256e761db4 100644
--- a/x-pack/plugins/canvas/public/components/palette_picker/__stories__/__snapshots__/palette_picker.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/palette_picker/__stories__/__snapshots__/palette_picker.stories.storyshot
@@ -38,12 +38,10 @@ exports[`Storyshots components/Color/PalettePicker clearable 1`] = `
           <button
             aria-haspopup="true"
             aria-labelledby="undefined generated-id"
-            aria-selected={true}
             className="euiSuperSelectControl euiSuperSelectControl--compressed"
             onClick={[Function]}
             onKeyDown={[Function]}
             readOnly={false}
-            role="option"
             type="button"
           >
             None
@@ -115,12 +113,10 @@ exports[`Storyshots components/Color/PalettePicker default 1`] = `
           <button
             aria-haspopup="true"
             aria-labelledby="undefined generated-id"
-            aria-selected={true}
             className="euiSuperSelectControl euiSuperSelectControl--compressed"
             onClick={[Function]}
             onKeyDown={[Function]}
             readOnly={false}
-            role="option"
             type="button"
           >
             <div
@@ -199,12 +195,10 @@ exports[`Storyshots components/Color/PalettePicker interactive 1`] = `
           <button
             aria-haspopup="true"
             aria-labelledby="undefined generated-id"
-            aria-selected={true}
             className="euiSuperSelectControl euiSuperSelectControl--compressed"
             onClick={[Function]}
             onKeyDown={[Function]}
             readOnly={false}
-            role="option"
             type="button"
           >
             <div
diff --git a/x-pack/plugins/canvas/public/components/saved_elements_modal/__stories__/__snapshots__/saved_elements_modal.stories.storyshot b/x-pack/plugins/canvas/public/components/saved_elements_modal/__stories__/__snapshots__/saved_elements_modal.stories.storyshot
index 0b345849b0a9a..77e897e163618 100644
--- a/x-pack/plugins/canvas/public/components/saved_elements_modal/__stories__/__snapshots__/saved_elements_modal.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/saved_elements_modal/__stories__/__snapshots__/saved_elements_modal.stories.storyshot
@@ -57,7 +57,7 @@ exports[`Storyshots components/SavedElementsModal no custom elements 1`] = `
               className="euiFormControlLayout__childrenWrapper"
             >
               <input
-                className="euiFieldSearch euiFieldSearch--fullWidth"
+                className="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch-isClearable"
                 onChange={[Function]}
                 onKeyUp={[Function]}
                 placeholder="Find element"
@@ -197,7 +197,7 @@ exports[`Storyshots components/SavedElementsModal with custom elements 1`] = `
               className="euiFormControlLayout__childrenWrapper"
             >
               <input
-                className="euiFieldSearch euiFieldSearch--fullWidth"
+                className="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch-isClearable"
                 onChange={[Function]}
                 onKeyUp={[Function]}
                 placeholder="Find element"
@@ -628,7 +628,7 @@ exports[`Storyshots components/SavedElementsModal with text filter 1`] = `
               className="euiFormControlLayout__childrenWrapper"
             >
               <input
-                className="euiFieldSearch euiFieldSearch--fullWidth"
+                className="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch-isClearable"
                 onChange={[Function]}
                 onKeyUp={[Function]}
                 placeholder="Find element"
diff --git a/x-pack/plugins/canvas/public/components/text_style_picker/__stories__/__snapshots__/text_style_picker.stories.storyshot b/x-pack/plugins/canvas/public/components/text_style_picker/__stories__/__snapshots__/text_style_picker.stories.storyshot
index 3d688acbf7d76..59b9989030459 100644
--- a/x-pack/plugins/canvas/public/components/text_style_picker/__stories__/__snapshots__/text_style_picker.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/text_style_picker/__stories__/__snapshots__/text_style_picker.stories.storyshot
@@ -48,11 +48,9 @@ exports[`Storyshots components/TextStylePicker default 1`] = `
                 <button
                   aria-haspopup="true"
                   aria-labelledby="undefined generated-id"
-                  aria-selected={true}
                   className="euiSuperSelectControl euiSuperSelectControl--compressed"
                   onClick={[Function]}
                   onKeyDown={[Function]}
-                  role="option"
                   type="button"
                 />
                 <div
@@ -529,11 +527,9 @@ exports[`Storyshots components/TextStylePicker interactive 1`] = `
                 <button
                   aria-haspopup="true"
                   aria-labelledby="undefined generated-id"
-                  aria-selected={true}
                   className="euiSuperSelectControl euiSuperSelectControl--compressed"
                   onClick={[Function]}
                   onKeyDown={[Function]}
-                  role="option"
                   type="button"
                 />
                 <div
diff --git a/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/edit_var.stories.storyshot b/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/edit_var.stories.storyshot
index ce3084ea4fbb4..841d7612b4c27 100644
--- a/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/edit_var.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/edit_var.stories.storyshot
@@ -127,13 +127,11 @@ Array [
                   <button
                     aria-haspopup="true"
                     aria-labelledby="generated-id generated-id"
-                    aria-selected={true}
                     className="euiSuperSelectControl euiSuperSelectControl--compressed"
                     onBlur={[Function]}
                     onClick={[Function]}
                     onFocus={[Function]}
                     onKeyDown={[Function]}
-                    role="option"
                     type="button"
                   >
                     <div
@@ -479,13 +477,11 @@ Array [
                   <button
                     aria-haspopup="true"
                     aria-labelledby="generated-id generated-id"
-                    aria-selected={true}
                     className="euiSuperSelectControl euiSuperSelectControl--compressed"
                     onBlur={[Function]}
                     onClick={[Function]}
                     onFocus={[Function]}
                     onKeyDown={[Function]}
-                    role="option"
                     type="button"
                   >
                     <div
@@ -780,13 +776,11 @@ Array [
                   <button
                     aria-haspopup="true"
                     aria-labelledby="generated-id generated-id"
-                    aria-selected={true}
                     className="euiSuperSelectControl euiSuperSelectControl--compressed"
                     onBlur={[Function]}
                     onClick={[Function]}
                     onFocus={[Function]}
                     onKeyDown={[Function]}
-                    role="option"
                     type="button"
                   >
                     <div
@@ -1057,13 +1051,11 @@ Array [
                   <button
                     aria-haspopup="true"
                     aria-labelledby="generated-id generated-id"
-                    aria-selected={true}
                     className="euiSuperSelectControl euiSuperSelectControl--compressed"
                     onBlur={[Function]}
                     onClick={[Function]}
                     onFocus={[Function]}
                     onKeyDown={[Function]}
-                    role="option"
                     type="button"
                   >
                     <div
diff --git a/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/var_config.stories.storyshot b/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/var_config.stories.storyshot
index 146f07a9d0118..b4996328b04e7 100644
--- a/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/var_config.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/var_config.stories.storyshot
@@ -17,6 +17,7 @@ exports[`Storyshots components/Variables/VarConfig default 1`] = `
           aria-controls="accordion-variables"
           aria-expanded={false}
           className="euiAccordion__button"
+          id="generated-id"
           onClick={[Function]}
           type="button"
         >
diff --git a/x-pack/plugins/canvas/public/components/workpad_templates/examples/__snapshots__/workpad_templates.stories.storyshot b/x-pack/plugins/canvas/public/components/workpad_templates/examples/__snapshots__/workpad_templates.stories.storyshot
index 4941215def43b..52a009f1d5cbf 100644
--- a/x-pack/plugins/canvas/public/components/workpad_templates/examples/__snapshots__/workpad_templates.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/workpad_templates/examples/__snapshots__/workpad_templates.stories.storyshot
@@ -22,7 +22,7 @@ exports[`Storyshots components/WorkpadTemplates default 1`] = `
         >
           <input
             aria-label="This is a search bar. As you type, the results lower in the page will automatically filter."
-            className="euiFieldSearch euiFieldSearch--fullWidth"
+            className="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch-isClearable"
             defaultValue=""
             onKeyUp={[Function]}
             placeholder="Find template"
diff --git a/x-pack/plugins/canvas/public/expression_types/arg_types/container_style/__stories__/__snapshots__/extended_template.stories.storyshot b/x-pack/plugins/canvas/public/expression_types/arg_types/container_style/__stories__/__snapshots__/extended_template.stories.storyshot
index 298c2482e6093..997f8a24050f6 100644
--- a/x-pack/plugins/canvas/public/expression_types/arg_types/container_style/__stories__/__snapshots__/extended_template.stories.storyshot
+++ b/x-pack/plugins/canvas/public/expression_types/arg_types/container_style/__stories__/__snapshots__/extended_template.stories.storyshot
@@ -332,13 +332,11 @@ exports[`Storyshots arguments/ContainerStyle extended 1`] = `
                     <button
                       aria-haspopup="true"
                       aria-labelledby="generated-id generated-id"
-                      aria-selected={true}
                       className="euiSuperSelectControl euiSuperSelectControl--compressed"
                       onBlur={[Function]}
                       onClick={[Function]}
                       onFocus={[Function]}
                       onKeyDown={[Function]}
-                      role="option"
                       type="button"
                     >
                       <div
@@ -804,13 +802,11 @@ exports[`Storyshots arguments/ContainerStyle/components border form 1`] = `
                   <button
                     aria-haspopup="true"
                     aria-labelledby="generated-id generated-id"
-                    aria-selected={true}
                     className="euiSuperSelectControl euiSuperSelectControl--compressed"
                     onBlur={[Function]}
                     onClick={[Function]}
                     onFocus={[Function]}
                     onKeyDown={[Function]}
-                    role="option"
                     type="button"
                   >
                     <div
@@ -1288,13 +1284,11 @@ exports[`Storyshots arguments/ContainerStyle/components extended template 1`] =
                     <button
                       aria-haspopup="true"
                       aria-labelledby="generated-id generated-id"
-                      aria-selected={true}
                       className="euiSuperSelectControl euiSuperSelectControl--compressed"
                       onBlur={[Function]}
                       onClick={[Function]}
                       onFocus={[Function]}
                       onKeyDown={[Function]}
-                      role="option"
                       type="button"
                     >
                       <div
diff --git a/x-pack/plugins/canvas/server/collectors/collector.ts b/x-pack/plugins/canvas/server/collectors/collector.ts
index 48396d93d13e6..eb650ca5ad152 100644
--- a/x-pack/plugins/canvas/server/collectors/collector.ts
+++ b/x-pack/plugins/canvas/server/collectors/collector.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import { LegacyAPICaller } from 'kibana/server';
 import { TelemetryCollector } from '../../types';
 
 import { workpadCollector } from './workpad_collector';
@@ -32,7 +32,7 @@ export function registerCanvasUsageCollector(
   const canvasCollector = usageCollection.makeUsageCollector({
     type: 'canvas',
     isReady: () => true,
-    fetch: async (callCluster: CallCluster) => {
+    fetch: async (callCluster: LegacyAPICaller) => {
       const collectorResults = await Promise.all(
         collectors.map((collector) => collector(kibanaIndex, callCluster))
       );
diff --git a/x-pack/plugins/canvas/shareable_runtime/webpack.config.js b/x-pack/plugins/canvas/shareable_runtime/webpack.config.js
index 3517c958b27b8..466a7cc20a497 100644
--- a/x-pack/plugins/canvas/shareable_runtime/webpack.config.js
+++ b/x-pack/plugins/canvas/shareable_runtime/webpack.config.js
@@ -38,10 +38,6 @@ module.exports = {
         'src/plugins/data/public/expressions/interpreter'
       ),
       'kbn/interpreter': path.resolve(KIBANA_ROOT, 'packages/kbn-interpreter/target/common'),
-      'types/interpreter': path.resolve(
-        KIBANA_ROOT,
-        'src/legacy/core_plugins/interpreter/public/types'
-      ),
       tinymath: path.resolve(KIBANA_ROOT, 'node_modules/tinymath/lib/tinymath.es5.js'),
       core_app_image_assets: path.resolve(KIBANA_ROOT, 'src/core/public/core_app/images'),
     },
diff --git a/x-pack/plugins/canvas/storybook/addon/src/components/action_list.tsx b/x-pack/plugins/canvas/storybook/addon/src/components/action_list.tsx
index 9c29a44a67318..36b08f99fffe2 100644
--- a/x-pack/plugins/canvas/storybook/addon/src/components/action_list.tsx
+++ b/x-pack/plugins/canvas/storybook/addon/src/components/action_list.tsx
@@ -51,7 +51,6 @@ export const ActionList: FC<{
   }, [recordedActions]);
 
   const options: EuiSelectableOption[] = Object.values(recordedActions).map((recordedAction) => ({
-    id: recordedAction.id,
     key: recordedAction.id,
     label: recordedAction.action.type,
     checked: recordedAction.id === selectedAction?.id ? 'on' : undefined,
@@ -59,8 +58,8 @@ export const ActionList: FC<{
 
   const onChange: (selectedOptions: EuiSelectableOption[]) => void = (selectedOptions) => {
     selectedOptions.forEach((option) => {
-      if (option && option.checked && option.id) {
-        const selected = recordedActions[option.id];
+      if (option && option.checked && option.key) {
+        const selected = recordedActions[option.key];
 
         if (selected) {
           setSelectedAction(selected);
diff --git a/x-pack/plugins/canvas/types/telemetry.ts b/x-pack/plugins/canvas/types/telemetry.ts
index 0b354d7677f6e..3b635b2e57926 100644
--- a/x-pack/plugins/canvas/types/telemetry.ts
+++ b/x-pack/plugins/canvas/types/telemetry.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { LegacyAPICaller } from 'kibana/server';
 
 /**
   Function for collecting information about canvas usage
@@ -13,7 +13,7 @@ export type TelemetryCollector = (
   /** The server instance */
   kibanaIndex: string,
   /** Function for calling elasticsearch */
-  callCluster: CallCluster
+  callCluster: LegacyAPICaller
 ) => Record<string, any>;
 
 export interface TelemetryCustomElementDocument {
diff --git a/x-pack/plugins/data_enhanced/server/index.ts b/x-pack/plugins/data_enhanced/server/index.ts
index fbe1ecc10d632..3c5d5d1e99d13 100644
--- a/x-pack/plugins/data_enhanced/server/index.ts
+++ b/x-pack/plugins/data_enhanced/server/index.ts
@@ -11,4 +11,6 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new EnhancedDataServerPlugin(initializerContext);
 }
 
+export { ENHANCED_ES_SEARCH_STRATEGY } from '../common';
+
 export { EnhancedDataServerPlugin as Plugin };
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.test.ts b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.test.ts
index 4906d0342be84..64af67aefa4be 100644
--- a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.test.ts
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.test.ts
@@ -5,7 +5,6 @@
  */
 
 import { UrlDrilldown, ActionContext, Config } from './url_drilldown';
-import { coreMock } from '../../../../../../src/core/public/mocks';
 import { IEmbeddable } from '../../../../../../src/plugins/embeddable/public/lib/embeddables';
 
 const mockDataPoints = [
@@ -52,7 +51,6 @@ const mockNavigateToUrl = jest.fn(() => Promise.resolve());
 describe('UrlDrilldown', () => {
   const urlDrilldown = new UrlDrilldown({
     getGlobalScope: () => ({ kibanaUrl: 'http://localhost:5601/' }),
-    getOpenModal: () => Promise.resolve(coreMock.createStart().overlays.openModal),
     getSyntaxHelpDocsLink: () => 'http://localhost:5601/docs',
     getVariablesHelpDocsLink: () => 'http://localhost:5601/docs',
     navigateToUrl: mockNavigateToUrl,
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.tsx b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.tsx
index 80478e6490b8f..85e92d0827daa 100644
--- a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.tsx
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.tsx
@@ -5,7 +5,6 @@
  */
 
 import React from 'react';
-import { OverlayStart } from 'kibana/public';
 import { reactToUiComponent } from '../../../../../../src/plugins/kibana_react/public';
 import { ChartActionContext, IEmbeddable } from '../../../../../../src/plugins/embeddable/public';
 import { CollectConfigProps as CollectConfigPropsBase } from '../../../../../../src/plugins/kibana_utils/public';
@@ -29,7 +28,6 @@ import { txtUrlDrilldownDisplayName } from './i18n';
 interface UrlDrilldownDeps {
   getGlobalScope: () => UrlDrilldownGlobalScope;
   navigateToUrl: (url: string) => Promise<void>;
-  getOpenModal: () => Promise<OverlayStart['openModal']>;
   getSyntaxHelpDocsLink: () => string;
   getVariablesHelpDocsLink: () => string;
 }
@@ -53,6 +51,7 @@ export class UrlDrilldown implements Drilldown<Config, UrlTrigger, ActionFactory
 
   readonly minimalLicense = 'gold';
   readonly licenseFeatureName = 'URL drilldown';
+  readonly isBeta = true;
 
   public readonly getDisplayName = () => txtUrlDrilldownDisplayName;
 
@@ -112,13 +111,10 @@ export class UrlDrilldown implements Drilldown<Config, UrlTrigger, ActionFactory
   };
 
   public readonly getHref = async (config: Config, context: ActionContext) =>
-    urlDrilldownCompileUrl(config.url.template, await this.buildRuntimeScope(context));
+    urlDrilldownCompileUrl(config.url.template, this.buildRuntimeScope(context));
 
   public readonly execute = async (config: Config, context: ActionContext) => {
-    const url = await urlDrilldownCompileUrl(
-      config.url.template,
-      await this.buildRuntimeScope(context, { allowPrompts: true })
-    );
+    const url = urlDrilldownCompileUrl(config.url.template, this.buildRuntimeScope(context));
     if (config.openInNewTab) {
       window.open(url, '_blank', 'noopener');
     } else {
@@ -134,14 +130,11 @@ export class UrlDrilldown implements Drilldown<Config, UrlTrigger, ActionFactory
     });
   };
 
-  private buildRuntimeScope = async (
-    context: ActionContext,
-    opts: { allowPrompts: boolean } = { allowPrompts: false }
-  ) => {
+  private buildRuntimeScope = (context: ActionContext) => {
     return urlDrilldownBuildScope({
       globalScope: this.deps.getGlobalScope(),
       contextScope: getContextScope(context),
-      eventScope: await getEventScope(context, this.deps, opts),
+      eventScope: getEventScope(context),
     });
   };
 }
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.test.ts b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.test.ts
new file mode 100644
index 0000000000000..bb1baf5b96428
--- /dev/null
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.test.ts
@@ -0,0 +1,129 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  getEventScope,
+  getMockEventScope,
+  ValueClickTriggerEventScope,
+} from './url_drilldown_scope';
+
+const createPoint = ({
+  field,
+  value,
+}: {
+  field: string;
+  value: string | null | number | boolean;
+}) => ({
+  table: {
+    columns: [
+      {
+        name: field,
+        id: '1-1',
+        meta: {
+          type: 'histogram',
+          indexPatternId: 'logstash-*',
+          aggConfigParams: {
+            field,
+            interval: 30,
+            otherBucket: true,
+          },
+        },
+      },
+    ],
+    rows: [
+      {
+        '1-1': '2048',
+      },
+    ],
+  },
+  column: 0,
+  row: 0,
+  value,
+});
+
+describe('VALUE_CLICK_TRIGGER', () => {
+  describe('supports `points[]`', () => {
+    test('getEventScope()', () => {
+      const mockDataPoints = [
+        createPoint({ field: 'field0', value: 'value0' }),
+        createPoint({ field: 'field1', value: 'value1' }),
+        createPoint({ field: 'field2', value: 'value2' }),
+      ];
+
+      const eventScope = getEventScope({
+        data: { data: mockDataPoints },
+      }) as ValueClickTriggerEventScope;
+
+      expect(eventScope.key).toBe('field0');
+      expect(eventScope.value).toBe('value0');
+      expect(eventScope.points).toHaveLength(mockDataPoints.length);
+      expect(eventScope.points).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "key": "field0",
+            "value": "value0",
+          },
+          Object {
+            "key": "field1",
+            "value": "value1",
+          },
+          Object {
+            "key": "field2",
+            "value": "value2",
+          },
+        ]
+      `);
+    });
+
+    test('getMockEventScope()', () => {
+      const mockEventScope = getMockEventScope([
+        'VALUE_CLICK_TRIGGER',
+      ]) as ValueClickTriggerEventScope;
+      expect(mockEventScope.points.length).toBeGreaterThan(3);
+      expect(mockEventScope.points).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "key": "event.points.0.key",
+          "value": "event.points.0.value",
+        },
+        Object {
+          "key": "event.points.1.key",
+          "value": "event.points.1.value",
+        },
+        Object {
+          "key": "event.points.2.key",
+          "value": "event.points.2.value",
+        },
+        Object {
+          "key": "event.points.3.key",
+          "value": "event.points.3.value",
+        },
+      ]
+    `);
+    });
+  });
+
+  describe('handles undefined, null or missing values', () => {
+    test('undefined or missing values are removed from the result scope', () => {
+      const point = createPoint({ field: undefined } as any);
+      const eventScope = getEventScope({
+        data: { data: [point] },
+      }) as ValueClickTriggerEventScope;
+
+      expect('key' in eventScope).toBeFalsy();
+      expect('value' in eventScope).toBeFalsy();
+    });
+
+    test('null value stays in the result scope', () => {
+      const point = createPoint({ field: 'field', value: null });
+      const eventScope = getEventScope({
+        data: { data: [point] },
+      }) as ValueClickTriggerEventScope;
+
+      expect(eventScope.value).toBeNull();
+    });
+  });
+});
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.tsx b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.ts
similarity index 51%
rename from x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.tsx
rename to x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.ts
index d3e3510f1b24e..15a9a3ba77d88 100644
--- a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.tsx
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.ts
@@ -9,19 +9,7 @@
  * Please refer to ./README.md for explanation of different scope sources
  */
 
-import React from 'react';
-import {
-  EuiButton,
-  EuiButtonEmpty,
-  EuiModalBody,
-  EuiModalFooter,
-  EuiModalHeader,
-  EuiModalHeaderTitle,
-  EuiRadioGroup,
-} from '@elastic/eui';
-import uniqBy from 'lodash/uniqBy';
-import { FormattedMessage } from '@kbn/i18n/react';
-import type { Query, Filter, TimeRange } from '../../../../../../src/plugins/data/public';
+import type { Filter, Query, TimeRange } from '../../../../../../src/plugins/data/public';
 import {
   IEmbeddable,
   isRangeSelectTriggerContext,
@@ -31,8 +19,6 @@ import {
 } from '../../../../../../src/plugins/embeddable/public';
 import type { ActionContext, ActionFactoryContext, UrlTrigger } from './url_drilldown';
 import { SELECT_RANGE_TRIGGER } from '../../../../../../src/plugins/ui_actions/public';
-import { OverlayStart } from '../../../../../../src/core/public';
-import { toMountPoint } from '../../../../../../src/plugins/kibana_react/public';
 
 type ContextScopeInput = ActionContext | ActionFactoryContext;
 
@@ -113,38 +99,35 @@ export function getContextScope(contextScopeInput: ContextScopeInput): UrlDrilld
 
 /**
  * URL drilldown event scope,
- * available as: {{event.key}}, {{event.from}}
+ * available as {{event.$}}
  */
-type UrlDrilldownEventScope = ValueClickTriggerEventScope | RangeSelectTriggerEventScope;
-type EventScopeInput = ActionContext;
-interface ValueClickTriggerEventScope {
+export type UrlDrilldownEventScope = ValueClickTriggerEventScope | RangeSelectTriggerEventScope;
+export type EventScopeInput = ActionContext;
+export interface ValueClickTriggerEventScope {
   key?: string;
-  value?: string | number | boolean;
+  value: Primitive;
   negate: boolean;
+  points: Array<{ key?: string; value: Primitive }>;
 }
-interface RangeSelectTriggerEventScope {
+export interface RangeSelectTriggerEventScope {
   key: string;
   from?: string | number;
   to?: string | number;
 }
 
-export async function getEventScope(
-  eventScopeInput: EventScopeInput,
-  deps: { getOpenModal: () => Promise<OverlayStart['openModal']> },
-  opts: { allowPrompts: boolean } = { allowPrompts: false }
-): Promise<UrlDrilldownEventScope> {
+export function getEventScope(eventScopeInput: EventScopeInput): UrlDrilldownEventScope {
   if (isRangeSelectTriggerContext(eventScopeInput)) {
     return getEventScopeFromRangeSelectTriggerContext(eventScopeInput);
   } else if (isValueClickTriggerContext(eventScopeInput)) {
-    return getEventScopeFromValueClickTriggerContext(eventScopeInput, deps, opts);
+    return getEventScopeFromValueClickTriggerContext(eventScopeInput);
   } else {
     throw new Error("UrlDrilldown [getEventScope] can't build scope from not supported trigger");
   }
 }
 
-async function getEventScopeFromRangeSelectTriggerContext(
+function getEventScopeFromRangeSelectTriggerContext(
   eventScopeInput: RangeSelectContext
-): Promise<RangeSelectTriggerEventScope> {
+): RangeSelectTriggerEventScope {
   const { table, column: columnIndex, range } = eventScopeInput.data;
   const column = table.columns[columnIndex];
   return cleanEmptyKeys({
@@ -154,18 +137,23 @@ async function getEventScopeFromRangeSelectTriggerContext(
   });
 }
 
-async function getEventScopeFromValueClickTriggerContext(
-  eventScopeInput: ValueClickContext,
-  deps: { getOpenModal: () => Promise<OverlayStart['openModal']> },
-  opts: { allowPrompts: boolean } = { allowPrompts: false }
-): Promise<ValueClickTriggerEventScope> {
+function getEventScopeFromValueClickTriggerContext(
+  eventScopeInput: ValueClickContext
+): ValueClickTriggerEventScope {
   const negate = eventScopeInput.data.negate ?? false;
-  const point = await getSingleValue(eventScopeInput.data.data, deps, opts);
-  const { key, value } = getKeyValueFromPoint(point);
+  const points = eventScopeInput.data.data.map(({ table, value, column: columnIndex }) => {
+    const column = table.columns[columnIndex];
+    return {
+      value: toPrimitiveOrUndefined(value) as Primitive,
+      key: toPrimitiveOrUndefined(column?.meta?.aggConfigParams?.field) as string | undefined,
+    };
+  });
+
   return cleanEmptyKeys({
-    key,
-    value,
+    key: points[0]?.key,
+    value: points[0]?.value,
     negate,
+    points,
   });
 }
 
@@ -182,29 +170,28 @@ export function getMockEventScope([trigger]: UrlTrigger[]): UrlDrilldownEventSco
       to: new Date().toISOString(),
     };
   } else {
+    // number of mock points to generate
+    // should be larger or equal of any possible data points length emitted by VALUE_CLICK_TRIGGER
+    const nPoints = 4;
+    const points = new Array(nPoints).fill(0).map((_, index) => ({
+      key: `event.points.${index}.key`,
+      value: `event.points.${index}.value`,
+    }));
     return {
-      key: 'event.key',
-      value: 'event.value',
+      key: `event.key`,
+      value: `event.value`,
       negate: false,
+      points,
     };
   }
 }
 
-function getKeyValueFromPoint(
-  point: ValueClickContext['data']['data'][0]
-): Pick<ValueClickTriggerEventScope, 'key' | 'value'> {
-  const { table, column: columnIndex, value } = point;
-  const column = table.columns[columnIndex];
-  return {
-    key: toPrimitiveOrUndefined(column?.meta?.aggConfigParams?.field) as string | undefined,
-    value: toPrimitiveOrUndefined(value),
-  };
-}
-
-function toPrimitiveOrUndefined(v: unknown): string | number | boolean | undefined {
-  if (typeof v === 'number' || typeof v === 'boolean' || typeof v === 'string') return v;
+type Primitive = string | number | boolean | null;
+function toPrimitiveOrUndefined(v: unknown): Primitive | undefined {
+  if (typeof v === 'number' || typeof v === 'boolean' || typeof v === 'string' || v === null)
+    return v;
   if (typeof v === 'object' && v instanceof Date) return v.toISOString();
-  if (typeof v === 'undefined' || v === null) return undefined;
+  if (typeof v === 'undefined') return undefined;
   return String(v);
 }
 
@@ -216,104 +203,3 @@ function cleanEmptyKeys<T extends Record<string, any>>(obj: T): T {
   });
   return obj;
 }
-
-/**
- * VALUE_CLICK_TRIGGER could have multiple data points
- * Prompt user which data point to use in a drilldown
- */
-async function getSingleValue(
-  data: ValueClickContext['data']['data'],
-  deps: { getOpenModal: () => Promise<OverlayStart['openModal']> },
-  opts: { allowPrompts: boolean } = { allowPrompts: false }
-): Promise<ValueClickContext['data']['data'][0]> {
-  data = uniqBy(data.filter(Boolean), (point) => {
-    const { key, value } = getKeyValueFromPoint(point);
-    return `${key}:${value}`;
-  });
-  if (data.length === 0)
-    throw new Error(`[trigger = "VALUE_CLICK_TRIGGER"][getSingleValue] no value to pick from`);
-  if (data.length === 1) return Promise.resolve(data[0]);
-  if (!opts.allowPrompts) return Promise.resolve(data[0]);
-  return new Promise(async (resolve, reject) => {
-    const openModal = await deps.getOpenModal();
-    const overlay = openModal(
-      toMountPoint(
-        <GetSingleValuePopup
-          onCancel={() => overlay.close()}
-          onSubmit={(point) => {
-            if (point) {
-              resolve(point);
-            }
-            overlay.close();
-          }}
-          data={data}
-        />
-      )
-    );
-    overlay.onClose.then(() => reject());
-  });
-}
-
-function GetSingleValuePopup({
-  data,
-  onCancel,
-  onSubmit,
-}: {
-  data: ValueClickContext['data']['data'];
-  onCancel: () => void;
-  onSubmit: (value: ValueClickContext['data']['data'][0]) => void;
-}) {
-  const values = data
-    .map((point) => {
-      const { key, value } = getKeyValueFromPoint(point);
-      return {
-        point,
-        id: key ?? '',
-        label: `${key}:${value}`,
-      };
-    })
-    .filter((value) => Boolean(value.id));
-
-  const [selectedValueId, setSelectedValueId] = React.useState(values[0].id);
-
-  return (
-    <React.Fragment>
-      <EuiModalHeader>
-        <EuiModalHeaderTitle>
-          <FormattedMessage
-            id="xpack.embeddableEnhanced.drilldowns.pickSingleValuePopup.popupHeader"
-            defaultMessage="Select a value to drill down into"
-          />
-        </EuiModalHeaderTitle>
-      </EuiModalHeader>
-
-      <EuiModalBody>
-        <EuiRadioGroup
-          options={values}
-          idSelected={selectedValueId}
-          onChange={(id) => setSelectedValueId(id)}
-          name="drilldownValues"
-        />
-      </EuiModalBody>
-
-      <EuiModalFooter>
-        <EuiButtonEmpty onClick={onCancel}>
-          <FormattedMessage
-            id="xpack.embeddableEnhanced.drilldowns.pickSingleValuePopup.cancelButtonLabel"
-            defaultMessage="Cancel"
-          />
-        </EuiButtonEmpty>
-        <EuiButton
-          onClick={() => onSubmit(values.find((v) => v.id === selectedValueId)?.point!)}
-          data-test-subj="applySingleValuePopoverButton"
-          fill
-        >
-          <FormattedMessage
-            id="xpack.embeddableEnhanced.drilldowns.pickSingleValuePopup.applyButtonLabel"
-            defaultMessage="Apply"
-          />
-        </EuiButton>
-      </EuiModalFooter>
-    </React.Fragment>
-  );
-}
diff --git a/x-pack/plugins/embeddable_enhanced/public/plugin.ts b/x-pack/plugins/embeddable_enhanced/public/plugin.ts
index 187db998e06ea..2138a372523b7 100644
--- a/x-pack/plugins/embeddable_enhanced/public/plugin.ts
+++ b/x-pack/plugins/embeddable_enhanced/public/plugin.ts
@@ -74,7 +74,6 @@ export class EmbeddableEnhancedPlugin
         getGlobalScope: urlDrilldownGlobalScopeProvider({ core }),
         navigateToUrl: (url: string) =>
           core.getStartServices().then(([{ application }]) => application.navigateToUrl(url)),
-        getOpenModal: () => core.getStartServices().then(([{ overlays }]) => overlays.openModal),
         getSyntaxHelpDocsLink: () =>
           startServices().core.docLinks.links.dashboard.urlDrilldownTemplateSyntax,
         getVariablesHelpDocsLink: () =>
diff --git a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts
index 18834f55af0a5..e516ab1cb73b3 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts
@@ -82,6 +82,58 @@ describe('#create', () => {
     expect(mockBaseClient.create).not.toHaveBeenCalled();
   });
 
+  it('allows a specified ID when overwriting an existing object', async () => {
+    const attributes = {
+      attrOne: 'one',
+      attrSecret: 'secret',
+      attrNotSoSecret: 'not-so-secret',
+      attrThree: 'three',
+    };
+    const options = { id: 'predefined-uuid', overwrite: true, version: 'some-version' };
+    const mockedResponse = {
+      id: 'predefined-uuid',
+      type: 'known-type',
+      attributes: {
+        attrOne: 'one',
+        attrSecret: '*secret*',
+        attrNotSoSecret: '*not-so-secret*',
+        attrThree: 'three',
+      },
+      references: [],
+    };
+
+    mockBaseClient.create.mockResolvedValue(mockedResponse);
+
+    expect(await wrapper.create('known-type', attributes, options)).toEqual({
+      ...mockedResponse,
+      attributes: { attrOne: 'one', attrNotSoSecret: 'not-so-secret', attrThree: 'three' },
+    });
+
+    expect(encryptedSavedObjectsServiceMockInstance.encryptAttributes).toHaveBeenCalledTimes(1);
+    expect(encryptedSavedObjectsServiceMockInstance.encryptAttributes).toHaveBeenCalledWith(
+      { type: 'known-type', id: 'predefined-uuid' },
+      {
+        attrOne: 'one',
+        attrSecret: 'secret',
+        attrNotSoSecret: 'not-so-secret',
+        attrThree: 'three',
+      },
+      { user: mockAuthenticatedUser() }
+    );
+
+    expect(mockBaseClient.create).toHaveBeenCalledTimes(1);
+    expect(mockBaseClient.create).toHaveBeenCalledWith(
+      'known-type',
+      {
+        attrOne: 'one',
+        attrSecret: '*secret*',
+        attrNotSoSecret: '*not-so-secret*',
+        attrThree: 'three',
+      },
+      { id: 'predefined-uuid', overwrite: true, version: 'some-version' }
+    );
+  });
+
   it('generates ID, encrypts attributes and strips them from response except for ones with `dangerouslyExposeValue` set to `true`', async () => {
     const attributes = {
       attrOne: 'one',
@@ -262,6 +314,77 @@ describe('#bulkCreate', () => {
     expect(mockBaseClient.bulkCreate).not.toHaveBeenCalled();
   });
 
+  it('allows a specified ID when overwriting an existing object', async () => {
+    const attributes = {
+      attrOne: 'one',
+      attrSecret: 'secret',
+      attrNotSoSecret: 'not-so-secret',
+      attrThree: 'three',
+    };
+    const mockedResponse = {
+      saved_objects: [
+        {
+          id: 'predefined-uuid',
+          type: 'known-type',
+          attributes: { ...attributes, attrSecret: '*secret*', attrNotSoSecret: '*not-so-secret*' },
+          references: [],
+        },
+        {
+          id: 'some-id',
+          type: 'unknown-type',
+          attributes,
+          references: [],
+        },
+      ],
+    };
+
+    mockBaseClient.bulkCreate.mockResolvedValue(mockedResponse);
+
+    const bulkCreateParams = [
+      { id: 'predefined-uuid', type: 'known-type', attributes, version: 'some-version' },
+      { type: 'unknown-type', attributes },
+    ];
+
+    await expect(wrapper.bulkCreate(bulkCreateParams, { overwrite: true })).resolves.toEqual({
+      saved_objects: [
+        {
+          ...mockedResponse.saved_objects[0],
+          attributes: { attrOne: 'one', attrNotSoSecret: 'not-so-secret', attrThree: 'three' },
+        },
+        mockedResponse.saved_objects[1],
+      ],
+    });
+
+    expect(encryptedSavedObjectsServiceMockInstance.encryptAttributes).toHaveBeenCalledTimes(1);
+    expect(encryptedSavedObjectsServiceMockInstance.encryptAttributes).toHaveBeenCalledWith(
+      { type: 'known-type', id: 'predefined-uuid' },
+      {
+        attrOne: 'one',
+        attrSecret: 'secret',
+        attrNotSoSecret: 'not-so-secret',
+        attrThree: 'three',
+      },
+      { user: mockAuthenticatedUser() }
+    );
+
+    expect(mockBaseClient.bulkCreate).toHaveBeenCalledTimes(1);
+    expect(mockBaseClient.bulkCreate).toHaveBeenCalledWith(
+      [
+        {
+          ...bulkCreateParams[0],
+          attributes: {
+            attrOne: 'one',
+            attrSecret: '*secret*',
+            attrNotSoSecret: '*not-so-secret*',
+            attrThree: 'three',
+          },
+        },
+        bulkCreateParams[1],
+      ],
+      { overwrite: true }
+    );
+  });
+
   it('generates ID, encrypts attributes and strips them from response except for ones with `dangerouslyExposeValue` set to `true`', async () => {
     const attributes = {
       attrOne: 'one',
diff --git a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.ts b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.ts
index 0eeb9943b5be9..eef389186d670 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.ts
@@ -68,13 +68,18 @@ export class EncryptedSavedObjectsClientWrapper implements SavedObjectsClientCon
     // Saved objects with encrypted attributes should have IDs that are hard to guess especially
     // since IDs are part of the AAD used during encryption, that's why we control them within this
     // wrapper and don't allow consumers to specify their own IDs directly.
-    if (options.id) {
+
+    // only allow a specified ID if we're overwriting an existing ESO with a Version
+    // this helps us ensure that the document really was previously created using ESO
+    // and not being used to get around the specified ID limitation
+    const canSpecifyID = options.overwrite && options.version;
+    if (options.id && !canSpecifyID) {
       throw new Error(
         'Predefined IDs are not allowed for saved objects with encrypted attributes.'
       );
     }
 
-    const id = generateID();
+    const id = options.id ?? generateID();
     const namespace = getDescriptorNamespace(
       this.options.baseTypeRegistry,
       type,
@@ -97,7 +102,7 @@ export class EncryptedSavedObjectsClientWrapper implements SavedObjectsClientCon
 
   public async bulkCreate<T>(
     objects: Array<SavedObjectsBulkCreateObject<T>>,
-    options?: SavedObjectsBaseOptions
+    options?: SavedObjectsBaseOptions & Pick<SavedObjectsCreateOptions, 'overwrite'>
   ) {
     // We encrypt attributes for every object in parallel and that can potentially exhaust libuv or
     // NodeJS thread pool. If it turns out to be a problem, we can consider switching to the
@@ -110,14 +115,15 @@ export class EncryptedSavedObjectsClientWrapper implements SavedObjectsClientCon
 
         // Saved objects with encrypted attributes should have IDs that are hard to guess especially
         // since IDs are part of the AAD used during encryption, that's why we control them within this
-        // wrapper and don't allow consumers to specify their own IDs directly.
-        if (object.id) {
+        // wrapper and don't allow consumers to specify their own IDs directly unless overwriting the original document.
+        const canSpecifyID = options?.overwrite && object.version;
+        if (object.id && !canSpecifyID) {
           throw new Error(
             'Predefined IDs are not allowed for saved objects with encrypted attributes.'
           );
         }
 
-        const id = generateID();
+        const id = object.id ?? generateID();
         const namespace = getDescriptorNamespace(
           this.options.baseTypeRegistry,
           object.type,
diff --git a/x-pack/plugins/enterprise_search/README.md b/x-pack/plugins/enterprise_search/README.md
index 31ee304fe2247..ba14be5564be1 100644
--- a/x-pack/plugins/enterprise_search/README.md
+++ b/x-pack/plugins/enterprise_search/README.md
@@ -13,6 +13,14 @@ This plugin's goal is to provide a Kibana user interface to the Enterprise Searc
 2. Update `config/kibana.dev.yml` with `enterpriseSearch.host: 'http://localhost:3002'`
 3. For faster QA/development, run Enterprise Search on [elasticsearch-native auth](https://www.elastic.co/guide/en/app-search/current/security-and-users.html#app-search-self-managed-security-and-user-management-elasticsearch-native-realm) and log in as the `elastic` superuser on Kibana.
 
+### Kea
+
+Enterprise Search uses [Kea.js](https://github.com/keajs/kea) to manage our React/Redux state for us. Kea state is handled in our `*Logic` files and exposes [values](https://kea.js.org/docs/guide/concepts#values) and [actions](https://kea.js.org/docs/guide/concepts#actions) for our components to get and set state with.
+
+#### Debugging Kea
+
+To debug Kea state in-browser, Kea recommends [Redux Devtools](https://kea.js.org/docs/guide/debugging). To facilitate debugging, we use the [path](https://kea.js.org/docs/guide/debugging/#setting-the-path-manually) key with `snake_case`d paths. The path key should always end with the logic filename (e.g. `['enterprise_search', 'some_logic']`) to make it easy for devs to quickly find/jump to files via IDE tooling.
+
 ## Testing
 
 ### Unit tests
diff --git a/x-pack/plugins/enterprise_search/common/constants.ts b/x-pack/plugins/enterprise_search/common/constants.ts
index d6a51e8b482d0..5df25f11e5070 100644
--- a/x-pack/plugins/enterprise_search/common/constants.ts
+++ b/x-pack/plugins/enterprise_search/common/constants.ts
@@ -76,4 +76,6 @@ export const JSON_HEADER = {
   Accept: 'application/json', // Required for Enterprise Search APIs
 };
 
+export const READ_ONLY_MODE_HEADER = 'x-ent-search-read-only-mode';
+
 export const ENGINES_PAGE_SIZE = 10;
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/app_logic.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/app_logic.ts
index 3f71759390879..9388d61041b13 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/app_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/app_logic.ts
@@ -16,6 +16,7 @@ export interface IAppActions {
 }
 
 export const AppLogic = kea<MakeLogicType<IAppValues, IAppActions>>({
+  path: ['enterprise_search', 'app_search', 'app_logic'],
   actions: {
     initializeAppData: (props) => props,
   },
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/index.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/index.test.tsx
index 94e9127bbed74..31c7680fd2f1c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/index.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/index.test.tsx
@@ -54,6 +54,7 @@ describe('AppSearchConfigured', () => {
     const wrapper = shallow(<AppSearchConfigured />);
 
     expect(wrapper.find(Layout)).toHaveLength(1);
+    expect(wrapper.find(Layout).prop('readOnlyMode')).toBeFalsy();
     expect(wrapper.find(EngineOverview)).toHaveLength(1);
   });
 
@@ -61,9 +62,9 @@ describe('AppSearchConfigured', () => {
     const initializeAppData = jest.fn();
     (useActions as jest.Mock).mockImplementation(() => ({ initializeAppData }));
 
-    shallow(<AppSearchConfigured readOnlyMode={true} />);
+    shallow(<AppSearchConfigured ilmEnabled={true} />);
 
-    expect(initializeAppData).toHaveBeenCalledWith({ readOnlyMode: true });
+    expect(initializeAppData).toHaveBeenCalledWith({ ilmEnabled: true });
   });
 
   it('does not re-initialize app data', () => {
@@ -83,6 +84,14 @@ describe('AppSearchConfigured', () => {
 
     expect(wrapper.find(ErrorConnecting)).toHaveLength(1);
   });
+
+  it('passes readOnlyMode state', () => {
+    (useValues as jest.Mock).mockImplementation(() => ({ readOnlyMode: true }));
+
+    const wrapper = shallow(<AppSearchConfigured />);
+
+    expect(wrapper.find(Layout).prop('readOnlyMode')).toEqual(true);
+  });
 });
 
 describe('AppSearchNav', () => {
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx
index c4a366930d22a..643c4b5ccc873 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx
@@ -51,7 +51,7 @@ export const AppSearchUnconfigured: React.FC = () => (
 export const AppSearchConfigured: React.FC<IInitialAppData> = (props) => {
   const { hasInitialized } = useValues(AppLogic);
   const { initializeAppData } = useActions(AppLogic);
-  const { errorConnecting } = useValues(HttpLogic);
+  const { errorConnecting, readOnlyMode } = useValues(HttpLogic);
 
   useEffect(() => {
     if (!hasInitialized) initializeAppData(props);
@@ -63,7 +63,7 @@ export const AppSearchConfigured: React.FC<IInitialAppData> = (props) => {
         <SetupGuide />
       </Route>
       <Route>
-        <Layout navigation={<AppSearchNav />}>
+        <Layout navigation={<AppSearchNav />} readOnlyMode={readOnlyMode}>
           {errorConnecting ? (
             <ErrorConnecting />
           ) : (
diff --git a/x-pack/plugins/enterprise_search/public/applications/index.tsx b/x-pack/plugins/enterprise_search/public/applications/index.tsx
index a54295548004a..82f884644be4a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/index.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/index.tsx
@@ -69,7 +69,11 @@ export const renderApp = (
       >
         <LicenseProvider license$={plugins.licensing.license$}>
           <Provider store={store}>
-            <HttpProvider http={core.http} errorConnecting={errorConnecting} />
+            <HttpProvider
+              http={core.http}
+              errorConnecting={errorConnecting}
+              readOnlyMode={initialData.readOnlyMode}
+            />
             <FlashMessagesProvider history={params.history} />
             <Router history={params.history}>
               <App {...initialData} />
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/flash_messages_logic.ts b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/flash_messages_logic.ts
index 3ae48f352b2c1..37a8f16acad6d 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/flash_messages_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/flash_messages_logic.ts
@@ -32,6 +32,7 @@ const convertToArray = (messages: IFlashMessage | IFlashMessage[]) =>
   !Array.isArray(messages) ? [messages] : messages;
 
 export const FlashMessagesLogic = kea<MakeLogicType<IFlashMessagesValues, IFlashMessagesActions>>({
+  path: ['enterprise_search', 'flash_messages_logic'],
   actions: {
     setFlashMessages: (messages) => ({ messages: convertToArray(messages) }),
     clearFlashMessages: () => null,
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/handle_api_errors.test.ts b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/handle_api_errors.test.ts
index 6f2aec757eb37..c30631329b79d 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/handle_api_errors.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/handle_api_errors.test.ts
@@ -52,6 +52,20 @@ describe('flashAPIErrors', () => {
     ]);
   });
 
+  it('falls back to the basic message for http responses without an errors array', () => {
+    flashAPIErrors({
+      body: {
+        statusCode: 404,
+        error: 'Not Found',
+        message: 'Not Found',
+      },
+    } as any);
+
+    expect(FlashMessagesLogic.actions.setFlashMessages).toHaveBeenCalledWith([
+      { type: 'error', message: 'Not Found' },
+    ]);
+  });
+
   it('displays a generic error message and re-throws non-API errors', () => {
     try {
       flashAPIErrors(Error('whatever') as any);
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/handle_api_errors.ts b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/handle_api_errors.ts
index 5e56c4fb0bd22..2bd04d1d87f7d 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/handle_api_errors.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/handle_api_errors.ts
@@ -40,7 +40,7 @@ export const flashAPIErrors = (
 
   const errorFlashMessages: IFlashMessage[] = Array.isArray(error?.body?.attributes?.errors)
     ? error.body!.attributes.errors.map((message) => ({ type: 'error', message }))
-    : [{ type: 'error', message: defaultErrorMessage }];
+    : [{ type: 'error', message: error?.body?.message || defaultErrorMessage }];
 
   if (isQueued) {
     FlashMessagesLogic.actions.setQueuedMessages(errorFlashMessages);
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/index.ts b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/index.ts
index 74e233ad6b320..c4daeb44420c8 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/index.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/index.ts
@@ -12,3 +12,5 @@ export {
   IFlashMessagesActions,
 } from './flash_messages_logic';
 export { FlashMessagesProvider } from './flash_messages_provider';
+export { flashAPIErrors } from './handle_api_errors';
+export { setSuccessMessage, setErrorMessage, setQueuedSuccessMessage } from './set_message_helpers';
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/set_message_helpers.test.ts b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/set_message_helpers.test.ts
new file mode 100644
index 0000000000000..c3c60d77f4577
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/set_message_helpers.test.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  FlashMessagesLogic,
+  setSuccessMessage,
+  setErrorMessage,
+  setQueuedSuccessMessage,
+} from './';
+
+describe('Flash Message Helpers', () => {
+  const message = 'I am a message';
+
+  beforeEach(() => {
+    FlashMessagesLogic.mount();
+  });
+
+  it('setSuccessMessage()', () => {
+    setSuccessMessage(message);
+
+    expect(FlashMessagesLogic.values.messages).toEqual([
+      {
+        message,
+        type: 'success',
+      },
+    ]);
+  });
+
+  it('setErrorMessage()', () => {
+    setErrorMessage(message);
+
+    expect(FlashMessagesLogic.values.messages).toEqual([
+      {
+        message,
+        type: 'error',
+      },
+    ]);
+  });
+
+  it('setQueuedSuccessMessage()', () => {
+    setQueuedSuccessMessage(message);
+
+    expect(FlashMessagesLogic.values.queuedMessages).toEqual([
+      {
+        message,
+        type: 'success',
+      },
+    ]);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/set_message_helpers.ts b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/set_message_helpers.ts
new file mode 100644
index 0000000000000..6abb540b7c14b
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/set_message_helpers.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FlashMessagesLogic } from './';
+
+export const setSuccessMessage = (message: string) => {
+  FlashMessagesLogic.actions.setFlashMessages({
+    type: 'success',
+    message,
+  });
+};
+
+export const setErrorMessage = (message: string) => {
+  FlashMessagesLogic.actions.setFlashMessages({
+    type: 'error',
+    message,
+  });
+};
+
+export const setQueuedSuccessMessage = (message: string) => {
+  FlashMessagesLogic.actions.setQueuedMessages({
+    type: 'success',
+    message,
+  });
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/http/http_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/shared/http/http_logic.test.ts
index c032e3b04ebe6..b65499be2f7c0 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/http/http_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/http/http_logic.test.ts
@@ -16,6 +16,7 @@ describe('HttpLogic', () => {
     http: null,
     httpInterceptors: [],
     errorConnecting: false,
+    readOnlyMode: false,
   };
 
   beforeEach(() => {
@@ -31,12 +32,17 @@ describe('HttpLogic', () => {
   describe('initializeHttp()', () => {
     it('sets values based on passed props', () => {
       HttpLogic.mount();
-      HttpLogic.actions.initializeHttp({ http: mockHttp, errorConnecting: true });
+      HttpLogic.actions.initializeHttp({
+        http: mockHttp,
+        errorConnecting: true,
+        readOnlyMode: true,
+      });
 
       expect(HttpLogic.values).toEqual({
         http: mockHttp,
         httpInterceptors: [],
         errorConnecting: true,
+        readOnlyMode: true,
       });
     });
   });
@@ -52,50 +58,110 @@ describe('HttpLogic', () => {
     });
   });
 
+  describe('setReadOnlyMode()', () => {
+    it('sets readOnlyMode value', () => {
+      HttpLogic.mount();
+      HttpLogic.actions.setReadOnlyMode(true);
+      expect(HttpLogic.values.readOnlyMode).toEqual(true);
+
+      HttpLogic.actions.setReadOnlyMode(false);
+      expect(HttpLogic.values.readOnlyMode).toEqual(false);
+    });
+  });
+
   describe('http interceptors', () => {
     describe('initializeHttpInterceptors()', () => {
       beforeEach(() => {
         HttpLogic.mount();
         jest.spyOn(HttpLogic.actions, 'setHttpInterceptors');
-        jest.spyOn(HttpLogic.actions, 'setErrorConnecting');
         HttpLogic.actions.initializeHttp({ http: mockHttp });
-
         HttpLogic.actions.initializeHttpInterceptors();
       });
 
       it('calls http.intercept and sets an array of interceptors', () => {
-        mockHttp.intercept.mockImplementationOnce(() => 'removeInterceptorFn' as any);
+        mockHttp.intercept
+          .mockImplementationOnce(() => 'removeErrorInterceptorFn' as any)
+          .mockImplementationOnce(() => 'removeReadOnlyInterceptorFn' as any);
         HttpLogic.actions.initializeHttpInterceptors();
 
         expect(mockHttp.intercept).toHaveBeenCalled();
-        expect(HttpLogic.actions.setHttpInterceptors).toHaveBeenCalledWith(['removeInterceptorFn']);
+        expect(HttpLogic.actions.setHttpInterceptors).toHaveBeenCalledWith([
+          'removeErrorInterceptorFn',
+          'removeReadOnlyInterceptorFn',
+        ]);
       });
 
       describe('errorConnectingInterceptor', () => {
+        let interceptedResponse: any;
+
+        beforeEach(() => {
+          interceptedResponse = mockHttp.intercept.mock.calls[0][0].responseError;
+          jest.spyOn(HttpLogic.actions, 'setErrorConnecting');
+        });
+
         it('handles errors connecting to Enterprise Search', async () => {
-          const { responseError } = mockHttp.intercept.mock.calls[0][0] as any;
-          const httpResponse = { response: { url: '/api/app_search/engines', status: 502 } };
-          await expect(responseError(httpResponse)).rejects.toEqual(httpResponse);
+          const httpResponse = {
+            response: { url: '/api/app_search/engines', status: 502 },
+          };
+          await expect(interceptedResponse(httpResponse)).rejects.toEqual(httpResponse);
 
           expect(HttpLogic.actions.setErrorConnecting).toHaveBeenCalled();
         });
 
         it('does not handle non-502 Enterprise Search errors', async () => {
-          const { responseError } = mockHttp.intercept.mock.calls[0][0] as any;
-          const httpResponse = { response: { url: '/api/workplace_search/overview', status: 404 } };
-          await expect(responseError(httpResponse)).rejects.toEqual(httpResponse);
+          const httpResponse = {
+            response: { url: '/api/workplace_search/overview', status: 404 },
+          };
+          await expect(interceptedResponse(httpResponse)).rejects.toEqual(httpResponse);
 
           expect(HttpLogic.actions.setErrorConnecting).not.toHaveBeenCalled();
         });
 
-        it('does not handle errors for unrelated calls', async () => {
-          const { responseError } = mockHttp.intercept.mock.calls[0][0] as any;
-          const httpResponse = { response: { url: '/api/some_other_plugin/', status: 502 } };
-          await expect(responseError(httpResponse)).rejects.toEqual(httpResponse);
+        it('does not handle errors for non-Enterprise Search API calls', async () => {
+          const httpResponse = {
+            response: { url: '/api/some_other_plugin/', status: 502 },
+          };
+          await expect(interceptedResponse(httpResponse)).rejects.toEqual(httpResponse);
 
           expect(HttpLogic.actions.setErrorConnecting).not.toHaveBeenCalled();
         });
       });
+
+      describe('readOnlyModeInterceptor', () => {
+        let interceptedResponse: any;
+
+        beforeEach(() => {
+          interceptedResponse = mockHttp.intercept.mock.calls[1][0].response;
+          jest.spyOn(HttpLogic.actions, 'setReadOnlyMode');
+        });
+
+        it('sets readOnlyMode to true if the response header is true', async () => {
+          const httpResponse = {
+            response: { url: '/api/app_search/engines', headers: { get: () => 'true' } },
+          };
+          await expect(interceptedResponse(httpResponse)).resolves.toEqual(httpResponse);
+
+          expect(HttpLogic.actions.setReadOnlyMode).toHaveBeenCalledWith(true);
+        });
+
+        it('sets readOnlyMode to false if the response header is false', async () => {
+          const httpResponse = {
+            response: { url: '/api/workplace_search/overview', headers: { get: () => 'false' } },
+          };
+          await expect(interceptedResponse(httpResponse)).resolves.toEqual(httpResponse);
+
+          expect(HttpLogic.actions.setReadOnlyMode).toHaveBeenCalledWith(false);
+        });
+
+        it('does not handle headers for non-Enterprise Search API calls', async () => {
+          const httpResponse = {
+            response: { url: '/api/some_other_plugin/', headers: { get: () => 'true' } },
+          };
+          await expect(interceptedResponse(httpResponse)).resolves.toEqual(httpResponse);
+
+          expect(HttpLogic.actions.setReadOnlyMode).not.toHaveBeenCalled();
+        });
+      });
     });
 
     it('sets httpInterceptors and calls all valid remove functions on unmount', () => {
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/http/http_logic.ts b/x-pack/plugins/enterprise_search/public/applications/shared/http/http_logic.ts
index ec9db30ddef3b..72380142fe399 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/http/http_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/http/http_logic.ts
@@ -6,32 +6,33 @@
 
 import { kea, MakeLogicType } from 'kea';
 
-import { HttpSetup, HttpInterceptorResponseError } from 'src/core/public';
+import { HttpSetup, HttpInterceptorResponseError, HttpResponse } from 'src/core/public';
+import { IHttpProviderProps } from './http_provider';
+
+import { READ_ONLY_MODE_HEADER } from '../../../../common/constants';
 
 export interface IHttpValues {
   http: HttpSetup;
   httpInterceptors: Function[];
   errorConnecting: boolean;
+  readOnlyMode: boolean;
 }
 export interface IHttpActions {
-  initializeHttp({
-    http,
-    errorConnecting,
-  }: {
-    http: HttpSetup;
-    errorConnecting?: boolean;
-  }): { http: HttpSetup; errorConnecting?: boolean };
+  initializeHttp({ http, errorConnecting, readOnlyMode }: IHttpProviderProps): IHttpProviderProps;
   initializeHttpInterceptors(): void;
   setHttpInterceptors(httpInterceptors: Function[]): { httpInterceptors: Function[] };
   setErrorConnecting(errorConnecting: boolean): { errorConnecting: boolean };
+  setReadOnlyMode(readOnlyMode: boolean): { readOnlyMode: boolean };
 }
 
 export const HttpLogic = kea<MakeLogicType<IHttpValues, IHttpActions>>({
+  path: ['enterprise_search', 'http_logic'],
   actions: {
-    initializeHttp: ({ http, errorConnecting }) => ({ http, errorConnecting }),
+    initializeHttp: (props) => props,
     initializeHttpInterceptors: () => null,
     setHttpInterceptors: (httpInterceptors) => ({ httpInterceptors }),
     setErrorConnecting: (errorConnecting) => ({ errorConnecting }),
+    setReadOnlyMode: (readOnlyMode) => ({ readOnlyMode }),
   },
   reducers: {
     http: [
@@ -53,6 +54,13 @@ export const HttpLogic = kea<MakeLogicType<IHttpValues, IHttpActions>>({
         setErrorConnecting: (_, { errorConnecting }) => errorConnecting,
       },
     ],
+    readOnlyMode: [
+      false,
+      {
+        initializeHttp: (_, { readOnlyMode }) => !!readOnlyMode,
+        setReadOnlyMode: (_, { readOnlyMode }) => readOnlyMode,
+      },
+    ],
   },
   listeners: ({ values, actions }) => ({
     initializeHttpInterceptors: () => {
@@ -60,13 +68,13 @@ export const HttpLogic = kea<MakeLogicType<IHttpValues, IHttpActions>>({
 
       const errorConnectingInterceptor = values.http.intercept({
         responseError: async (httpResponse) => {
-          const { url, status } = httpResponse.response!;
-          const hasErrorConnecting = status === 502;
-          const isApiResponse =
-            url.includes('/api/app_search/') || url.includes('/api/workplace_search/');
+          if (isEnterpriseSearchApi(httpResponse)) {
+            const { status } = httpResponse.response!;
+            const hasErrorConnecting = status === 502;
 
-          if (isApiResponse && hasErrorConnecting) {
-            actions.setErrorConnecting(true);
+            if (hasErrorConnecting) {
+              actions.setErrorConnecting(true);
+            }
           }
 
           // Re-throw error so that downstream catches work as expected
@@ -75,7 +83,23 @@ export const HttpLogic = kea<MakeLogicType<IHttpValues, IHttpActions>>({
       });
       httpInterceptors.push(errorConnectingInterceptor);
 
-      // TODO: Read only mode interceptor
+      const readOnlyModeInterceptor = values.http.intercept({
+        response: async (httpResponse) => {
+          if (isEnterpriseSearchApi(httpResponse)) {
+            const readOnlyMode = httpResponse.response!.headers.get(READ_ONLY_MODE_HEADER);
+
+            if (readOnlyMode === 'true') {
+              actions.setReadOnlyMode(true);
+            } else {
+              actions.setReadOnlyMode(false);
+            }
+          }
+
+          return Promise.resolve(httpResponse);
+        },
+      });
+      httpInterceptors.push(readOnlyModeInterceptor);
+
       actions.setHttpInterceptors(httpInterceptors);
     },
   }),
@@ -87,3 +111,11 @@ export const HttpLogic = kea<MakeLogicType<IHttpValues, IHttpActions>>({
     },
   }),
 });
+
+/**
+ * Small helper that checks whether or not an http call is for an Enterprise Search API
+ */
+const isEnterpriseSearchApi = (httpResponse: HttpResponse) => {
+  const { url } = httpResponse.response!;
+  return url.includes('/api/app_search/') || url.includes('/api/workplace_search/');
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/http/http_provider.test.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/http/http_provider.test.tsx
index 81106235780d6..902c910f10d7c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/http/http_provider.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/http/http_provider.test.tsx
@@ -17,6 +17,7 @@ describe('HttpProvider', () => {
   const props = {
     http: {} as any,
     errorConnecting: false,
+    readOnlyMode: false,
   };
   const initializeHttp = jest.fn();
   const initializeHttpInterceptors = jest.fn();
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/http/http_provider.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/http/http_provider.tsx
index 4c2160195a1af..db1b0d611079a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/http/http_provider.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/http/http_provider.tsx
@@ -11,9 +11,10 @@ import { HttpSetup } from 'src/core/public';
 
 import { HttpLogic } from './http_logic';
 
-interface IHttpProviderProps {
+export interface IHttpProviderProps {
   http: HttpSetup;
   errorConnecting?: boolean;
+  readOnlyMode?: boolean;
 }
 
 export const HttpProvider: React.FC<IHttpProviderProps> = (props) => {
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.scss b/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.scss
index c73a527147961..e867e9cf5a445 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.scss
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.scss
@@ -7,8 +7,12 @@
 .enterpriseSearchLayout {
   $sideBarWidth: $euiSize * 15;
   $sideBarMobileHeight: $euiSize * 4.75;
+  $consoleHeaderHeight: 98px; // NOTE: Keep an eye on this for changes
+  $pageHeight: calc(100vh - #{$consoleHeaderHeight});
 
   display: block;
+  background-color: $euiColorEmptyShade;
+  min-height: $pageHeight;
   position: relative;
   left: $sideBarWidth;
   width: calc(100% - #{$sideBarWidth});
@@ -44,8 +48,7 @@
     overflow-y: auto;
     overflow-x: hidden;
 
-    $kibanaHeader: 49px; // NOTE: Keep an eye on this for changes
-    height: calc(100vh - #{$kibanaHeader});
+    height: $pageHeight;
     width: $sideBarWidth;
 
     background-color: $euiColorLightestShade;
@@ -78,4 +81,15 @@
       padding: $euiSize;
     }
   }
+
+  &__readOnlyMode {
+    margin: -$euiSizeM 0 $euiSizeL;
+
+    @include euiBreakpoint('m') {
+      margin: 0 0 $euiSizeL;
+    }
+    @include euiBreakpoint('xs', 's') {
+      margin: 0;
+    }
+  }
 }
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.test.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.test.tsx
index 623e6e47167d2..7b876d81527fa 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.test.tsx
@@ -6,7 +6,7 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
-import { EuiPageSideBar, EuiButton, EuiPageBody } from '@elastic/eui';
+import { EuiPageSideBar, EuiButton, EuiPageBody, EuiCallOut } from '@elastic/eui';
 
 import { Layout, INavContext } from './layout';
 
@@ -55,6 +55,12 @@ describe('Layout', () => {
     expect(wrapper.find(EuiPageSideBar).prop('className')).not.toContain('--isOpen');
   });
 
+  it('renders a read-only mode callout', () => {
+    const wrapper = shallow(<Layout navigation={null} readOnlyMode={true} />);
+
+    expect(wrapper.find(EuiCallOut)).toHaveLength(1);
+  });
+
   it('renders children', () => {
     const wrapper = shallow(
       <Layout navigation={null}>
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.tsx
index e122c4d5cfdfa..ef8216e8b6711 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.tsx
@@ -7,7 +7,7 @@
 import React, { useState } from 'react';
 import classNames from 'classnames';
 
-import { EuiPage, EuiPageSideBar, EuiPageBody, EuiButton } from '@elastic/eui';
+import { EuiPage, EuiPageSideBar, EuiPageBody, EuiButton, EuiCallOut } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
 import './layout.scss';
@@ -15,6 +15,7 @@ import './layout.scss';
 interface ILayoutProps {
   navigation: React.ReactNode;
   restrictWidth?: boolean;
+  readOnlyMode?: boolean;
 }
 
 export interface INavContext {
@@ -22,7 +23,12 @@ export interface INavContext {
 }
 export const NavContext = React.createContext({});
 
-export const Layout: React.FC<ILayoutProps> = ({ children, navigation, restrictWidth }) => {
+export const Layout: React.FC<ILayoutProps> = ({
+  children,
+  navigation,
+  restrictWidth,
+  readOnlyMode,
+}) => {
   const [isNavOpen, setIsNavOpen] = useState(false);
   const toggleNavigation = () => setIsNavOpen(!isNavOpen);
   const closeNavigation = () => setIsNavOpen(false);
@@ -56,6 +62,17 @@ export const Layout: React.FC<ILayoutProps> = ({ children, navigation, restrictW
         <NavContext.Provider value={{ closeNavigation }}>{navigation}</NavContext.Provider>
       </EuiPageSideBar>
       <EuiPageBody className="enterpriseSearchLayout__body" restrictWidth={restrictWidth}>
+        {readOnlyMode && (
+          <EuiCallOut
+            className="enterpriseSearchLayout__readOnlyMode"
+            color="warning"
+            iconType="lock"
+            title={i18n.translate('xpack.enterpriseSearch.readOnlyMode.warning', {
+              defaultMessage:
+                'Enterprise Search is in read-only mode. You will be unable to make changes such as creating, editing, or deleting.',
+            })}
+          />
+        )}
         {children}
       </EuiPageBody>
     </EuiPage>
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.scss b/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.scss
index d673542ba1983..79cd7634cfaa0 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.scss
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.scss
@@ -72,4 +72,15 @@ $euiSizeML: $euiSize * 1.25; // 20px - between medium and large ¯\_(ツ)_/¯
       }
     }
   }
+
+  &__subNav {
+    padding-left: $euiSizeML;
+
+    // Extends the click area of links more to the left, so that second tiers
+    // of subnavigation links still have the same hitbox as first tier links
+    .enterpriseSearchNavLinks__item {
+      margin-left: -$euiSizeML;
+      padding-left: $euiSizeXXL;
+    }
+  }
 }
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.test.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.test.tsx
index c117fa404a16b..b006068ac0d9e 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.test.tsx
@@ -89,4 +89,20 @@ describe('SideNavLink', () => {
     expect(wrapper.find('.testing')).toHaveLength(1);
     expect(wrapper.find('[data-test-subj="testing"]')).toHaveLength(1);
   });
+
+  it('renders nested subnavigation', () => {
+    const subNav = (
+      <SideNavLink to="/elsewhere" data-test-subj="subNav">
+        Another link!
+      </SideNavLink>
+    );
+    const wrapper = shallow(
+      <SideNavLink to="/" subNav={subNav}>
+        Link
+      </SideNavLink>
+    );
+
+    expect(wrapper.find('.enterpriseSearchNavLinks__subNav')).toHaveLength(1);
+    expect(wrapper.find('[data-test-subj="subNav"]')).toHaveLength(1);
+  });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.tsx
index 72e4f2f091496..edcfc2c84e3ad 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/side_nav.tsx
@@ -66,6 +66,7 @@ interface ISideNavLinkProps {
   isExternal?: boolean;
   className?: string;
   isRoot?: boolean;
+  subNav?: React.ReactNode;
 }
 
 export const SideNavLink: React.FC<ISideNavLinkProps> = ({
@@ -74,6 +75,7 @@ export const SideNavLink: React.FC<ISideNavLinkProps> = ({
   children,
   className,
   isRoot,
+  subNav,
   ...rest
 }) => {
   const { closeNavigation } = useContext(NavContext) as INavContext;
@@ -103,6 +105,7 @@ export const SideNavLink: React.FC<ISideNavLinkProps> = ({
           {children}
         </EuiLink>
       )}
+      {subNav && <ul className="enterpriseSearchNavLinks__subNav">{subNav}</ul>}
     </li>
   );
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.ts
index f88a00f63f487..94bd1d529b65f 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.ts
@@ -22,6 +22,7 @@ export interface IAppActions {
 }
 
 export const AppLogic = kea<MakeLogicType<IAppValues, IAppActions>>({
+  path: ['enterprise_search', 'workplace_search', 'app_logic'],
   actions: {
     initializeAppData: ({ workplaceSearch, isFederatedAuth }) => ({
       workplaceSearch,
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.test.tsx
index 39280ad6f4be4..fc1943264d72b 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.test.tsx
@@ -12,6 +12,7 @@ import { Redirect } from 'react-router-dom';
 import { shallow } from 'enzyme';
 import { useValues, useActions } from 'kea';
 
+import { Layout } from '../shared/layout';
 import { SetupGuide } from './views/setup_guide';
 import { ErrorState } from './views/error_state';
 import { Overview } from './views/overview';
@@ -53,6 +54,7 @@ describe('WorkplaceSearchConfigured', () => {
   it('renders with layout', () => {
     const wrapper = shallow(<WorkplaceSearchConfigured />);
 
+    expect(wrapper.find(Layout).prop('readOnlyMode')).toBeFalsy();
     expect(wrapper.find(Overview)).toHaveLength(1);
   });
 
@@ -60,9 +62,9 @@ describe('WorkplaceSearchConfigured', () => {
     const initializeAppData = jest.fn();
     (useActions as jest.Mock).mockImplementation(() => ({ initializeAppData }));
 
-    shallow(<WorkplaceSearchConfigured readOnlyMode={true} />);
+    shallow(<WorkplaceSearchConfigured isFederatedAuth={true} />);
 
-    expect(initializeAppData).toHaveBeenCalledWith({ readOnlyMode: true });
+    expect(initializeAppData).toHaveBeenCalledWith({ isFederatedAuth: true });
   });
 
   it('does not re-initialize app data', () => {
@@ -82,4 +84,12 @@ describe('WorkplaceSearchConfigured', () => {
 
     expect(wrapper.find(ErrorState)).toHaveLength(2);
   });
+
+  it('passes readOnlyMode state', () => {
+    (useValues as jest.Mock).mockImplementation(() => ({ readOnlyMode: true }));
+
+    const wrapper = shallow(<WorkplaceSearchConfigured />);
+
+    expect(wrapper.find(Layout).prop('readOnlyMode')).toEqual(true);
+  });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx
index 6a51b49869eaf..a68dfaf8ea471 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx
@@ -31,7 +31,7 @@ export const WorkplaceSearch: React.FC<IInitialAppData> = (props) => {
 export const WorkplaceSearchConfigured: React.FC<IInitialAppData> = (props) => {
   const { hasInitialized } = useValues(AppLogic);
   const { initializeAppData } = useActions(AppLogic);
-  const { errorConnecting } = useValues(HttpLogic);
+  const { errorConnecting, readOnlyMode } = useValues(HttpLogic);
 
   useEffect(() => {
     if (!hasInitialized) initializeAppData(props);
@@ -46,7 +46,7 @@ export const WorkplaceSearchConfigured: React.FC<IInitialAppData> = (props) => {
         {errorConnecting ? <ErrorState /> : <Overview />}
       </Route>
       <Route>
-        <Layout navigation={<WorkplaceSearchNav />}>
+        <Layout navigation={<WorkplaceSearchNav />} readOnlyMode={readOnlyMode}>
           {errorConnecting ? (
             <ErrorState />
           ) : (
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.ts
index 787d5295db1cf..a156b8a8009f9 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.ts
@@ -31,6 +31,7 @@ export interface IOverviewValues extends IOverviewServerData {
 }
 
 export const OverviewLogic = kea<MakeLogicType<IOverviewValues, IOverviewActions>>({
+  path: ['enterprise_search', 'workplace_search', 'overview_logic'],
   actions: {
     setServerData: (serverData) => serverData,
     initializeOverview: () => null,
diff --git a/x-pack/plugins/enterprise_search/server/lib/enterprise_search_request_handler.test.ts b/x-pack/plugins/enterprise_search/server/lib/enterprise_search_request_handler.test.ts
index 0c1e81e3aba46..3d0a3181f8ab8 100644
--- a/x-pack/plugins/enterprise_search/server/lib/enterprise_search_request_handler.test.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/enterprise_search_request_handler.test.ts
@@ -5,7 +5,7 @@
  */
 
 import { mockConfig, mockLogger } from '../__mocks__';
-import { JSON_HEADER } from '../../common/constants';
+import { JSON_HEADER, READ_ONLY_MODE_HEADER } from '../../common/constants';
 
 import { EnterpriseSearchRequestHandler } from './enterprise_search_request_handler';
 
@@ -18,6 +18,9 @@ const responseMock = {
   custom: jest.fn(),
   customError: jest.fn(),
 };
+const mockExpectedResponseHeaders = {
+  [READ_ONLY_MODE_HEADER]: 'false',
+};
 
 describe('EnterpriseSearchRequestHandler', () => {
   const enterpriseSearchRequestHandler = new EnterpriseSearchRequestHandler({
@@ -58,6 +61,7 @@ describe('EnterpriseSearchRequestHandler', () => {
       expect(responseMock.custom).toHaveBeenCalledWith({
         body: responseBody,
         statusCode: 200,
+        headers: mockExpectedResponseHeaders,
       });
     });
 
@@ -112,11 +116,12 @@ describe('EnterpriseSearchRequestHandler', () => {
         await makeAPICall(requestHandler);
 
         EnterpriseSearchAPI.shouldHaveBeenCalledWith('http://localhost:3002/api/example');
-        expect(responseMock.custom).toHaveBeenCalledWith({ body: {}, statusCode: 201 });
+        expect(responseMock.custom).toHaveBeenCalledWith({
+          body: {},
+          statusCode: 201,
+          headers: mockExpectedResponseHeaders,
+        });
       });
-
-      // TODO: It's possible we may also pass back headers at some point
-      // from Enterprise Search, e.g. the x-read-only mode header
     });
   });
 
@@ -140,6 +145,7 @@ describe('EnterpriseSearchRequestHandler', () => {
             message: 'some error message',
             attributes: { errors: ['some error message'] },
           },
+          headers: mockExpectedResponseHeaders,
         });
       });
 
@@ -156,6 +162,7 @@ describe('EnterpriseSearchRequestHandler', () => {
             message: 'one,two,three',
             attributes: { errors: ['one', 'two', 'three'] },
           },
+          headers: mockExpectedResponseHeaders,
         });
       });
 
@@ -171,6 +178,7 @@ describe('EnterpriseSearchRequestHandler', () => {
             message: 'Bad Request',
             attributes: { errors: ['Bad Request'] },
           },
+          headers: mockExpectedResponseHeaders,
         });
       });
 
@@ -186,6 +194,7 @@ describe('EnterpriseSearchRequestHandler', () => {
             message: 'Bad Request',
             attributes: { errors: ['Bad Request'] },
           },
+          headers: mockExpectedResponseHeaders,
         });
       });
 
@@ -201,6 +210,7 @@ describe('EnterpriseSearchRequestHandler', () => {
             message: 'Not Found',
             attributes: { errors: ['Not Found'] },
           },
+          headers: mockExpectedResponseHeaders,
         });
       });
     });
@@ -215,12 +225,33 @@ describe('EnterpriseSearchRequestHandler', () => {
       expect(responseMock.customError).toHaveBeenCalledWith({
         statusCode: 502,
         body: expect.stringContaining('Enterprise Search encountered an internal server error'),
+        headers: mockExpectedResponseHeaders,
       });
       expect(mockLogger.error).toHaveBeenCalledWith(
         'Enterprise Search Server Error 500 at <http://localhost:3002/api/5xx>: "something crashed!"'
       );
     });
 
+    it('handleReadOnlyModeError()', async () => {
+      EnterpriseSearchAPI.mockReturn(
+        { errors: ['Read only mode'] },
+        { status: 503, headers: { ...JSON_HEADER, [READ_ONLY_MODE_HEADER]: 'true' } }
+      );
+      const requestHandler = enterpriseSearchRequestHandler.createRequest({ path: '/api/503' });
+
+      await makeAPICall(requestHandler);
+      EnterpriseSearchAPI.shouldHaveBeenCalledWith('http://localhost:3002/api/503');
+
+      expect(responseMock.customError).toHaveBeenCalledWith({
+        statusCode: 503,
+        body: expect.stringContaining('Enterprise Search is in read-only mode'),
+        headers: { [READ_ONLY_MODE_HEADER]: 'true' },
+      });
+      expect(mockLogger.error).toHaveBeenCalledWith(
+        'Cannot perform action: Enterprise Search is in read-only mode. Actions that create, update, or delete information are disabled.'
+      );
+    });
+
     it('handleInvalidDataError()', async () => {
       EnterpriseSearchAPI.mockReturn({ results: false });
       const requestHandler = enterpriseSearchRequestHandler.createRequest({
@@ -234,6 +265,7 @@ describe('EnterpriseSearchRequestHandler', () => {
       expect(responseMock.customError).toHaveBeenCalledWith({
         statusCode: 502,
         body: 'Invalid data received from Enterprise Search',
+        headers: mockExpectedResponseHeaders,
       });
       expect(mockLogger.error).toHaveBeenCalledWith(
         'Invalid data received from <http://localhost:3002/api/invalid>: {"results":false}'
@@ -250,6 +282,7 @@ describe('EnterpriseSearchRequestHandler', () => {
       expect(responseMock.customError).toHaveBeenCalledWith({
         statusCode: 502,
         body: 'Error connecting to Enterprise Search: Failed',
+        headers: mockExpectedResponseHeaders,
       });
       expect(mockLogger.error).toHaveBeenCalled();
     });
@@ -265,6 +298,7 @@ describe('EnterpriseSearchRequestHandler', () => {
         expect(responseMock.customError).toHaveBeenCalledWith({
           statusCode: 502,
           body: 'Cannot authenticate Enterprise Search user',
+          headers: mockExpectedResponseHeaders,
         });
         expect(mockLogger.error).toHaveBeenCalled();
       });
@@ -279,6 +313,18 @@ describe('EnterpriseSearchRequestHandler', () => {
     });
   });
 
+  it('setResponseHeaders', async () => {
+    EnterpriseSearchAPI.mockReturn('anything' as any, {
+      headers: { [READ_ONLY_MODE_HEADER]: 'true' },
+    });
+    const requestHandler = enterpriseSearchRequestHandler.createRequest({ path: '/' });
+    await makeAPICall(requestHandler);
+
+    expect(enterpriseSearchRequestHandler.headers).toEqual({
+      [READ_ONLY_MODE_HEADER]: 'true',
+    });
+  });
+
   it('isEmptyObj', async () => {
     expect(enterpriseSearchRequestHandler.isEmptyObj({})).toEqual(true);
     expect(enterpriseSearchRequestHandler.isEmptyObj({ empty: false })).toEqual(false);
@@ -304,9 +350,10 @@ const EnterpriseSearchAPI = {
       ...expectedParams,
     });
   },
-  mockReturn(response: object, options?: object) {
+  mockReturn(response: object, options?: any) {
     fetchMock.mockImplementation(() => {
-      return Promise.resolve(new Response(JSON.stringify(response), options));
+      const headers = Object.assign({}, mockExpectedResponseHeaders, options?.headers);
+      return Promise.resolve(new Response(JSON.stringify(response), { ...options, headers }));
     });
   },
   mockReturnError() {
diff --git a/x-pack/plugins/enterprise_search/server/lib/enterprise_search_request_handler.ts b/x-pack/plugins/enterprise_search/server/lib/enterprise_search_request_handler.ts
index 00d5eaf5d6a83..6b65c16c832fd 100644
--- a/x-pack/plugins/enterprise_search/server/lib/enterprise_search_request_handler.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/enterprise_search_request_handler.ts
@@ -14,7 +14,7 @@ import {
   Logger,
 } from 'src/core/server';
 import { ConfigType } from '../index';
-import { JSON_HEADER } from '../../common/constants';
+import { JSON_HEADER, READ_ONLY_MODE_HEADER } from '../../common/constants';
 
 interface IConstructorDependencies {
   config: ConfigType;
@@ -46,6 +46,7 @@ export interface IEnterpriseSearchRequestHandler {
 export class EnterpriseSearchRequestHandler {
   private enterpriseSearchUrl: string;
   private log: Logger;
+  private headers: Record<string, string> = {};
 
   constructor({ config, log }: IConstructorDependencies) {
     this.log = log;
@@ -80,6 +81,9 @@ export class EnterpriseSearchRequestHandler {
         // Call the Enterprise Search API
         const apiResponse = await fetch(url, { method, headers, body });
 
+        // Handle response headers
+        this.setResponseHeaders(apiResponse);
+
         // Handle authentication redirects
         if (apiResponse.url.endsWith('/login') || apiResponse.url.endsWith('/ent/select')) {
           return this.handleAuthenticationError(response);
@@ -88,7 +92,13 @@ export class EnterpriseSearchRequestHandler {
         // Handle 400-500+ responses from the Enterprise Search server
         const { status } = apiResponse;
         if (status >= 500) {
-          return this.handleServerError(response, apiResponse, url);
+          if (this.headers[READ_ONLY_MODE_HEADER] === 'true') {
+            // Handle 503 read-only mode errors
+            return this.handleReadOnlyModeError(response);
+          } else {
+            // Handle unexpected server errors
+            return this.handleServerError(response, apiResponse, url);
+          }
         } else if (status >= 400) {
           return this.handleClientError(response, apiResponse);
         }
@@ -100,7 +110,11 @@ export class EnterpriseSearchRequestHandler {
         }
 
         // Pass successful responses back to the front-end
-        return response.custom({ statusCode: status, body: json });
+        return response.custom({
+          statusCode: status,
+          headers: this.headers,
+          body: json,
+        });
       } catch (e) {
         // Catch connection/auth errors
         return this.handleConnectionError(response, e);
@@ -160,7 +174,7 @@ export class EnterpriseSearchRequestHandler {
     const { status } = apiResponse;
     const body = await this.getErrorResponseBody(apiResponse);
 
-    return response.customError({ statusCode: status, body });
+    return response.customError({ statusCode: status, headers: this.headers, body });
   }
 
   async handleServerError(response: KibanaResponseFactory, apiResponse: Response, url: string) {
@@ -172,14 +186,22 @@ export class EnterpriseSearchRequestHandler {
       'Enterprise Search encountered an internal server error. Please contact your system administrator if the problem persists.';
 
     this.log.error(`Enterprise Search Server Error ${status} at <${url}>: ${message}`);
-    return response.customError({ statusCode: 502, body: errorMessage });
+    return response.customError({ statusCode: 502, headers: this.headers, body: errorMessage });
+  }
+
+  handleReadOnlyModeError(response: KibanaResponseFactory) {
+    const errorMessage =
+      'Enterprise Search is in read-only mode. Actions that create, update, or delete information are disabled.';
+
+    this.log.error(`Cannot perform action: ${errorMessage}`);
+    return response.customError({ statusCode: 503, headers: this.headers, body: errorMessage });
   }
 
   handleInvalidDataError(response: KibanaResponseFactory, url: string, json: object) {
     const errorMessage = 'Invalid data received from Enterprise Search';
 
     this.log.error(`Invalid data received from <${url}>: ${JSON.stringify(json)}`);
-    return response.customError({ statusCode: 502, body: errorMessage });
+    return response.customError({ statusCode: 502, headers: this.headers, body: errorMessage });
   }
 
   handleConnectionError(response: KibanaResponseFactory, e: Error) {
@@ -188,14 +210,26 @@ export class EnterpriseSearchRequestHandler {
     this.log.error(errorMessage);
     if (e instanceof Error) this.log.debug(e.stack as string);
 
-    return response.customError({ statusCode: 502, body: errorMessage });
+    return response.customError({ statusCode: 502, headers: this.headers, body: errorMessage });
   }
 
   handleAuthenticationError(response: KibanaResponseFactory) {
     const errorMessage = 'Cannot authenticate Enterprise Search user';
 
     this.log.error(errorMessage);
-    return response.customError({ statusCode: 502, body: errorMessage });
+    return response.customError({ statusCode: 502, headers: this.headers, body: errorMessage });
+  }
+
+  /**
+   * Set response headers
+   *
+   * Currently just forwards the read-only mode header, but we can expand this
+   * in the future to pass more headers from Enterprise Search as we need them
+   */
+
+  setResponseHeaders(apiResponse: Response) {
+    const readOnlyMode = apiResponse.headers.get(READ_ONLY_MODE_HEADER);
+    this.headers[READ_ONLY_MODE_HEADER] = readOnlyMode as 'true' | 'false';
   }
 
   /**
diff --git a/x-pack/plugins/features/server/feature_registry.test.ts b/x-pack/plugins/features/server/feature_registry.test.ts
index 24aae3a69ee5d..e89cf06ec8621 100644
--- a/x-pack/plugins/features/server/feature_registry.test.ts
+++ b/x-pack/plugins/features/server/feature_registry.test.ts
@@ -57,7 +57,7 @@ describe('FeatureRegistry', () => {
           read: {
             savedObject: {
               all: [],
-              read: ['config', 'url'],
+              read: ['config', 'url', 'telemetry'],
             },
             ui: [],
           },
@@ -230,7 +230,7 @@ describe('FeatureRegistry', () => {
       expect(allPrivilege?.savedObject.all).toEqual(['telemetry']);
     });
 
-    it(`automatically grants 'read' access to config and url saved objects for both privileges`, () => {
+    it(`automatically grants access to config, url, and telemetry saved objects`, () => {
       const feature: KibanaFeatureConfig = {
         id: 'test-feature',
         name: 'Test Feature',
@@ -263,7 +263,7 @@ describe('FeatureRegistry', () => {
       const allPrivilege = result[0].privileges?.all;
       const readPrivilege = result[0].privileges?.read;
       expect(allPrivilege?.savedObject.read).toEqual(['config', 'url']);
-      expect(readPrivilege?.savedObject.read).toEqual(['config', 'url']);
+      expect(readPrivilege?.savedObject.read).toEqual(['config', 'telemetry', 'url']);
     });
 
     it(`automatically grants 'all' access to telemetry and 'read' to [config, url] saved objects for the reserved privilege`, () => {
@@ -332,7 +332,7 @@ describe('FeatureRegistry', () => {
       const readPrivilege = result[0].privileges!.read;
       expect(allPrivilege?.savedObject.all).toEqual(['telemetry']);
       expect(allPrivilege?.savedObject.read).toEqual(['config', 'url']);
-      expect(readPrivilege?.savedObject.read).toEqual(['config', 'url']);
+      expect(readPrivilege?.savedObject.read).toEqual(['config', 'url', 'telemetry']);
     });
 
     it(`does not allow duplicate features to be registered`, () => {
diff --git a/x-pack/plugins/features/server/feature_registry.ts b/x-pack/plugins/features/server/feature_registry.ts
index d357bdb782797..e9e556ba22fd2 100644
--- a/x-pack/plugins/features/server/feature_registry.ts
+++ b/x-pack/plugins/features/server/feature_registry.ts
@@ -97,7 +97,12 @@ function applyAutomaticReadPrivilegeGrants(
 ) {
   readPrivileges.forEach((readPrivilege) => {
     if (readPrivilege) {
-      readPrivilege.savedObject.read = uniq([...readPrivilege.savedObject.read, 'config', 'url']);
+      readPrivilege.savedObject.read = uniq([
+        ...readPrivilege.savedObject.read,
+        'config',
+        'telemetry',
+        'url',
+      ]);
     }
   });
 }
diff --git a/x-pack/plugins/global_search_bar/public/components/__snapshots__/search_bar.test.tsx.snap b/x-pack/plugins/global_search_bar/public/components/__snapshots__/search_bar.test.tsx.snap
index f7e4bfd1c961c..7bb9954fa3048 100644
--- a/x-pack/plugins/global_search_bar/public/components/__snapshots__/search_bar.test.tsx.snap
+++ b/x-pack/plugins/global_search_bar/public/components/__snapshots__/search_bar.test.tsx.snap
@@ -7,8 +7,13 @@ Array [
     "className": "euiSelectableTemplateSitewide__listItem",
     "key": "Canvas",
     "label": "Canvas",
+    "meta": Array [
+      Object {
+        "text": "Kibana",
+      },
+    ],
     "prepend": undefined,
-    "title": "Canvasundefinedundefined",
+    "title": "Canvas •  Kibana",
     "url": "/app/test/Canvas",
   },
   Object {
@@ -16,8 +21,13 @@ Array [
     "className": "euiSelectableTemplateSitewide__listItem",
     "key": "Discover",
     "label": "Discover",
+    "meta": Array [
+      Object {
+        "text": "Kibana",
+      },
+    ],
     "prepend": undefined,
-    "title": "Discoverundefinedundefined",
+    "title": "Discover •  Kibana",
     "url": "/app/test/Discover",
   },
   Object {
@@ -25,8 +35,13 @@ Array [
     "className": "euiSelectableTemplateSitewide__listItem",
     "key": "Graph",
     "label": "Graph",
+    "meta": Array [
+      Object {
+        "text": "Kibana",
+      },
+    ],
     "prepend": undefined,
-    "title": "Graphundefinedundefined",
+    "title": "Graph •  Kibana",
     "url": "/app/test/Graph",
   },
 ]
@@ -39,8 +54,13 @@ Array [
     "className": "euiSelectableTemplateSitewide__listItem",
     "key": "Discover",
     "label": "Discover",
+    "meta": Array [
+      Object {
+        "text": "Kibana",
+      },
+    ],
     "prepend": undefined,
-    "title": "Discoverundefinedundefined",
+    "title": "Discover •  Kibana",
     "url": "/app/test/Discover",
   },
   Object {
@@ -66,7 +86,7 @@ exports[`SearchBar supports keyboard shortcuts 1`] = `
   aria-haspopup="listbox"
   aria-label="Filter options"
   autocomplete="off"
-  class="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch--compressed euiSelectableSearch euiSelectableTemplateSitewide__search"
+  class="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch--compressed euiFieldSearch-isClearable euiSelectableSearch euiSelectableTemplateSitewide__search"
   data-test-subj="header-search"
   placeholder="Search Elastic"
   type="search"
diff --git a/x-pack/plugins/global_search_bar/public/components/search_bar.test.tsx b/x-pack/plugins/global_search_bar/public/components/search_bar.test.tsx
index 0d1e8725b4911..11fbc7931e620 100644
--- a/x-pack/plugins/global_search_bar/public/components/search_bar.test.tsx
+++ b/x-pack/plugins/global_search_bar/public/components/search_bar.test.tsx
@@ -21,6 +21,7 @@ type Result = { id: string; type: string } | string;
 const createResult = (result: Result): GlobalSearchResult => {
   const id = typeof result === 'string' ? result : result.id;
   const type = typeof result === 'string' ? 'application' : result.type;
+  const meta = type === 'application' ? { categoryLabel: 'Kibana' } : { categoryLabel: null };
 
   return {
     id,
@@ -28,6 +29,7 @@ const createResult = (result: Result): GlobalSearchResult => {
     title: id,
     url: `/app/test/${id}`,
     score: 42,
+    meta,
   };
 };
 
@@ -74,7 +76,7 @@ describe('SearchBar', () => {
     expect(findSpy).toHaveBeenCalledTimes(1);
     expect(findSpy).toHaveBeenCalledWith('', {});
     expect(getSelectableProps(component).options).toMatchSnapshot();
-    await wait(() => getSearchProps(component).onSearch('d'));
+    await wait(() => getSearchProps(component).onKeyUpCapture({ currentTarget: { value: 'd' } }));
     jest.runAllTimers();
     component.update();
     expect(getSelectableProps(component).options).toMatchSnapshot();
diff --git a/x-pack/plugins/global_search_bar/public/components/search_bar.tsx b/x-pack/plugins/global_search_bar/public/components/search_bar.tsx
index d00349e21a7e4..e41f9243198ad 100644
--- a/x-pack/plugins/global_search_bar/public/components/search_bar.tsx
+++ b/x-pack/plugins/global_search_bar/public/components/search_bar.tsx
@@ -52,14 +52,20 @@ export function SearchBar({ globalSearch, navigateToUrl }: Props) {
       if (!isMounted()) return;
 
       _setOptions([
-        ..._options.map((option) => ({
-          key: option.id,
-          label: option.title,
-          url: option.url,
-          ...(option.icon && { icon: { type: option.icon } }),
-          ...(option.type &&
-            option.type !== 'application' && { meta: [{ text: cleanMeta(option.type) }] }),
-        })),
+        ..._options.map(({ id, title, url, icon, type, meta }) => {
+          const option: EuiSelectableTemplateSitewideOption = {
+            key: id,
+            label: title,
+            url,
+          };
+
+          if (icon) option.icon = { type: icon };
+
+          if (type === 'application') option.meta = [{ text: meta?.categoryLabel as string }];
+          else option.meta = [{ text: cleanMeta(type) }];
+
+          return option;
+        }),
       ]);
     },
     [isMounted, _setOptions]
@@ -133,7 +139,8 @@ export function SearchBar({ globalSearch, navigateToUrl }: Props) {
       onChange={onChange}
       options={options}
       searchProps={{
-        onSearch: setSearchValue,
+        onKeyUpCapture: (e: React.KeyboardEvent<HTMLInputElement>) =>
+          setSearchValue(e.currentTarget.value),
         'data-test-subj': 'header-search',
         inputRef: setSearchRef,
         compressed: true,
diff --git a/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts b/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts
index 0c9daadf14fc6..5ef15a8cf2ea4 100644
--- a/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts
+++ b/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts
@@ -4,7 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AppNavLinkStatus, AppStatus, PublicAppInfo } from 'src/core/public';
+import {
+  AppNavLinkStatus,
+  AppStatus,
+  PublicAppInfo,
+  DEFAULT_APP_CATEGORIES,
+} from 'src/core/public';
 import { appToResult, getAppResults, scoreApp } from './get_app_results';
 
 const createApp = (props: Partial<PublicAppInfo> = {}): PublicAppInfo => ({
@@ -70,6 +75,7 @@ describe('appToResult', () => {
       title: 'Foo',
       euiIconType: 'fooIcon',
       appRoute: '/app/foo',
+      category: DEFAULT_APP_CATEGORIES.security,
     });
     expect(appToResult(app, 42)).toEqual({
       id: 'foo',
@@ -77,6 +83,31 @@ describe('appToResult', () => {
       type: 'application',
       icon: 'fooIcon',
       url: '/app/foo',
+      meta: {
+        categoryId: DEFAULT_APP_CATEGORIES.security.id,
+        categoryLabel: DEFAULT_APP_CATEGORIES.security.label,
+      },
+      score: 42,
+    });
+  });
+
+  it('converts an app without category to a result', () => {
+    const app = createApp({
+      id: 'foo',
+      title: 'Foo',
+      euiIconType: 'fooIcon',
+      appRoute: '/app/foo',
+    });
+    expect(appToResult(app, 42)).toEqual({
+      id: 'foo',
+      title: 'Foo',
+      type: 'application',
+      icon: 'fooIcon',
+      url: '/app/foo',
+      meta: {
+        categoryId: null,
+        categoryLabel: null,
+      },
       score: 42,
     });
   });
diff --git a/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts b/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts
index 4b2901254076c..c4e1a9532d144 100644
--- a/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts
+++ b/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts
@@ -50,6 +50,10 @@ export const appToResult = (app: PublicAppInfo, score: number): GlobalSearchProv
     type: 'application',
     icon: app.euiIconType,
     url: app.appRoute,
+    meta: {
+      categoryId: app.category?.id ?? null,
+      categoryLabel: app.category?.label ?? null,
+    },
     score,
   };
 };
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx b/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx
index 3867c30655379..b0df3723ca77e 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx
@@ -14,8 +14,8 @@ import { SinonFakeServer } from 'sinon';
 import { ReactWrapper } from 'enzyme';
 import axios from 'axios';
 import axiosXhrAdapter from 'axios/lib/adapters/xhr';
+import { createMemoryHistory } from 'history';
 
-import { init as initHttpRequests } from './helpers/http_requests';
 import {
   notificationServiceMock,
   fatalErrorsServiceMock,
@@ -41,8 +41,7 @@ import {
   policyNameAlreadyUsedErrorMessage,
   maximumDocumentsRequiredMessage,
 } from '../../public/application/services/policies/policy_validation';
-import { HttpResponse } from './helpers/http_requests';
-import { createMemoryHistory } from 'history';
+import { editPolicyHelpers } from './helpers';
 
 // @ts-ignore
 initHttp(axios.create({ adapter: axiosXhrAdapter }));
@@ -54,11 +53,8 @@ initNotification(
 
 const history = createMemoryHistory();
 let server: SinonFakeServer;
-let httpRequestsMockHelpers: {
-  setPoliciesResponse: (response: HttpResponse) => void;
-  setNodesListResponse: (response: HttpResponse) => void;
-  setNodesDetailsResponse: (nodeAttributes: string, response: HttpResponse) => void;
-};
+let httpRequestsMockHelpers: editPolicyHelpers.EditPolicySetup['http']['httpRequestsMockHelpers'];
+let http: editPolicyHelpers.EditPolicySetup['http'];
 const policy = {
   phases: {
     hot: {
@@ -94,6 +90,17 @@ const activatePhase = async (rendered: ReactWrapper, phase: string) => {
   });
   rendered.update();
 };
+const openNodeAttributesSection = (rendered: ReactWrapper, phase: string) => {
+  const getControls = () => findTestSubject(rendered, `${phase}-dataTierAllocationControls`);
+  act(() => {
+    findTestSubject(getControls(), 'dataTierSelect').simulate('click');
+  });
+  rendered.update();
+  act(() => {
+    findTestSubject(getControls(), 'customDataAllocationOption').simulate('click');
+  });
+  rendered.update();
+};
 const expectedErrorMessages = (rendered: ReactWrapper, expectedMessages: string[]) => {
   const errorMessages = rendered.find('.euiFormErrorText');
   expect(errorMessages.length).toBe(expectedMessages.length);
@@ -119,12 +126,16 @@ const setPolicyName = (rendered: ReactWrapper, policyName: string) => {
   policyNameField.simulate('change', { target: { value: policyName } });
   rendered.update();
 };
-const setPhaseAfter = (rendered: ReactWrapper, phase: string, after: string) => {
+const setPhaseAfter = (rendered: ReactWrapper, phase: string, after: string | number) => {
   const afterInput = rendered.find(`input#${phase}-selectedMinimumAge`);
   afterInput.simulate('change', { target: { value: after } });
   rendered.update();
 };
-const setPhaseIndexPriority = (rendered: ReactWrapper, phase: string, priority: string) => {
+const setPhaseIndexPriority = (
+  rendered: ReactWrapper,
+  phase: string,
+  priority: string | number
+) => {
   const priorityInput = rendered.find(`input#${phase}-phaseIndexPriority`);
   priorityInput.simulate('change', { target: { value: priority } });
   rendered.update();
@@ -139,7 +150,9 @@ describe('edit policy', () => {
     component = (
       <EditPolicy history={history} getUrlForApp={jest.fn()} policies={policies} policyName={''} />
     );
-    ({ server, httpRequestsMockHelpers } = initHttpRequests());
+
+    ({ http } = editPolicyHelpers.setup());
+    ({ server, httpRequestsMockHelpers } = http);
 
     httpRequestsMockHelpers.setPoliciesResponse(policies);
   });
@@ -321,7 +334,7 @@ describe('edit policy', () => {
   describe('warm phase', () => {
     beforeEach(() => {
       server.respondImmediately = true;
-      httpRequestsMockHelpers.setNodesListResponse({});
+      http.setupNodeListResponse();
       httpRequestsMockHelpers.setNodesDetailsResponse('attribute:true', [
         { nodeId: 'testNodeId', stats: { name: 'testNodeName', host: 'testHost' } },
       ]);
@@ -431,34 +444,39 @@ describe('edit policy', () => {
       expect(getNodeAttributeSelect(rendered, 'warm').exists()).toBeFalsy();
     });
     test('should show warning instead of node attributes input when none exist', async () => {
+      http.setupNodeListResponse({
+        nodesByAttributes: {},
+        nodesByRoles: { data: ['node1'] },
+      });
       const rendered = mountWithIntl(component);
       noRollover(rendered);
       setPolicyName(rendered, 'mypolicy');
       await activatePhase(rendered, 'warm');
       expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeTruthy();
+      openNodeAttributesSection(rendered, 'warm');
+      expect(findTestSubject(rendered, 'noNodeAttributesWarning').exists()).toBeTruthy();
       expect(getNodeAttributeSelect(rendered, 'warm').exists()).toBeFalsy();
     });
     test('should show node attributes input when attributes exist', async () => {
-      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
       const rendered = mountWithIntl(component);
       noRollover(rendered);
       setPolicyName(rendered, 'mypolicy');
       await activatePhase(rendered, 'warm');
       expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      openNodeAttributesSection(rendered, 'warm');
+      expect(findTestSubject(rendered, 'noNodeAttributesWarning').exists()).toBeFalsy();
       const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'warm');
       expect(nodeAttributesSelect.exists()).toBeTruthy();
       expect(nodeAttributesSelect.find('option').length).toBe(2);
     });
     test('should show view node attributes link when attribute selected and show flyout when clicked', async () => {
-      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
       const rendered = mountWithIntl(component);
       noRollover(rendered);
       setPolicyName(rendered, 'mypolicy');
       await activatePhase(rendered, 'warm');
       expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      openNodeAttributesSection(rendered, 'warm');
+      expect(findTestSubject(rendered, 'noNodeAttributesWarning').exists()).toBeFalsy();
       const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'warm');
       expect(nodeAttributesSelect.exists()).toBeTruthy();
       expect(findTestSubject(rendered, 'warm-viewNodeDetailsFlyoutButton').exists()).toBeFalsy();
@@ -473,11 +491,23 @@ describe('edit policy', () => {
       rendered.update();
       expect(rendered.find('.euiFlyout').exists()).toBeTruthy();
     });
+    test('should show default allocation warning when no node roles are found', async () => {
+      http.setupNodeListResponse({
+        nodesByAttributes: {},
+        nodesByRoles: {},
+      });
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      expect(findTestSubject(rendered, 'defaultAllocationWarning').exists()).toBeTruthy();
+    });
   });
   describe('cold phase', () => {
     beforeEach(() => {
       server.respondImmediately = true;
-      httpRequestsMockHelpers.setNodesListResponse({});
+      http.setupNodeListResponse();
       httpRequestsMockHelpers.setNodesDetailsResponse('attribute:true', [
         { nodeId: 'testNodeId', stats: { name: 'testNodeName', host: 'testHost' } },
       ]);
@@ -511,34 +541,39 @@ describe('edit policy', () => {
       expect(getNodeAttributeSelect(rendered, 'cold').exists()).toBeFalsy();
     });
     test('should show warning instead of node attributes input when none exist', async () => {
+      http.setupNodeListResponse({
+        nodesByAttributes: {},
+        nodesByRoles: { data: ['node1'] },
+      });
       const rendered = mountWithIntl(component);
       noRollover(rendered);
       setPolicyName(rendered, 'mypolicy');
       await activatePhase(rendered, 'cold');
       expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeTruthy();
+      openNodeAttributesSection(rendered, 'cold');
+      expect(findTestSubject(rendered, 'noNodeAttributesWarning').exists()).toBeTruthy();
       expect(getNodeAttributeSelect(rendered, 'cold').exists()).toBeFalsy();
     });
     test('should show node attributes input when attributes exist', async () => {
-      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
       const rendered = mountWithIntl(component);
       noRollover(rendered);
       setPolicyName(rendered, 'mypolicy');
       await activatePhase(rendered, 'cold');
       expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      openNodeAttributesSection(rendered, 'cold');
+      expect(findTestSubject(rendered, 'noNodeAttributesWarning').exists()).toBeFalsy();
       const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'cold');
       expect(nodeAttributesSelect.exists()).toBeTruthy();
       expect(nodeAttributesSelect.find('option').length).toBe(2);
     });
     test('should show view node attributes link when attribute selected and show flyout when clicked', async () => {
-      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
       const rendered = mountWithIntl(component);
       noRollover(rendered);
       setPolicyName(rendered, 'mypolicy');
       await activatePhase(rendered, 'cold');
       expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      openNodeAttributesSection(rendered, 'cold');
+      expect(findTestSubject(rendered, 'noNodeAttributesWarning').exists()).toBeFalsy();
       const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'cold');
       expect(nodeAttributesSelect.exists()).toBeTruthy();
       expect(findTestSubject(rendered, 'cold-viewNodeDetailsFlyoutButton').exists()).toBeFalsy();
@@ -563,6 +598,128 @@ describe('edit policy', () => {
       save(rendered);
       expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
     });
+    test('should show default allocation warning when no node roles are found', async () => {
+      http.setupNodeListResponse({
+        nodesByAttributes: {},
+        nodesByRoles: {},
+      });
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'cold');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      expect(findTestSubject(rendered, 'defaultAllocationWarning').exists()).toBeTruthy();
+    });
+  });
+  describe('frozen phase', () => {
+    beforeEach(() => {
+      server.respondImmediately = true;
+      http.setupNodeListResponse();
+      httpRequestsMockHelpers.setNodesDetailsResponse('attribute:true', [
+        { nodeId: 'testNodeId', stats: { name: 'testNodeName', host: 'testHost' } },
+      ]);
+    });
+    test('should allow 0 for phase timing', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'frozen');
+      setPhaseAfter(rendered, 'frozen', 0);
+      save(rendered);
+      expectedErrorMessages(rendered, []);
+    });
+    test('should show positive number required error when trying to save cold phase with -1 for after', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'frozen');
+      setPhaseAfter(rendered, 'frozen', -1);
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
+    });
+    test('should show spinner for node attributes input when loading', async () => {
+      server.respondImmediately = false;
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'frozen');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeTruthy();
+      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      expect(getNodeAttributeSelect(rendered, 'frozen').exists()).toBeFalsy();
+    });
+    test('should show warning instead of node attributes input when none exist', async () => {
+      http.setupNodeListResponse({
+        nodesByAttributes: {},
+        nodesByRoles: { data: ['node1'] },
+      });
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'frozen');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      openNodeAttributesSection(rendered, 'frozen');
+      expect(findTestSubject(rendered, 'noNodeAttributesWarning').exists()).toBeTruthy();
+      expect(getNodeAttributeSelect(rendered, 'frozen').exists()).toBeFalsy();
+    });
+    test('should show node attributes input when attributes exist', async () => {
+      http.setupNodeListResponse();
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'frozen');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      openNodeAttributesSection(rendered, 'frozen');
+      expect(findTestSubject(rendered, 'noNodeAttributesWarning').exists()).toBeFalsy();
+      const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'frozen');
+      expect(nodeAttributesSelect.exists()).toBeTruthy();
+      expect(nodeAttributesSelect.find('option').length).toBe(2);
+    });
+    test('should show view node attributes link when attribute selected and show flyout when clicked', async () => {
+      http.setupNodeListResponse();
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'frozen');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      openNodeAttributesSection(rendered, 'frozen');
+      expect(findTestSubject(rendered, 'noNodeAttributesWarning').exists()).toBeFalsy();
+      const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'frozen');
+      expect(nodeAttributesSelect.exists()).toBeTruthy();
+      expect(findTestSubject(rendered, 'frozen-viewNodeDetailsFlyoutButton').exists()).toBeFalsy();
+      expect(nodeAttributesSelect.find('option').length).toBe(2);
+      nodeAttributesSelect.simulate('change', { target: { value: 'attribute:true' } });
+      rendered.update();
+      const flyoutButton = findTestSubject(rendered, 'frozen-viewNodeDetailsFlyoutButton');
+      expect(flyoutButton.exists()).toBeTruthy();
+      await act(async () => {
+        await flyoutButton.simulate('click');
+      });
+      rendered.update();
+      expect(rendered.find('.euiFlyout').exists()).toBeTruthy();
+    });
+    test('should show positive number required error when trying to save with -1 for index priority', async () => {
+      http.setupNodeListResponse();
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'frozen');
+      setPhaseAfter(rendered, 'frozen', 1);
+      setPhaseIndexPriority(rendered, 'frozen', -1);
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
+    });
+    test('should show default allocation warning when no node roles are found', async () => {
+      http.setupNodeListResponse({
+        nodesByAttributes: {},
+        nodesByRoles: {},
+      });
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'frozen');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      expect(findTestSubject(rendered, 'defaultAllocationWarning').exists()).toBeTruthy();
+    });
   });
   describe('delete phase', () => {
     test('should allow 0 for phase timing', async () => {
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/edit_policy.ts b/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/edit_policy.ts
new file mode 100644
index 0000000000000..4eeb542671d23
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/edit_policy.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { init as initHttpRequests } from './http_requests';
+
+export type EditPolicySetup = ReturnType<typeof setup>;
+
+export const setup = () => {
+  const { httpRequestsMockHelpers, server } = initHttpRequests();
+
+  const setupNodeListResponse = (
+    response: Record<string, any> = {
+      nodesByAttributes: { 'attribute:true': ['node1'] },
+      nodesByRoles: { data: ['node1'] },
+    }
+  ) => {
+    httpRequestsMockHelpers.setNodesListResponse(response);
+  };
+
+  return {
+    http: {
+      setupNodeListResponse,
+      httpRequestsMockHelpers,
+      server,
+    },
+  };
+};
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/http_requests.ts b/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/http_requests.ts
index 6cbe3bdf1f8c6..a9d326073e4d3 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/http_requests.ts
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/http_requests.ts
@@ -40,6 +40,8 @@ const registerHttpRequestMockHelpers = (server: SinonFakeServer) => {
   };
 };
 
+export type HttpRequestMockHelpers = ReturnType<typeof registerHttpRequestMockHelpers>;
+
 export const init = () => {
   const server = sinon.fakeServer.create();
 
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/index.ts b/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/index.ts
new file mode 100644
index 0000000000000..4c32ea121bb57
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as editPolicyHelpers from './edit_policy';
+
+export { HttpRequestMockHelpers, init } from './http_requests';
+
+export { editPolicyHelpers };
diff --git a/x-pack/plugins/index_lifecycle_management/common/types/api.ts b/x-pack/plugins/index_lifecycle_management/common/types/api.ts
new file mode 100644
index 0000000000000..16b8fbd127ab6
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/common/types/api.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export type NodeDataRole = 'data' | 'data_hot' | 'data_warm' | 'data_cold' | 'data_frozen';
+
+export interface ListNodesRouteResponse {
+  nodesByAttributes: { [attributePair: string]: string[] };
+  nodesByRoles: { [role in NodeDataRole]?: string[] };
+}
diff --git a/x-pack/plugins/index_lifecycle_management/common/types/index.ts b/x-pack/plugins/index_lifecycle_management/common/types/index.ts
index fef79c7782bb0..a23dc647f1f65 100644
--- a/x-pack/plugins/index_lifecycle_management/common/types/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/common/types/index.ts
@@ -4,4 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+export * from './api';
+
 export * from './policies';
diff --git a/x-pack/plugins/index_lifecycle_management/common/types/policies.ts b/x-pack/plugins/index_lifecycle_management/common/types/policies.ts
index 97effee44533a..8f913dd884dfe 100644
--- a/x-pack/plugins/index_lifecycle_management/common/types/policies.ts
+++ b/x-pack/plugins/index_lifecycle_management/common/types/policies.ts
@@ -6,6 +6,8 @@
 
 import { Index as IndexInterface } from '../../../index_management/common/types';
 
+export type PhaseWithAllocation = 'warm' | 'cold' | 'frozen';
+
 export interface SerializedPolicy {
   name: string;
   phases: Phases;
@@ -62,6 +64,7 @@ export interface SerializedWarmPhase extends SerializedPhase {
     set_priority?: {
       priority: number | null;
     };
+    migrate?: { enabled: boolean };
   };
 }
 
@@ -72,6 +75,7 @@ export interface SerializedColdPhase extends SerializedPhase {
     set_priority?: {
       priority: number | null;
     };
+    migrate?: { enabled: boolean };
   };
 }
 
@@ -82,6 +86,7 @@ export interface SerializedFrozenPhase extends SerializedPhase {
     set_priority?: {
       priority: number | null;
     };
+    migrate?: { enabled: boolean };
   };
 }
 
@@ -103,6 +108,13 @@ export interface AllocateAction {
   require?: {
     [attribute: string]: string;
   };
+  migrate?: {
+    /**
+     * If enabled is ever set it will only be set to `false` because the default value
+     * for this is `true`. Rather leave unspecified for true.
+     */
+    enabled: false;
+  };
 }
 
 export interface Policy {
@@ -125,9 +137,23 @@ export interface PhaseWithMinAge {
   selectedMinimumAgeUnits: string;
 }
 
+/**
+ * Different types of allocation markers we use in deserialized policies.
+ *
+ * default - use data tier based data allocation based on node roles -- this is ES best practice mode.
+ * custom - use node_attrs to allocate data to specific nodes
+ * none - do not move data anywhere when entering a phase
+ */
+export type DataTierAllocationType = 'default' | 'custom' | 'none';
+
 export interface PhaseWithAllocationAction {
   selectedNodeAttrs: string;
   selectedReplicaCount: string;
+  /**
+   * A string value indicating allocation type. If unspecified we assume the user
+   * wants to use default allocation.
+   */
+  dataTierAllocationType: DataTierAllocationType;
 }
 
 export interface PhaseWithIndexPriority {
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts b/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts
index f11860d36faf8..6d4c57d23138d 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts
@@ -38,6 +38,7 @@ export const defaultNewWarmPhase: WarmPhase = {
   selectedReplicaCount: '',
   warmPhaseOnRollover: true,
   phaseIndexPriority: '50',
+  dataTierAllocationType: 'default',
 };
 
 export const defaultNewColdPhase: ColdPhase = {
@@ -48,6 +49,7 @@ export const defaultNewColdPhase: ColdPhase = {
   selectedReplicaCount: '',
   freezeEnabled: false,
   phaseIndexPriority: '0',
+  dataTierAllocationType: 'default',
 };
 
 export const defaultNewFrozenPhase: FrozenPhase = {
@@ -58,6 +60,7 @@ export const defaultNewFrozenPhase: FrozenPhase = {
   selectedReplicaCount: '',
   freezeEnabled: false,
   phaseIndexPriority: '0',
+  dataTierAllocationType: 'default',
 };
 
 export const defaultNewDeletePhase: DeletePhase = {
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/lib/data_tiers/check_phase_compatibility.ts b/x-pack/plugins/index_lifecycle_management/public/application/lib/data_tiers/check_phase_compatibility.ts
new file mode 100644
index 0000000000000..2ef0fb145551f
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/lib/data_tiers/check_phase_compatibility.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  NodeDataRole,
+  ListNodesRouteResponse,
+  PhaseWithAllocation,
+} from '../../../../common/types';
+
+/**
+ * Given a phase and current node roles, determine whether the phase
+ * can use default data tier allocation.
+ *
+ * This can only be checked for phases that have an allocate action.
+ */
+export const isPhaseDefaultDataAllocationCompatible = (
+  phase: PhaseWithAllocation,
+  nodesByRoles: ListNodesRouteResponse['nodesByRoles']
+): boolean => {
+  // The 'data' role covers all node roles, so if we have at least one node with the data role
+  // we can use default allocation.
+  if (nodesByRoles.data?.length) {
+    return true;
+  }
+
+  // Otherwise we need to check whether a node role for the specific phase exists
+  if (nodesByRoles[`data_${phase}` as NodeDataRole]?.length) {
+    return true;
+  }
+
+  // Otherwise default allocation has nowhere to allocate new shards to in this phase.
+  return false;
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/lib/data_tiers/determine_allocation_type.ts b/x-pack/plugins/index_lifecycle_management/public/application/lib/data_tiers/determine_allocation_type.ts
new file mode 100644
index 0000000000000..4067ad97fc43b
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/lib/data_tiers/determine_allocation_type.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { DataTierAllocationType, AllocateAction } from '../../../../common/types';
+
+/**
+ * Determine what deserialized state the policy config represents.
+ *
+ * See {@DataTierAllocationType} for more information.
+ */
+export const determineDataTierAllocationType = (
+  allocateAction?: AllocateAction
+): DataTierAllocationType => {
+  if (!allocateAction) {
+    return 'default';
+  }
+
+  if (allocateAction.migrate?.enabled === false) {
+    return 'none';
+  }
+
+  if (
+    (allocateAction.require && Object.keys(allocateAction.require).length) ||
+    (allocateAction.include && Object.keys(allocateAction.include).length) ||
+    (allocateAction.exclude && Object.keys(allocateAction.exclude).length)
+  ) {
+    return 'custom';
+  }
+
+  return 'default';
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/lib/data_tiers/index.ts b/x-pack/plugins/index_lifecycle_management/public/application/lib/data_tiers/index.ts
new file mode 100644
index 0000000000000..67a512cefe00c
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/lib/data_tiers/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './determine_allocation_type';
+
+export * from './check_phase_compatibility';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/lib/index.ts b/x-pack/plugins/index_lifecycle_management/public/application/lib/index.ts
new file mode 100644
index 0000000000000..1dabae1a0f0c4
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/lib/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './data_tiers';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/data_tier_allocation.scss b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/data_tier_allocation.scss
new file mode 100644
index 0000000000000..62ec3f303e1e8
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/data_tier_allocation.scss
@@ -0,0 +1,9 @@
+.indexLifecycleManagement__phase__dataTierAllocation {
+  &__controlSection {
+    background-color: $euiColorLightestShade;
+    padding-top: $euiSizeM;
+    padding-left: $euiSizeM;
+    padding-right: $euiSizeM;
+    padding-bottom: $euiSizeM;
+  }
+}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/data_tier_allocation.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/data_tier_allocation.tsx
new file mode 100644
index 0000000000000..3ae60a5a3d622
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/data_tier_allocation.tsx
@@ -0,0 +1,194 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiText, EuiFormRow, EuiSpacer, EuiSuperSelect, EuiSuperSelectOption } from '@elastic/eui';
+
+import { DataTierAllocationType } from '../../../../../../common/types';
+import { NodeAllocation } from './node_allocation';
+import { SharedProps } from './types';
+
+import './data_tier_allocation.scss';
+
+type SelectOptions = EuiSuperSelectOption<DataTierAllocationType>;
+
+const i18nTexts = {
+  allocationFieldLabel: i18n.translate(
+    'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.allocationFieldLabel',
+    { defaultMessage: 'Data tier options' }
+  ),
+  allocationOptions: {
+    warm: {
+      default: {
+        input: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.warm.defaultOption.input',
+          { defaultMessage: 'Use warm nodes (recommended)' }
+        ),
+        helpText: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.warm.defaultOption.helpText',
+          { defaultMessage: 'Move data to nodes in the warm tier.' }
+        ),
+      },
+      none: {
+        inputDisplay: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.warm.noneOption.input',
+          { defaultMessage: 'Off' }
+        ),
+        helpText: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.warm.noneOption.helpText',
+          { defaultMessage: 'Do not move data in the warm phase.' }
+        ),
+      },
+      custom: {
+        inputDisplay: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.warm.customOption.input',
+          { defaultMessage: 'Custom' }
+        ),
+        helpText: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.warm.customOption.helpText',
+          { defaultMessage: 'Move data based on node attributes.' }
+        ),
+      },
+    },
+    cold: {
+      default: {
+        input: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.cold.defaultOption.input',
+          { defaultMessage: 'Use cold nodes (recommended)' }
+        ),
+        helpText: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.cold.defaultOption.helpText',
+          { defaultMessage: 'Move data to nodes in the cold tier.' }
+        ),
+      },
+      none: {
+        inputDisplay: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.cold.noneOption.input',
+          { defaultMessage: 'Off' }
+        ),
+        helpText: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.cold.noneOption.helpText',
+          { defaultMessage: 'Do not move data in the cold phase.' }
+        ),
+      },
+      custom: {
+        inputDisplay: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.cold.customOption.input',
+          { defaultMessage: 'Custom' }
+        ),
+        helpText: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.cold.customOption.helpText',
+          { defaultMessage: 'Move data based on node attributes.' }
+        ),
+      },
+    },
+    frozen: {
+      default: {
+        input: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.frozen.defaultOption.input',
+          { defaultMessage: 'Use frozen nodes (recommended)' }
+        ),
+        helpText: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.frozen.defaultOption.helpText',
+          { defaultMessage: 'Move data to nodes in the frozen tier.' }
+        ),
+      },
+      none: {
+        inputDisplay: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.frozen.noneOption.input',
+          { defaultMessage: 'Off' }
+        ),
+        helpText: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.frozen.noneOption.helpText',
+          { defaultMessage: 'Do not move data in the frozen phase.' }
+        ),
+      },
+      custom: {
+        inputDisplay: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.frozen.customOption.input',
+          { defaultMessage: 'Custom' }
+        ),
+        helpText: i18n.translate(
+          'xpack.indexLifecycleMgmt.editPolicy.common.dataTierAllocation.frozen.customOption.helpText',
+          { defaultMessage: 'Move data based on node attributes.' }
+        ),
+      },
+    },
+  },
+};
+
+export const DataTierAllocation: FunctionComponent<SharedProps> = (props) => {
+  const { phaseData, setPhaseData, phase, hasNodeAttributes } = props;
+
+  return (
+    <div data-test-subj={`${phase}-dataTierAllocationControls`}>
+      <EuiFormRow label={i18nTexts.allocationFieldLabel}>
+        <EuiSuperSelect
+          data-test-subj="dataTierSelect"
+          hasDividers
+          valueOfSelected={phaseData.dataTierAllocationType}
+          onChange={(value) => setPhaseData('dataTierAllocationType', value)}
+          options={
+            [
+              {
+                value: 'default',
+                inputDisplay: i18nTexts.allocationOptions[phase].default.input,
+                dropdownDisplay: (
+                  <>
+                    <strong>{i18nTexts.allocationOptions[phase].default.input}</strong>
+                    <EuiText size="s" color="subdued">
+                      <p className="euiTextColor--subdued">
+                        {i18nTexts.allocationOptions[phase].default.helpText}
+                      </p>
+                    </EuiText>
+                  </>
+                ),
+              },
+              {
+                value: 'none',
+                inputDisplay: i18nTexts.allocationOptions[phase].none.inputDisplay,
+                dropdownDisplay: (
+                  <>
+                    <strong>{i18nTexts.allocationOptions[phase].none.inputDisplay}</strong>
+                    <EuiText size="s" color="subdued">
+                      <p className="euiTextColor--subdued">
+                        {i18nTexts.allocationOptions[phase].none.helpText}
+                      </p>
+                    </EuiText>
+                  </>
+                ),
+              },
+              {
+                'data-test-subj': 'customDataAllocationOption',
+                value: 'custom',
+                inputDisplay: i18nTexts.allocationOptions[phase].custom.inputDisplay,
+                dropdownDisplay: (
+                  <>
+                    <strong>{i18nTexts.allocationOptions[phase].custom.inputDisplay}</strong>
+                    <EuiText size="s" color="subdued">
+                      <p className="euiTextColor--subdued">
+                        {i18nTexts.allocationOptions[phase].custom.helpText}
+                      </p>
+                    </EuiText>
+                  </>
+                ),
+              },
+            ] as SelectOptions[]
+          }
+        />
+      </EuiFormRow>
+      {phaseData.dataTierAllocationType === 'custom' && hasNodeAttributes && (
+        <>
+          <EuiSpacer size="s" />
+          <div className="indexLifecycleManagement__phase__dataTierAllocation__controlSection">
+            <NodeAllocation {...props} />
+          </div>
+        </>
+      )}
+    </div>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/default_allocation_warning.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/default_allocation_warning.tsx
new file mode 100644
index 0000000000000..a7ebc0d2e4a24
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/default_allocation_warning.tsx
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import React, { FunctionComponent } from 'react';
+import { EuiCallOut, EuiSpacer } from '@elastic/eui';
+
+import { PhaseWithAllocation } from '../../../../../../common/types';
+
+const i18nTexts = {
+  warm: {
+    title: i18n.translate(
+      'xpack.indexLifecycleMgmt.warmPhase.dataTier.defaultAllocationNotAvailableTitle',
+      { defaultMessage: 'No nodes assigned to the warm tier' }
+    ),
+    body: i18n.translate(
+      'xpack.indexLifecycleMgmt.warmPhase.dataTier.defaultAllocationNotAvailableBody',
+      {
+        defaultMessage:
+          'Assign at least one node to the warm tier to use role-based allocation. The policy will fail to complete allocation if there are no warm nodes.',
+      }
+    ),
+  },
+  cold: {
+    title: i18n.translate(
+      'xpack.indexLifecycleMgmt.coldPhase.dataTier.defaultAllocationNotAvailableTitle',
+      { defaultMessage: 'No nodes assigned to the cold tier' }
+    ),
+    body: i18n.translate(
+      'xpack.indexLifecycleMgmt.coldPhase.dataTier.defaultAllocationNotAvailableBody',
+      {
+        defaultMessage:
+          'Assign at least one node to the cold tier to use role-based allocation. The policy will fail to complete allocation if there are no cold nodes.',
+      }
+    ),
+  },
+  frozen: {
+    title: i18n.translate(
+      'xpack.indexLifecycleMgmt.frozenPhase.dataTier.defaultAllocationNotAvailableTitle',
+      { defaultMessage: 'No nodes assigned to the frozen tier' }
+    ),
+    body: i18n.translate(
+      'xpack.indexLifecycleMgmt.frozenPhase.dataTier.defaultAllocationNotAvailableBody',
+      {
+        defaultMessage:
+          'Assign at least one node to the frozen tier to use role-based allocation. The policy will fail to complete allocation if there are no frozen nodes.',
+      }
+    ),
+  },
+};
+
+interface Props {
+  phase: PhaseWithAllocation;
+}
+
+export const DefaultAllocationWarning: FunctionComponent<Props> = ({ phase }) => {
+  return (
+    <>
+      <EuiSpacer size="s" />
+      <EuiCallOut
+        data-test-subj="defaultAllocationWarning"
+        title={i18nTexts[phase].title}
+        color="warning"
+      >
+        {i18nTexts[phase].body}
+      </EuiCallOut>
+    </>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/index.ts b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/index.ts
new file mode 100644
index 0000000000000..26464a75ae14c
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/index.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { NodesDataProvider } from './node_data_provider';
+export { NodeAllocation } from './node_allocation';
+export { NodeAttrsDetails } from './node_attrs_details';
+export { DataTierAllocation } from './data_tier_allocation';
+export { DefaultAllocationWarning } from './default_allocation_warning';
+export { NoNodeAttributesWarning } from './no_node_attributes_warning';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/no_node_attributes_warning.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/no_node_attributes_warning.tsx
new file mode 100644
index 0000000000000..1ba82623c2b94
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/no_node_attributes_warning.tsx
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { EuiCallOut, EuiSpacer } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+import { PhaseWithAllocation } from '../../../../../../common/types';
+
+const i18nTexts = {
+  title: i18n.translate('xpack.indexLifecycleMgmt.editPolicy.nodeAttributesMissingLabel', {
+    defaultMessage: 'No custom node attributes configured',
+  }),
+  warm: {
+    body: i18n.translate(
+      'xpack.indexLifecycleMgmt.editPolicy.warm.nodeAttributesMissingDescription',
+      {
+        defaultMessage:
+          'Define custom node attributes in elasticsearch.yml to use attribute-based allocation. Warm nodes will be used instead.',
+      }
+    ),
+  },
+  cold: {
+    body: i18n.translate(
+      'xpack.indexLifecycleMgmt.editPolicy.cold.nodeAttributesMissingDescription',
+      {
+        defaultMessage:
+          'Define custom node attributes in elasticsearch.yml to use attribute-based allocation. Cold nodes will be used instead.',
+      }
+    ),
+  },
+  frozen: {
+    body: i18n.translate(
+      'xpack.indexLifecycleMgmt.editPolicy.frozen.nodeAttributesMissingDescription',
+      {
+        defaultMessage:
+          'Define custom node attributes in elasticsearch.yml to use attribute-based allocation. Frozen nodes will be used instead.',
+      }
+    ),
+  },
+};
+
+export const NoNodeAttributesWarning: FunctionComponent<{ phase: PhaseWithAllocation }> = ({
+  phase,
+}) => {
+  return (
+    <>
+      <EuiSpacer size="s" />
+      <EuiCallOut
+        data-test-subj="noNodeAttributesWarning"
+        style={{ maxWidth: 400 }}
+        title={i18nTexts.title}
+        color="warning"
+      >
+        {i18nTexts[phase].body}
+      </EuiCallOut>
+    </>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/node_allocation.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/node_allocation.tsx
new file mode 100644
index 0000000000000..a57a6ba4ff2c6
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/node_allocation.tsx
@@ -0,0 +1,121 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, FunctionComponent } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+import { EuiSelect, EuiButtonEmpty, EuiText, EuiSpacer } from '@elastic/eui';
+
+import { PhaseWithAllocationAction } from '../../../../../../common/types';
+import { propertyof } from '../../../../services/policies/policy_validation';
+
+import { ErrableFormRow } from '../form_errors';
+
+import { NodeAttrsDetails } from './node_attrs_details';
+import { SharedProps } from './types';
+import { LearnMoreLink } from '../learn_more_link';
+
+const learnMoreLink = (
+  <LearnMoreLink
+    text={
+      <FormattedMessage
+        id="xpack.indexLifecycleMgmt.editPolicy.learnAboutShardAllocationLink"
+        defaultMessage="Learn about shard allocation"
+      />
+    }
+    docPath="modules-cluster.html#cluster-shard-allocation-settings"
+  />
+);
+
+const i18nTexts = {
+  doNotModifyAllocationOption: i18n.translate(
+    'xpack.indexLifecycleMgmt.editPolicy.nodeAllocation.doNotModifyAllocationOption',
+    { defaultMessage: 'Do not modify allocation configuration' }
+  ),
+};
+
+export const NodeAllocation: FunctionComponent<SharedProps> = ({
+  phase,
+  setPhaseData,
+  errors,
+  phaseData,
+  isShowingErrors,
+  nodes,
+}) => {
+  const [selectedNodeAttrsForDetails, setSelectedNodeAttrsForDetails] = useState<string | null>(
+    null
+  );
+
+  const nodeOptions = Object.keys(nodes).map((attrs) => ({
+    text: `${attrs} (${nodes[attrs].length})`,
+    value: attrs,
+  }));
+
+  nodeOptions.sort((a, b) => a.value.localeCompare(b.value));
+
+  // check that this string is a valid property
+  const nodeAttrsProperty = propertyof<PhaseWithAllocationAction>('selectedNodeAttrs');
+
+  return (
+    <>
+      <EuiText size="s">
+        <p>
+          <FormattedMessage
+            id="xpack.indexLifecycleMgmt.editPolicy.nodeAllocation.customOption.description"
+            defaultMessage="Use node attributes to control shard allocation. {learnMoreLink}."
+            values={{ learnMoreLink }}
+          />
+        </p>
+      </EuiText>
+      <EuiSpacer size="m" />
+
+      {/*
+        TODO: this field component must be revisited to support setting multiple require values and to support
+        setting `include and exclude values on ILM policies. See https://github.com/elastic/kibana/issues/77344
+      */}
+      <ErrableFormRow
+        id={`${phase}-${nodeAttrsProperty}`}
+        label={i18n.translate('xpack.indexLifecycleMgmt.editPolicy.nodeAllocationLabel', {
+          defaultMessage: 'Select a node attribute',
+        })}
+        isShowingErrors={isShowingErrors}
+        errors={errors?.selectedNodeAttrs}
+        helpText={
+          !!phaseData.selectedNodeAttrs ? (
+            <EuiButtonEmpty
+              size="xs"
+              style={{ maxWidth: 400 }}
+              data-test-subj={`${phase}-viewNodeDetailsFlyoutButton`}
+              flush="left"
+              onClick={() => setSelectedNodeAttrsForDetails(phaseData.selectedNodeAttrs)}
+            >
+              <FormattedMessage
+                id="xpack.indexLifecycleMgmt.editPolicy.viewNodeDetailsButton"
+                defaultMessage="View nodes with the selected attribute"
+              />
+            </EuiButtonEmpty>
+          ) : null
+        }
+      >
+        <EuiSelect
+          id={`${phase}-${nodeAttrsProperty}`}
+          value={phaseData.selectedNodeAttrs || ' '}
+          options={[{ text: i18nTexts.doNotModifyAllocationOption, value: '' }].concat(nodeOptions)}
+          onChange={(e) => {
+            setPhaseData(nodeAttrsProperty, e.target.value);
+          }}
+        />
+      </ErrableFormRow>
+
+      {selectedNodeAttrsForDetails ? (
+        <NodeAttrsDetails
+          selectedNodeAttrs={selectedNodeAttrsForDetails}
+          close={() => setSelectedNodeAttrsForDetails(null)}
+        />
+      ) : null}
+    </>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_attrs_details.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/node_attrs_details.tsx
similarity index 97%
rename from x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_attrs_details.tsx
rename to x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/node_attrs_details.tsx
index af8833c8082b3..c29495d13eb8e 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_attrs_details.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/node_attrs_details.tsx
@@ -20,7 +20,7 @@ import {
   EuiButton,
 } from '@elastic/eui';
 
-import { useLoadNodeDetails } from '../../../services/api';
+import { useLoadNodeDetails } from '../../../../services/api';
 
 interface Props {
   close: () => void;
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/node_data_provider.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/node_data_provider.tsx
new file mode 100644
index 0000000000000..a7c0f3ec7c866
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/node_data_provider.tsx
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { EuiButton, EuiCallOut, EuiLoadingSpinner, EuiSpacer } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import { ListNodesRouteResponse } from '../../../../../../common/types';
+import { useLoadNodes } from '../../../../services/api';
+
+interface Props {
+  children: (data: ListNodesRouteResponse) => JSX.Element;
+}
+
+export const NodesDataProvider = ({ children }: Props): JSX.Element => {
+  const { isLoading, data, error, resendRequest } = useLoadNodes();
+
+  if (isLoading) {
+    return (
+      <>
+        <EuiLoadingSpinner size="xl" />
+        <EuiSpacer size="m" />
+      </>
+    );
+  }
+
+  const renderError = () => {
+    if (error) {
+      const { statusCode, message } = error;
+      return (
+        <>
+          <EuiCallOut
+            style={{ maxWidth: 400 }}
+            title={
+              <FormattedMessage
+                id="xpack.indexLifecycleMgmt.editPolicy.nodeAttributesLoadingFailedTitle"
+                defaultMessage="Unable to load node attributes"
+              />
+            }
+            color="danger"
+          >
+            <p>
+              {message} ({statusCode})
+            </p>
+            <EuiButton onClick={resendRequest} iconType="refresh" color="danger">
+              <FormattedMessage
+                id="xpack.indexLifecycleMgmt.editPolicy.nodeAttributesReloadButton"
+                defaultMessage="Try again"
+              />
+            </EuiButton>
+          </EuiCallOut>
+
+          <EuiSpacer size="xl" />
+        </>
+      );
+    }
+    return null;
+  };
+
+  return (
+    <>
+      {renderError()}
+      {/* `data` will always be defined because we use an initial value when loading */}
+      {children(data!)}
+    </>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/types.ts b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/types.ts
new file mode 100644
index 0000000000000..d4cb31a3be9e7
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/data_tier_allocation/types.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  ListNodesRouteResponse,
+  PhaseWithAllocation,
+  PhaseWithAllocationAction,
+} from '../../../../../../common/types';
+import { PhaseValidationErrors } from '../../../../services/policies/policy_validation';
+
+export interface SharedProps {
+  phase: PhaseWithAllocation;
+  errors?: PhaseValidationErrors<PhaseWithAllocationAction>;
+  phaseData: PhaseWithAllocationAction;
+  setPhaseData: (dataKey: keyof PhaseWithAllocationAction, value: string) => void;
+  isShowingErrors: boolean;
+  nodes: ListNodesRouteResponse['nodesByAttributes'];
+  hasNodeAttributes: boolean;
+}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/described_form_field.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/described_form_field.tsx
new file mode 100644
index 0000000000000..7bf8cd3ba6d90
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/described_form_field.tsx
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { EuiDescribedFormGroup, EuiDescribedFormGroupProps } from '@elastic/eui';
+
+import { ToggleableField, Props as ToggleableFieldProps } from './toggleable_field';
+
+type Props = EuiDescribedFormGroupProps & {
+  switchProps: ToggleableFieldProps;
+};
+
+export const DescribedFormField: FunctionComponent<Props> = ({
+  children,
+  switchProps,
+  ...restDescribedFormProps
+}) => {
+  return (
+    <EuiDescribedFormGroup {...restDescribedFormProps}>
+      <ToggleableField {...switchProps}>{children}</ToggleableField>
+    </EuiDescribedFormGroup>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/index.ts b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/index.ts
index 4410c4bb38397..2428cade0898e 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/index.ts
@@ -8,11 +8,17 @@ export { ActiveBadge } from './active_badge';
 export { ErrableFormRow } from './form_errors';
 export { LearnMoreLink } from './learn_more_link';
 export { MinAgeInput } from './min_age_input';
-export { NodeAllocation } from './node_allocation';
-export { NodeAttrsDetails } from './node_attrs_details';
 export { OptionalLabel } from './optional_label';
 export { PhaseErrorMessage } from './phase_error_message';
 export { PolicyJsonFlyout } from './policy_json_flyout';
 export { SetPriorityInput } from './set_priority_input';
 export { SnapshotPolicies } from './snapshot_policies';
+export {
+  DataTierAllocation,
+  NodeAllocation,
+  NodeAttrsDetails,
+  NodesDataProvider,
+  DefaultAllocationWarning,
+} from './data_tier_allocation';
+export { DescribedFormField } from './described_form_field';
 export { Forcemerge } from './forcemerge';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx
deleted file mode 100644
index 6a22d8716514c..0000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx
+++ /dev/null
@@ -1,189 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { Fragment, useState } from 'react';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { i18n } from '@kbn/i18n';
-import {
-  EuiSelect,
-  EuiButtonEmpty,
-  EuiCallOut,
-  EuiSpacer,
-  EuiLoadingSpinner,
-  EuiButton,
-} from '@elastic/eui';
-
-import { LearnMoreLink } from './learn_more_link';
-import { ErrableFormRow } from './form_errors';
-import { useLoadNodes } from '../../../services/api';
-import { NodeAttrsDetails } from './node_attrs_details';
-import { PhaseWithAllocationAction, Phases } from '../../../../../common/types';
-import { PhaseValidationErrors, propertyof } from '../../../services/policies/policy_validation';
-
-const learnMoreLink = (
-  <Fragment>
-    <EuiSpacer size="m" />
-    <LearnMoreLink
-      text={
-        <FormattedMessage
-          id="xpack.indexLifecycleMgmt.editPolicy.learnAboutShardAllocationLink"
-          defaultMessage="Learn about shard allocation"
-        />
-      }
-      docPath="modules-cluster.html#cluster-shard-allocation-settings"
-    />
-  </Fragment>
-);
-
-interface Props<T extends PhaseWithAllocationAction> {
-  phase: keyof Phases & string;
-  errors?: PhaseValidationErrors<T>;
-  phaseData: T;
-  setPhaseData: (dataKey: keyof T & string, value: string) => void;
-  isShowingErrors: boolean;
-}
-export const NodeAllocation = <T extends PhaseWithAllocationAction>({
-  phase,
-  setPhaseData,
-  errors,
-  phaseData,
-  isShowingErrors,
-}: React.PropsWithChildren<Props<T>>) => {
-  const { isLoading, data: nodes, error, resendRequest } = useLoadNodes();
-
-  const [selectedNodeAttrsForDetails, setSelectedNodeAttrsForDetails] = useState<string | null>(
-    null
-  );
-
-  if (isLoading) {
-    return (
-      <Fragment>
-        <EuiLoadingSpinner size="xl" />
-        <EuiSpacer size="m" />
-      </Fragment>
-    );
-  }
-
-  if (error) {
-    const { statusCode, message } = error;
-    return (
-      <Fragment>
-        <EuiCallOut
-          style={{ maxWidth: 400 }}
-          title={
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.editPolicy.nodeAttributesLoadingFailedTitle"
-              defaultMessage="Unable to load node attributes"
-            />
-          }
-          color="danger"
-        >
-          <p>
-            {message} ({statusCode})
-          </p>
-          <EuiButton onClick={resendRequest} iconType="refresh" color="danger">
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.editPolicy.nodeAttributesReloadButton"
-              defaultMessage="Try again"
-            />
-          </EuiButton>
-        </EuiCallOut>
-
-        <EuiSpacer size="xl" />
-      </Fragment>
-    );
-  }
-
-  let nodeOptions = Object.keys(nodes).map((attrs) => ({
-    text: `${attrs} (${nodes[attrs].length})`,
-    value: attrs,
-  }));
-
-  nodeOptions.sort((a, b) => a.value.localeCompare(b.value));
-  if (nodeOptions.length) {
-    nodeOptions = [
-      {
-        text: i18n.translate('xpack.indexLifecycleMgmt.editPolicy.defaultNodeAllocation', {
-          defaultMessage: "Default allocation (don't use attributes)",
-        }),
-        value: '',
-      },
-      ...nodeOptions,
-    ];
-  }
-  if (!nodeOptions.length) {
-    return (
-      <Fragment>
-        <EuiCallOut
-          style={{ maxWidth: 400 }}
-          title={
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.editPolicy.nodeAttributesMissingLabel"
-              defaultMessage="No node attributes configured in elasticsearch.yml"
-            />
-          }
-          color="warning"
-        >
-          <FormattedMessage
-            id="xpack.indexLifecycleMgmt.editPolicy.nodeAttributesMissingDescription"
-            defaultMessage="You can't control shard allocation without node attributes."
-          />
-          {learnMoreLink}
-        </EuiCallOut>
-
-        <EuiSpacer size="xl" />
-      </Fragment>
-    );
-  }
-
-  // check that this string is a valid property
-  const nodeAttrsProperty = propertyof<T>('selectedNodeAttrs');
-
-  return (
-    <Fragment>
-      <ErrableFormRow
-        id={`${phase}-${nodeAttrsProperty}`}
-        label={i18n.translate('xpack.indexLifecycleMgmt.editPolicy.nodeAllocationLabel', {
-          defaultMessage: 'Select a node attribute to control shard allocation',
-        })}
-        isShowingErrors={isShowingErrors}
-        errors={errors?.selectedNodeAttrs}
-      >
-        <EuiSelect
-          id={`${phase}-${nodeAttrsProperty}`}
-          value={phaseData.selectedNodeAttrs || ' '}
-          options={nodeOptions}
-          onChange={(e) => {
-            setPhaseData(nodeAttrsProperty, e.target.value);
-          }}
-        />
-      </ErrableFormRow>
-      {!!phaseData.selectedNodeAttrs ? (
-        <EuiButtonEmpty
-          style={{ maxWidth: 400 }}
-          data-test-subj={`${phase}-viewNodeDetailsFlyoutButton`}
-          flush="left"
-          iconType="eye"
-          onClick={() => setSelectedNodeAttrsForDetails(phaseData.selectedNodeAttrs)}
-        >
-          <FormattedMessage
-            id="xpack.indexLifecycleMgmt.editPolicy.viewNodeDetailsButton"
-            defaultMessage="View a list of nodes attached to this configuration"
-          />
-        </EuiButtonEmpty>
-      ) : null}
-      {learnMoreLink}
-      <EuiSpacer size="m" />
-
-      {selectedNodeAttrsForDetails ? (
-        <NodeAttrsDetails
-          selectedNodeAttrs={selectedNodeAttrsForDetails}
-          close={() => setSelectedNodeAttrsForDetails(null)}
-        />
-      ) : null}
-    </Fragment>
-  );
-};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/toggleable_field.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/toggleable_field.tsx
new file mode 100644
index 0000000000000..ff4301808db33
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/toggleable_field.tsx
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent, useState } from 'react';
+import { EuiSpacer, EuiSwitch, EuiSwitchProps } from '@elastic/eui';
+
+export interface Props extends Omit<EuiSwitchProps, 'checked' | 'onChange'> {
+  initialValue: boolean;
+  onChange: (nextValue: boolean) => void;
+}
+
+export const ToggleableField: FunctionComponent<Props> = ({
+  initialValue,
+  onChange,
+  children,
+  ...restProps
+}) => {
+  const [isContentVisible, setIsContentVisible] = useState<boolean>(initialValue);
+
+  return (
+    <>
+      <EuiSwitch
+        {...restProps}
+        checked={isContentVisible}
+        onChange={(e) => {
+          const nextValue = e.target.checked;
+          setIsContentVisible(nextValue);
+          onChange(nextValue);
+        }}
+      />
+      <EuiSpacer size="m" />
+      {isContentVisible ? children : null}
+    </>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.tsx
index f1c287788e08d..85529ef0c9a5b 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { Fragment, useEffect, useState } from 'react';
+import React, { Fragment, useEffect, useState, useCallback } from 'react';
 import { RouteComponentProps } from 'react-router-dom';
 import { FormattedMessage } from '@kbn/i18n/react';
 
@@ -45,7 +45,7 @@ import {
 import { ErrableFormRow, LearnMoreLink, PolicyJsonFlyout } from './components';
 import { ColdPhase, DeletePhase, FrozenPhase, HotPhase, WarmPhase } from './phases';
 
-interface Props {
+export interface Props {
   policies: PolicyFromES[];
   policyName: string;
   getUrlForApp: (
@@ -119,15 +119,39 @@ export const EditPolicy: React.FunctionComponent<Props> = ({
     setIsShowingPolicyJsonFlyout(!isShowingPolicyJsonFlyout);
   };
 
-  const setPhaseData = (phase: keyof Phases, key: string, value: any) => {
-    setPolicy({
-      ...policy,
-      phases: {
-        ...policy.phases,
-        [phase]: { ...policy.phases[phase], [key]: value },
-      },
-    });
-  };
+  const setPhaseData = useCallback(
+    (phase: keyof Phases, key: string, value: any) => {
+      setPolicy((nextPolicy) => ({
+        ...nextPolicy,
+        phases: {
+          ...nextPolicy.phases,
+          [phase]: { ...nextPolicy.phases[phase], [key]: value },
+        },
+      }));
+    },
+    [setPolicy]
+  );
+
+  const setHotPhaseData = useCallback(
+    (key: string, value: any) => setPhaseData('hot', key, value),
+    [setPhaseData]
+  );
+  const setWarmPhaseData = useCallback(
+    (key: string, value: any) => setPhaseData('warm', key, value),
+    [setPhaseData]
+  );
+  const setColdPhaseData = useCallback(
+    (key: string, value: any) => setPhaseData('cold', key, value),
+    [setPhaseData]
+  );
+  const setFrozenPhaseData = useCallback(
+    (key: string, value: any) => setPhaseData('frozen', key, value),
+    [setPhaseData]
+  );
+  const setDeletePhaseData = useCallback(
+    (key: string, value: any) => setPhaseData('delete', key, value),
+    [setPhaseData]
+  );
 
   const setWarmPhaseOnRollover = (value: boolean) => {
     setPolicy({
@@ -277,7 +301,7 @@ export const EditPolicy: React.FunctionComponent<Props> = ({
             <HotPhase
               errors={errors?.hot}
               isShowingErrors={isShowingErrors && !!errors && Object.keys(errors.hot).length > 0}
-              setPhaseData={(key, value) => setPhaseData('hot', key, value)}
+              setPhaseData={setHotPhaseData}
               phaseData={policy.phases.hot}
               setWarmPhaseOnRollover={setWarmPhaseOnRollover}
             />
@@ -287,7 +311,7 @@ export const EditPolicy: React.FunctionComponent<Props> = ({
             <WarmPhase
               errors={errors?.warm}
               isShowingErrors={isShowingErrors && !!errors && Object.keys(errors.warm).length > 0}
-              setPhaseData={(key, value) => setPhaseData('warm', key, value)}
+              setPhaseData={setWarmPhaseData}
               phaseData={policy.phases.warm}
               hotPhaseRolloverEnabled={policy.phases.hot.rolloverEnabled}
             />
@@ -297,7 +321,7 @@ export const EditPolicy: React.FunctionComponent<Props> = ({
             <ColdPhase
               errors={errors?.cold}
               isShowingErrors={isShowingErrors && !!errors && Object.keys(errors.cold).length > 0}
-              setPhaseData={(key, value) => setPhaseData('cold', key, value)}
+              setPhaseData={setColdPhaseData}
               phaseData={policy.phases.cold}
               hotPhaseRolloverEnabled={policy.phases.hot.rolloverEnabled}
             />
@@ -307,7 +331,7 @@ export const EditPolicy: React.FunctionComponent<Props> = ({
             <FrozenPhase
               errors={errors?.frozen}
               isShowingErrors={isShowingErrors && !!errors && Object.keys(errors.frozen).length > 0}
-              setPhaseData={(key, value) => setPhaseData('frozen', key, value)}
+              setPhaseData={setFrozenPhaseData}
               phaseData={policy.phases.frozen}
               hotPhaseRolloverEnabled={policy.phases.hot.rolloverEnabled}
             />
@@ -318,7 +342,7 @@ export const EditPolicy: React.FunctionComponent<Props> = ({
               errors={errors?.delete}
               isShowingErrors={isShowingErrors && !!errors && Object.keys(errors.delete).length > 0}
               getUrlForApp={getUrlForApp}
-              setPhaseData={(key, value) => setPhaseData('delete', key, value)}
+              setPhaseData={setDeletePhaseData}
               phaseData={policy.phases.delete}
               hotPhaseRolloverEnabled={policy.phases.hot.rolloverEnabled}
             />
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/cold_phase.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/cold_phase.tsx
index ae2858e7a84ae..241a98fffa6df 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/cold_phase.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/cold_phase.tsx
@@ -4,19 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { PureComponent, Fragment } from 'react';
+import React, { FunctionComponent, Fragment } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-  EuiFieldNumber,
-  EuiDescribedFormGroup,
-  EuiSwitch,
-  EuiTextColor,
-} from '@elastic/eui';
+import { EuiFieldNumber, EuiDescribedFormGroup, EuiSwitch, EuiTextColor } from '@elastic/eui';
 
 import { ColdPhase as ColdPhaseInterface, Phases } from '../../../../../common/types';
 import { PhaseValidationErrors } from '../../../services/policies/policy_validation';
@@ -27,14 +19,24 @@ import {
   PhaseErrorMessage,
   OptionalLabel,
   ErrableFormRow,
-  MinAgeInput,
-  NodeAllocation,
   SetPriorityInput,
+  MinAgeInput,
+  DescribedFormField,
 } from '../components';
 
-const freezeLabel = i18n.translate('xpack.indexLifecycleMgmt.coldPhase.freezeIndexLabel', {
-  defaultMessage: 'Freeze index',
-});
+import { DataTierAllocationField } from './shared';
+
+const i18nTexts = {
+  freezeLabel: i18n.translate('xpack.indexLifecycleMgmt.coldPhase.freezeIndexLabel', {
+    defaultMessage: 'Freeze index',
+  }),
+  dataTierAllocation: {
+    description: i18n.translate('xpack.indexLifecycleMgmt.coldPhase.dataTier.description', {
+      defaultMessage:
+        'Move data to data nodes optimized for less frequent, read-only access. Store cold data on less-expensive hardware.',
+    }),
+  },
+};
 
 const coldProperty: keyof Phases = 'cold';
 const phaseProperty = (propertyName: keyof ColdPhaseInterface) => propertyName;
@@ -46,18 +48,17 @@ interface Props {
   errors?: PhaseValidationErrors<ColdPhaseInterface>;
   hotPhaseRolloverEnabled: boolean;
 }
-export class ColdPhase extends PureComponent<Props> {
-  render() {
-    const {
-      setPhaseData,
-      phaseData,
-      errors,
-      isShowingErrors,
-      hotPhaseRolloverEnabled,
-    } = this.props;
-
-    return (
-      <div id="coldPhaseContent" aria-live="polite" role="region">
+export const ColdPhase: FunctionComponent<Props> = ({
+  setPhaseData,
+  phaseData,
+  errors,
+  isShowingErrors,
+  hotPhaseRolloverEnabled,
+}) => {
+  return (
+    <div id="coldPhaseContent" aria-live="polite" role="region">
+      <>
+        {/* Section title group; containing min age */}
         <EuiDescribedFormGroup
           title={
             <div>
@@ -86,7 +87,7 @@ export class ColdPhase extends PureComponent<Props> {
                 data-test-subj="enablePhaseSwitch-cold"
                 label={
                   <FormattedMessage
-                    id="xpack.indexLifecycleMgmt.editPolicy.coldPhase.activateWarmPhaseSwitchLabel"
+                    id="xpack.indexLifecycleMgmt.editPolicy.coldPhase.activateColdPhaseSwitchLabel"
                     defaultMessage="Activate cold phase"
                   />
                 }
@@ -101,68 +102,83 @@ export class ColdPhase extends PureComponent<Props> {
           }
           fullWidth
         >
-          <Fragment>
-            {phaseData.phaseEnabled ? (
-              <Fragment>
-                <MinAgeInput<ColdPhaseInterface>
-                  errors={errors}
-                  phaseData={phaseData}
-                  phase={coldProperty}
-                  isShowingErrors={isShowingErrors}
-                  setPhaseData={setPhaseData}
-                  rolloverEnabled={hotPhaseRolloverEnabled}
-                />
-                <EuiSpacer />
-
-                <NodeAllocation<ColdPhaseInterface>
-                  phase={coldProperty}
-                  setPhaseData={setPhaseData}
-                  errors={errors}
-                  phaseData={phaseData}
-                  isShowingErrors={isShowingErrors}
-                />
-
-                <EuiFlexGroup>
-                  <EuiFlexItem grow={false} style={{ maxWidth: 188 }}>
-                    <ErrableFormRow
-                      id={`${coldProperty}-${phaseProperty('freezeEnabled')}`}
-                      label={
-                        <Fragment>
-                          <FormattedMessage
-                            id="xpack.indexLifecycleMgmt.coldPhase.numberOfReplicasLabel"
-                            defaultMessage="Number of replicas"
-                          />
-                          <OptionalLabel />
-                        </Fragment>
-                      }
-                      isShowingErrors={isShowingErrors}
-                      errors={errors?.freezeEnabled}
-                      helpText={i18n.translate(
-                        'xpack.indexLifecycleMgmt.coldPhase.replicaCountHelpText',
-                        {
-                          defaultMessage: 'By default, the number of replicas remains the same.',
-                        }
-                      )}
-                    >
-                      <EuiFieldNumber
-                        id={`${coldProperty}-${phaseProperty('selectedReplicaCount')}`}
-                        value={phaseData.selectedReplicaCount}
-                        onChange={(e) => {
-                          setPhaseData(phaseProperty('selectedReplicaCount'), e.target.value);
-                        }}
-                        min={0}
-                      />
-                    </ErrableFormRow>
-                  </EuiFlexItem>
-                </EuiFlexGroup>
-              </Fragment>
-            ) : (
-              <div />
-            )}
-          </Fragment>
+          {phaseData.phaseEnabled ? (
+            <MinAgeInput<ColdPhaseInterface>
+              errors={errors}
+              phaseData={phaseData}
+              phase={coldProperty}
+              isShowingErrors={isShowingErrors}
+              setPhaseData={setPhaseData}
+              rolloverEnabled={hotPhaseRolloverEnabled}
+            />
+          ) : null}
         </EuiDescribedFormGroup>
         {phaseData.phaseEnabled ? (
           <Fragment>
+            {/* Data tier allocation section */}
+            <DataTierAllocationField
+              description={i18nTexts.dataTierAllocation.description}
+              phase={coldProperty}
+              setPhaseData={setPhaseData}
+              isShowingErrors={isShowingErrors}
+              phaseData={phaseData}
+            />
+
+            {/* Replicas section */}
+            <DescribedFormField
+              title={
+                <h3>
+                  {i18n.translate('xpack.indexLifecycleMgmt.coldPhase.replicasTitle', {
+                    defaultMessage: 'Replicas',
+                  })}
+                </h3>
+              }
+              description={i18n.translate(
+                'xpack.indexLifecycleMgmt.coldPhase.numberOfReplicasDescription',
+                {
+                  defaultMessage:
+                    'Set the number of replicas. Remains the same as the previous phase by default.',
+                }
+              )}
+              switchProps={{
+                label: i18n.translate(
+                  'xpack.indexLifecycleMgmt.editPolicy.coldPhase.numberOfReplicas.switchLabel',
+                  { defaultMessage: 'Set replicas' }
+                ),
+                initialValue: Boolean(phaseData.selectedReplicaCount),
+                onChange: (v) => {
+                  if (!v) {
+                    setPhaseData('selectedReplicaCount', '');
+                  }
+                },
+              }}
+              fullWidth
+            >
+              <ErrableFormRow
+                id={`${coldProperty}-${phaseProperty('selectedReplicaCount')}`}
+                label={
+                  <Fragment>
+                    <FormattedMessage
+                      id="xpack.indexLifecycleMgmt.coldPhase.numberOfReplicasLabel"
+                      defaultMessage="Number of replicas"
+                    />
+                    <OptionalLabel />
+                  </Fragment>
+                }
+                isShowingErrors={isShowingErrors}
+                errors={errors?.selectedReplicaCount}
+              >
+                <EuiFieldNumber
+                  id={`${coldProperty}-${phaseProperty('selectedReplicaCount')}`}
+                  value={phaseData.selectedReplicaCount}
+                  onChange={(e) => {
+                    setPhaseData(phaseProperty('selectedReplicaCount'), e.target.value);
+                  }}
+                  min={0}
+                />
+              </ErrableFormRow>
+            </DescribedFormField>
+            {/* Freeze section */}
             <EuiDescribedFormGroup
               title={
                 <h3>
@@ -191,8 +207,8 @@ export class ColdPhase extends PureComponent<Props> {
                 onChange={(e) => {
                   setPhaseData(phaseProperty('freezeEnabled'), e.target.checked);
                 }}
-                label={freezeLabel}
-                aria-label={freezeLabel}
+                label={i18nTexts.freezeLabel}
+                aria-label={i18nTexts.freezeLabel}
               />
             </EuiDescribedFormGroup>
             <SetPriorityInput<ColdPhaseInterface>
@@ -204,7 +220,7 @@ export class ColdPhase extends PureComponent<Props> {
             />
           </Fragment>
         ) : null}
-      </div>
-    );
-  }
-}
+      </>
+    </div>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/frozen_phase.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/frozen_phase.tsx
index bfaf141438169..6a849cc2c3f1f 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/frozen_phase.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/frozen_phase.tsx
@@ -4,19 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { PureComponent, Fragment } from 'react';
+import React, { FunctionComponent, Fragment } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-  EuiFieldNumber,
-  EuiDescribedFormGroup,
-  EuiSwitch,
-  EuiTextColor,
-} from '@elastic/eui';
+import { EuiFieldNumber, EuiDescribedFormGroup, EuiSwitch, EuiTextColor } from '@elastic/eui';
 
 import { FrozenPhase as FrozenPhaseInterface, Phases } from '../../../../../common/types';
 import { PhaseValidationErrors } from '../../../services/policies/policy_validation';
@@ -28,13 +20,22 @@ import {
   OptionalLabel,
   ErrableFormRow,
   MinAgeInput,
-  NodeAllocation,
   SetPriorityInput,
+  DescribedFormField,
 } from '../components';
+import { DataTierAllocationField } from './shared';
 
-const freezeLabel = i18n.translate('xpack.indexLifecycleMgmt.frozenPhase.freezeIndexLabel', {
-  defaultMessage: 'Freeze index',
-});
+const i18nTexts = {
+  freezeLabel: i18n.translate('xpack.indexLifecycleMgmt.frozenPhase.freezeIndexLabel', {
+    defaultMessage: 'Freeze index',
+  }),
+  dataTierAllocation: {
+    description: i18n.translate('xpack.indexLifecycleMgmt.frozenPhase.dataTier.description', {
+      defaultMessage:
+        'Move data to data nodes optimized for infrequent, read-only access. Store frozen data on the least-expensive hardware.',
+    }),
+  },
+};
 
 const frozenProperty: keyof Phases = 'frozen';
 const phaseProperty = (propertyName: keyof FrozenPhaseInterface) => propertyName;
@@ -46,18 +47,17 @@ interface Props {
   errors?: PhaseValidationErrors<FrozenPhaseInterface>;
   hotPhaseRolloverEnabled: boolean;
 }
-export class FrozenPhase extends PureComponent<Props> {
-  render() {
-    const {
-      setPhaseData,
-      phaseData,
-      errors,
-      isShowingErrors,
-      hotPhaseRolloverEnabled,
-    } = this.props;
-
-    return (
-      <div id="frozenPhaseContent" aria-live="polite" role="region">
+export const FrozenPhase: FunctionComponent<Props> = ({
+  setPhaseData,
+  phaseData,
+  errors,
+  isShowingErrors,
+  hotPhaseRolloverEnabled,
+}) => {
+  return (
+    <div id="frozenPhaseContent" aria-live="polite" role="region">
+      <>
+        {/* Section title group; containing min age */}
         <EuiDescribedFormGroup
           title={
             <div>
@@ -101,68 +101,82 @@ export class FrozenPhase extends PureComponent<Props> {
           }
           fullWidth
         >
-          <Fragment>
-            {phaseData.phaseEnabled ? (
-              <Fragment>
-                <MinAgeInput<FrozenPhaseInterface>
-                  errors={errors}
-                  phaseData={phaseData}
-                  phase={frozenProperty}
-                  isShowingErrors={isShowingErrors}
-                  setPhaseData={setPhaseData}
-                  rolloverEnabled={hotPhaseRolloverEnabled}
-                />
-                <EuiSpacer />
-
-                <NodeAllocation<FrozenPhaseInterface>
-                  phase={frozenProperty}
-                  setPhaseData={setPhaseData}
-                  errors={errors}
-                  phaseData={phaseData}
-                  isShowingErrors={isShowingErrors}
-                />
-
-                <EuiFlexGroup>
-                  <EuiFlexItem grow={false} style={{ maxWidth: 188 }}>
-                    <ErrableFormRow
-                      id={`${frozenProperty}-${phaseProperty('freezeEnabled')}`}
-                      label={
-                        <Fragment>
-                          <FormattedMessage
-                            id="xpack.indexLifecycleMgmt.frozenPhase.numberOfReplicasLabel"
-                            defaultMessage="Number of replicas"
-                          />
-                          <OptionalLabel />
-                        </Fragment>
-                      }
-                      isShowingErrors={isShowingErrors}
-                      errors={errors?.freezeEnabled}
-                      helpText={i18n.translate(
-                        'xpack.indexLifecycleMgmt.frozenPhase.replicaCountHelpText',
-                        {
-                          defaultMessage: 'By default, the number of replicas remains the same.',
-                        }
-                      )}
-                    >
-                      <EuiFieldNumber
-                        id={`${frozenProperty}-${phaseProperty('selectedReplicaCount')}`}
-                        value={phaseData.selectedReplicaCount}
-                        onChange={(e) => {
-                          setPhaseData(phaseProperty('selectedReplicaCount'), e.target.value);
-                        }}
-                        min={0}
-                      />
-                    </ErrableFormRow>
-                  </EuiFlexItem>
-                </EuiFlexGroup>
-              </Fragment>
-            ) : (
-              <div />
-            )}
-          </Fragment>
+          {phaseData.phaseEnabled ? (
+            <MinAgeInput<FrozenPhaseInterface>
+              errors={errors}
+              phaseData={phaseData}
+              phase={frozenProperty}
+              isShowingErrors={isShowingErrors}
+              setPhaseData={setPhaseData}
+              rolloverEnabled={hotPhaseRolloverEnabled}
+            />
+          ) : null}
         </EuiDescribedFormGroup>
         {phaseData.phaseEnabled ? (
           <Fragment>
+            {/* Data tier allocation section */}
+            <DataTierAllocationField
+              description={i18nTexts.dataTierAllocation.description}
+              phase={frozenProperty}
+              setPhaseData={setPhaseData}
+              isShowingErrors={isShowingErrors}
+              phaseData={phaseData}
+            />
+
+            {/* Replicas section */}
+            <DescribedFormField
+              title={
+                <h3>
+                  {i18n.translate('xpack.indexLifecycleMgmt.frozenPhase.replicasTitle', {
+                    defaultMessage: 'Replicas',
+                  })}
+                </h3>
+              }
+              description={i18n.translate(
+                'xpack.indexLifecycleMgmt.frozenPhase.numberOfReplicasDescription',
+                {
+                  defaultMessage:
+                    'Set the number of replicas. Remains the same as the previous phase by default.',
+                }
+              )}
+              switchProps={{
+                label: i18n.translate(
+                  'xpack.indexLifecycleMgmt.editPolicy.frozenPhase.numberOfReplicas.switchLabel',
+                  { defaultMessage: 'Set replicas' }
+                ),
+                initialValue: Boolean(phaseData.selectedReplicaCount),
+                onChange: (v) => {
+                  if (!v) {
+                    setPhaseData('selectedReplicaCount', '');
+                  }
+                },
+              }}
+              fullWidth
+            >
+              <ErrableFormRow
+                id={`${frozenProperty}-${phaseProperty('selectedReplicaCount')}`}
+                label={
+                  <Fragment>
+                    <FormattedMessage
+                      id="xpack.indexLifecycleMgmt.frozenPhase.numberOfReplicasLabel"
+                      defaultMessage="Number of replicas"
+                    />
+                    <OptionalLabel />
+                  </Fragment>
+                }
+                isShowingErrors={isShowingErrors}
+                errors={errors?.selectedReplicaCount}
+              >
+                <EuiFieldNumber
+                  id={`${frozenProperty}-${phaseProperty('selectedReplicaCount')}`}
+                  value={phaseData.selectedReplicaCount}
+                  onChange={(e) => {
+                    setPhaseData(phaseProperty('selectedReplicaCount'), e.target.value);
+                  }}
+                  min={0}
+                />
+              </ErrableFormRow>
+            </DescribedFormField>
             <EuiDescribedFormGroup
               title={
                 <h3>
@@ -191,8 +205,8 @@ export class FrozenPhase extends PureComponent<Props> {
                 onChange={(e) => {
                   setPhaseData(phaseProperty('freezeEnabled'), e.target.checked);
                 }}
-                label={freezeLabel}
-                aria-label={freezeLabel}
+                label={i18nTexts.freezeLabel}
+                aria-label={i18nTexts.freezeLabel}
               />
             </EuiDescribedFormGroup>
             <SetPriorityInput<FrozenPhaseInterface>
@@ -204,7 +218,7 @@ export class FrozenPhase extends PureComponent<Props> {
             />
           </Fragment>
         ) : null}
-      </div>
-    );
-  }
-}
+      </>
+    </div>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/shared/data_tier_allocation_field.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/shared/data_tier_allocation_field.tsx
new file mode 100644
index 0000000000000..6475e5286a778
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/shared/data_tier_allocation_field.tsx
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiDescribedFormGroup, EuiFormRow } from '@elastic/eui';
+
+import { PhaseWithAllocationAction, PhaseWithAllocation } from '../../../../../../common/types';
+
+import {
+  DataTierAllocation,
+  DefaultAllocationWarning,
+  NoNodeAttributesWarning,
+  NodesDataProvider,
+} from '../../components/data_tier_allocation';
+import { PhaseValidationErrors } from '../../../../services/policies/policy_validation';
+import { isPhaseDefaultDataAllocationCompatible } from '../../../../lib/data_tiers';
+
+const i18nTexts = {
+  title: i18n.translate('xpack.indexLifecycleMgmt.common.dataTier.title', {
+    defaultMessage: 'Data allocation',
+  }),
+};
+
+interface Props {
+  description: React.ReactNode;
+  phase: PhaseWithAllocation;
+  setPhaseData: (dataKey: keyof PhaseWithAllocationAction, value: string) => void;
+  isShowingErrors: boolean;
+  errors?: PhaseValidationErrors<PhaseWithAllocationAction>;
+  phaseData: PhaseWithAllocationAction;
+}
+
+/**
+ * Top-level layout control for the data tier allocation field.
+ */
+export const DataTierAllocationField: FunctionComponent<Props> = ({
+  description,
+  phase,
+  phaseData,
+  setPhaseData,
+  isShowingErrors,
+  errors,
+}) => {
+  return (
+    <NodesDataProvider>
+      {(nodesData) => {
+        const isCompatible = isPhaseDefaultDataAllocationCompatible(phase, nodesData.nodesByRoles);
+        const hasNodeAttrs = Boolean(Object.keys(nodesData.nodesByAttributes ?? {}).length);
+
+        return (
+          <EuiDescribedFormGroup
+            title={<h3>{i18nTexts.title}</h3>}
+            description={description}
+            fullWidth
+          >
+            <EuiFormRow>
+              <>
+                <DataTierAllocation
+                  hasNodeAttributes={hasNodeAttrs}
+                  phase={phase}
+                  errors={errors}
+                  setPhaseData={setPhaseData}
+                  phaseData={phaseData}
+                  isShowingErrors={isShowingErrors}
+                  nodes={nodesData.nodesByAttributes}
+                />
+
+                {/* Data tier related warnings */}
+
+                {phaseData.dataTierAllocationType === 'default' && !isCompatible && (
+                  <DefaultAllocationWarning phase={phase} />
+                )}
+
+                {phaseData.dataTierAllocationType === 'custom' && !hasNodeAttrs && (
+                  <NoNodeAttributesWarning phase={phase} />
+                )}
+              </>
+            </EuiFormRow>
+          </EuiDescribedFormGroup>
+        );
+      }}
+    </NodesDataProvider>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/shared/index.ts b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/shared/index.ts
new file mode 100644
index 0000000000000..f9e939058adb9
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/shared/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { DataTierAllocationField } from './data_tier_allocation_field';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx
index c806056899cac..16a740b1171c9 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { Fragment, PureComponent } from 'react';
+import React, { Fragment, FunctionComponent } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import {
@@ -27,44 +27,53 @@ import {
   OptionalLabel,
   ErrableFormRow,
   SetPriorityInput,
-  NodeAllocation,
   MinAgeInput,
+  DescribedFormField,
   Forcemerge,
 } from '../components';
+import { DataTierAllocationField } from './shared';
 
-const shrinkLabel = i18n.translate('xpack.indexLifecycleMgmt.warmPhase.shrinkIndexLabel', {
-  defaultMessage: 'Shrink index',
-});
-
-const moveToWarmPhaseOnRolloverLabel = i18n.translate(
-  'xpack.indexLifecycleMgmt.warmPhase.moveToWarmPhaseOnRolloverLabel',
-  {
-    defaultMessage: 'Move to warm phase on rollover',
-  }
-);
+const i18nTexts = {
+  shrinkLabel: i18n.translate('xpack.indexLifecycleMgmt.warmPhase.shrinkIndexLabel', {
+    defaultMessage: 'Shrink index',
+  }),
+  moveToWarmPhaseOnRolloverLabel: i18n.translate(
+    'xpack.indexLifecycleMgmt.warmPhase.moveToWarmPhaseOnRolloverLabel',
+    {
+      defaultMessage: 'Move to warm phase on rollover',
+    }
+  ),
+  dataTierAllocation: {
+    description: i18n.translate('xpack.indexLifecycleMgmt.warmPhase.dataTier.description', {
+      defaultMessage:
+        'Move warm data to nodes optimized for read-only access. Store warm data on less-expensive hardware.',
+    }),
+  },
+};
 
 const warmProperty: keyof Phases = 'warm';
 const phaseProperty = (propertyName: keyof WarmPhaseInterface) => propertyName;
 
 interface Props {
-  setPhaseData: (key: keyof WarmPhaseInterface & string, value: boolean | string) => void;
+  setPhaseData: (
+    key: keyof WarmPhaseInterface & string,
+    value: boolean | string | undefined
+  ) => void;
   phaseData: WarmPhaseInterface;
   isShowingErrors: boolean;
   errors?: PhaseValidationErrors<WarmPhaseInterface>;
   hotPhaseRolloverEnabled: boolean;
 }
-export class WarmPhase extends PureComponent<Props> {
-  render() {
-    const {
-      setPhaseData,
-      phaseData,
-      errors,
-      isShowingErrors,
-      hotPhaseRolloverEnabled,
-    } = this.props;
-
-    return (
-      <div id="warmPhaseContent" aria-live="polite" role="region" aria-relevant="additions">
+export const WarmPhase: FunctionComponent<Props> = ({
+  setPhaseData,
+  phaseData,
+  errors,
+  isShowingErrors,
+  hotPhaseRolloverEnabled,
+}) => {
+  return (
+    <div id="warmPhaseContent" aria-live="polite" role="region" aria-relevant="additions">
+      <>
         <EuiDescribedFormGroup
           title={
             <div>
@@ -115,7 +124,7 @@ export class WarmPhase extends PureComponent<Props> {
                   <EuiFormRow id={`${warmProperty}-${phaseProperty('warmPhaseOnRollover')}`}>
                     <EuiSwitch
                       data-test-subj="warmPhaseOnRolloverSwitch"
-                      label={moveToWarmPhaseOnRolloverLabel}
+                      label={i18nTexts.moveToWarmPhaseOnRolloverLabel}
                       id={`${warmProperty}-${phaseProperty('warmPhaseOnRollover')}`}
                       checked={phaseData.warmPhaseOnRollover}
                       onChange={(e) => {
@@ -137,58 +146,75 @@ export class WarmPhase extends PureComponent<Props> {
                     />
                   </Fragment>
                 ) : null}
-
-                <EuiSpacer />
-
-                <NodeAllocation<WarmPhaseInterface>
-                  phase={warmProperty}
-                  setPhaseData={setPhaseData}
-                  errors={errors}
-                  phaseData={phaseData}
-                  isShowingErrors={isShowingErrors}
-                />
-
-                <EuiFlexGroup>
-                  <EuiFlexItem grow={false} style={{ maxWidth: 188 }}>
-                    <ErrableFormRow
-                      id={`${warmProperty}-${phaseProperty('selectedReplicaCount')}`}
-                      label={
-                        <Fragment>
-                          <FormattedMessage
-                            id="xpack.indexLifecycleMgmt.warmPhase.numberOfReplicasLabel"
-                            defaultMessage="Number of replicas"
-                          />
-                          <OptionalLabel />
-                        </Fragment>
-                      }
-                      isShowingErrors={isShowingErrors}
-                      errors={errors?.selectedReplicaCount}
-                      helpText={i18n.translate(
-                        'xpack.indexLifecycleMgmt.warmPhase.replicaCountHelpText',
-                        {
-                          defaultMessage: 'By default, the number of replicas remains the same.',
-                        }
-                      )}
-                    >
-                      <EuiFieldNumber
-                        id={`${warmProperty}-${phaseProperty('selectedReplicaCount')}`}
-                        value={phaseData.selectedReplicaCount}
-                        onChange={(e) => {
-                          setPhaseData('selectedReplicaCount', e.target.value);
-                        }}
-                        min={0}
-                      />
-                    </ErrableFormRow>
-                  </EuiFlexItem>
-                </EuiFlexGroup>
-
-                <EuiSpacer size="m" />
               </Fragment>
             ) : null}
           </Fragment>
         </EuiDescribedFormGroup>
+
         {phaseData.phaseEnabled ? (
           <Fragment>
+            {/* Data tier allocation section */}
+            <DataTierAllocationField
+              description={i18nTexts.dataTierAllocation.description}
+              phase={warmProperty}
+              setPhaseData={setPhaseData}
+              isShowingErrors={isShowingErrors}
+              phaseData={phaseData}
+            />
+
+            <DescribedFormField
+              title={
+                <h3>
+                  {i18n.translate('xpack.indexLifecycleMgmt.warmPhase.replicasTitle', {
+                    defaultMessage: 'Replicas',
+                  })}
+                </h3>
+              }
+              description={i18n.translate(
+                'xpack.indexLifecycleMgmt.warmPhase.numberOfReplicasDescription',
+                {
+                  defaultMessage:
+                    'Set the number of replicas. Remains the same as the previous phase by default.',
+                }
+              )}
+              switchProps={{
+                label: i18n.translate(
+                  'xpack.indexLifecycleMgmt.editPolicy.warmPhase.numberOfReplicas.switchLabel',
+                  { defaultMessage: 'Set replicas' }
+                ),
+                initialValue: Boolean(phaseData.selectedReplicaCount),
+                onChange: (v) => {
+                  if (!v) {
+                    setPhaseData('selectedReplicaCount', '');
+                  }
+                },
+              }}
+              fullWidth
+            >
+              <ErrableFormRow
+                id={`${warmProperty}-${phaseProperty('selectedReplicaCount')}`}
+                label={
+                  <Fragment>
+                    <FormattedMessage
+                      id="xpack.indexLifecycleMgmt.warmPhase.numberOfReplicasLabel"
+                      defaultMessage="Number of replicas"
+                    />
+                    <OptionalLabel />
+                  </Fragment>
+                }
+                isShowingErrors={isShowingErrors}
+                errors={errors?.selectedReplicaCount}
+              >
+                <EuiFieldNumber
+                  id={`${warmProperty}-${phaseProperty('selectedReplicaCount')}`}
+                  value={phaseData.selectedReplicaCount}
+                  onChange={(e) => {
+                    setPhaseData('selectedReplicaCount', e.target.value);
+                  }}
+                  min={0}
+                />
+              </ErrableFormRow>
+            </DescribedFormField>
             <EuiDescribedFormGroup
               title={
                 <h3>
@@ -217,8 +243,8 @@ export class WarmPhase extends PureComponent<Props> {
                   onChange={(e) => {
                     setPhaseData(phaseProperty('shrinkEnabled'), e.target.checked);
                   }}
-                  label={shrinkLabel}
-                  aria-label={shrinkLabel}
+                  label={i18nTexts.shrinkLabel}
+                  aria-label={i18nTexts.shrinkLabel}
                   aria-controls="shrinkContent"
                 />
 
@@ -275,7 +301,7 @@ export class WarmPhase extends PureComponent<Props> {
             />
           </Fragment>
         ) : null}
-      </div>
-    );
-  }
-}
+      </>
+    </div>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/api.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/api.ts
index 3d068433becbd..b279a5647c3e8 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/api.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/api.ts
@@ -6,7 +6,7 @@
 
 import { METRIC_TYPE } from '@kbn/analytics';
 
-import { PolicyFromES, SerializedPolicy } from '../../../common/types';
+import { PolicyFromES, SerializedPolicy, ListNodesRouteResponse } from '../../../common/types';
 
 import {
   UIM_POLICY_DELETE,
@@ -23,10 +23,10 @@ interface GenericObject {
 }
 
 export const useLoadNodes = () => {
-  return useRequest({
+  return useRequest<ListNodesRouteResponse>({
     path: `nodes/list`,
     method: 'get',
-    initialData: [],
+    initialData: { nodesByAttributes: {}, nodesByRoles: {} } as ListNodesRouteResponse,
   });
 };
 
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/cold_phase.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/cold_phase.ts
index 3b71c11349752..70f172de390e3 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/cold_phase.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/cold_phase.ts
@@ -13,6 +13,8 @@ import {
   PhaseValidationErrors,
   positiveNumberRequiredMessage,
 } from './policy_validation';
+import { determineDataTierAllocationType } from '../../lib';
+import { serializePhaseWithAllocation } from './shared';
 
 const coldPhaseInitialization: ColdPhase = {
   phaseEnabled: false,
@@ -22,6 +24,7 @@ const coldPhaseInitialization: ColdPhase = {
   selectedReplicaCount: '',
   freezeEnabled: false,
   phaseIndexPriority: '',
+  dataTierAllocationType: 'default',
 };
 
 export const coldPhaseFromES = (phaseSerialized?: SerializedColdPhase): ColdPhase => {
@@ -32,6 +35,12 @@ export const coldPhaseFromES = (phaseSerialized?: SerializedColdPhase): ColdPhas
 
   phase.phaseEnabled = true;
 
+  if (phaseSerialized.actions.allocate) {
+    phase.dataTierAllocationType = determineDataTierAllocationType(
+      phaseSerialized.actions.allocate
+    );
+  }
+
   if (phaseSerialized.min_age) {
     const { size: minAge, units: minAgeUnits } = splitSizeAndUnits(phaseSerialized.min_age);
     phase.selectedMinimumAge = minAge;
@@ -80,19 +89,7 @@ export const coldPhaseToES = (
     esPhase.min_age = `${phase.selectedMinimumAge}${phase.selectedMinimumAgeUnits}`;
   }
 
-  esPhase.actions = esPhase.actions ? { ...esPhase.actions } : {};
-
-  if (phase.selectedNodeAttrs) {
-    const [name, value] = phase.selectedNodeAttrs.split(':');
-    esPhase.actions.allocate = esPhase.actions.allocate || ({} as AllocateAction);
-    esPhase.actions.allocate.require = {
-      [name]: value,
-    };
-  } else {
-    if (esPhase.actions.allocate) {
-      delete esPhase.actions.allocate.require;
-    }
-  }
+  esPhase.actions = serializePhaseWithAllocation(phase, esPhase.actions);
 
   if (isNumber(phase.selectedReplicaCount)) {
     esPhase.actions.allocate = esPhase.actions.allocate || ({} as AllocateAction);
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/frozen_phase.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/frozen_phase.ts
index 6249507bcb407..28d18b8f89263 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/frozen_phase.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/frozen_phase.ts
@@ -13,6 +13,8 @@ import {
   PhaseValidationErrors,
   positiveNumberRequiredMessage,
 } from './policy_validation';
+import { determineDataTierAllocationType } from '../../lib';
+import { serializePhaseWithAllocation } from './shared';
 
 const frozenPhaseInitialization: FrozenPhase = {
   phaseEnabled: false,
@@ -22,6 +24,7 @@ const frozenPhaseInitialization: FrozenPhase = {
   selectedReplicaCount: '',
   freezeEnabled: false,
   phaseIndexPriority: '',
+  dataTierAllocationType: 'default',
 };
 
 export const frozenPhaseFromES = (phaseSerialized?: SerializedFrozenPhase): FrozenPhase => {
@@ -32,6 +35,12 @@ export const frozenPhaseFromES = (phaseSerialized?: SerializedFrozenPhase): Froz
 
   phase.phaseEnabled = true;
 
+  if (phaseSerialized.actions.allocate) {
+    phase.dataTierAllocationType = determineDataTierAllocationType(
+      phaseSerialized.actions.allocate
+    );
+  }
+
   if (phaseSerialized.min_age) {
     const { size: minAge, units: minAgeUnits } = splitSizeAndUnits(phaseSerialized.min_age);
     phase.selectedMinimumAge = minAge;
@@ -80,19 +89,7 @@ export const frozenPhaseToES = (
     esPhase.min_age = `${phase.selectedMinimumAge}${phase.selectedMinimumAgeUnits}`;
   }
 
-  esPhase.actions = esPhase.actions ? { ...esPhase.actions } : {};
-
-  if (phase.selectedNodeAttrs) {
-    const [name, value] = phase.selectedNodeAttrs.split(':');
-    esPhase.actions.allocate = esPhase.actions.allocate || ({} as AllocateAction);
-    esPhase.actions.allocate.require = {
-      [name]: value,
-    };
-  } else {
-    if (esPhase.actions.allocate) {
-      delete esPhase.actions.allocate.require;
-    }
-  }
+  esPhase.actions = serializePhaseWithAllocation(phase, esPhase.actions);
 
   if (isNumber(phase.selectedReplicaCount)) {
     esPhase.actions.allocate = esPhase.actions.allocate || ({} as AllocateAction);
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_serialization.test.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_serialization.test.ts
new file mode 100644
index 0000000000000..0e7257d437ee7
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_serialization.test.ts
@@ -0,0 +1,464 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import cloneDeep from 'lodash/cloneDeep';
+import { serializePolicy } from './policy_serialization';
+import {
+  defaultNewColdPhase,
+  defaultNewDeletePhase,
+  defaultNewFrozenPhase,
+  defaultNewHotPhase,
+  defaultNewWarmPhase,
+} from '../../constants';
+import { DataTierAllocationType } from '../../../../common/types';
+
+describe('Policy serialization', () => {
+  test('serialize a policy using "default" data allocation', () => {
+    expect(
+      serializePolicy(
+        {
+          name: 'test',
+          phases: {
+            hot: { ...defaultNewHotPhase },
+            warm: {
+              ...defaultNewWarmPhase,
+              dataTierAllocationType: 'default',
+              // These selected attrs should be ignored
+              selectedNodeAttrs: 'another:thing',
+              phaseEnabled: true,
+            },
+            cold: {
+              ...defaultNewColdPhase,
+              dataTierAllocationType: 'default',
+              selectedNodeAttrs: 'another:thing',
+              phaseEnabled: true,
+            },
+            frozen: {
+              ...defaultNewFrozenPhase,
+              dataTierAllocationType: 'default',
+              selectedNodeAttrs: 'another:thing',
+              phaseEnabled: true,
+            },
+            delete: { ...defaultNewDeletePhase },
+          },
+        },
+        {
+          name: 'test',
+          phases: {
+            hot: { actions: {} },
+            warm: {
+              actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+            },
+            cold: {
+              actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+            },
+            frozen: {
+              actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+            },
+          },
+        }
+      )
+    ).toEqual({
+      name: 'test',
+      phases: {
+        hot: {
+          actions: {
+            rollover: {
+              max_age: '30d',
+              max_size: '50gb',
+            },
+            set_priority: {
+              priority: 100,
+            },
+          },
+        },
+        warm: {
+          actions: {
+            set_priority: {
+              priority: 50,
+            },
+          },
+        },
+        cold: {
+          actions: {
+            set_priority: {
+              priority: 0,
+            },
+          },
+          min_age: '0d',
+        },
+        frozen: {
+          actions: {
+            set_priority: {
+              priority: 0,
+            },
+          },
+          min_age: '0d',
+        },
+      },
+    });
+  });
+
+  test('serialize a policy using "custom" data allocation', () => {
+    expect(
+      serializePolicy(
+        {
+          name: 'test',
+          phases: {
+            hot: { ...defaultNewHotPhase },
+            warm: {
+              ...defaultNewWarmPhase,
+              dataTierAllocationType: 'custom',
+              selectedNodeAttrs: 'another:thing',
+              phaseEnabled: true,
+            },
+            cold: {
+              ...defaultNewColdPhase,
+              dataTierAllocationType: 'custom',
+              selectedNodeAttrs: 'another:thing',
+              phaseEnabled: true,
+            },
+            frozen: {
+              ...defaultNewFrozenPhase,
+              dataTierAllocationType: 'custom',
+              selectedNodeAttrs: 'another:thing',
+              phaseEnabled: true,
+            },
+            delete: { ...defaultNewDeletePhase },
+          },
+        },
+        {
+          name: 'test',
+          phases: {
+            hot: { actions: {} },
+            warm: {
+              actions: {
+                allocate: {
+                  include: { keep: 'this' },
+                  exclude: { keep: 'this' },
+                  require: { something: 'here' },
+                },
+              },
+            },
+            cold: {
+              actions: {
+                allocate: {
+                  include: { keep: 'this' },
+                  exclude: { keep: 'this' },
+                  require: { something: 'here' },
+                },
+              },
+            },
+            frozen: {
+              actions: {
+                allocate: {
+                  include: { keep: 'this' },
+                  exclude: { keep: 'this' },
+                  require: { something: 'here' },
+                },
+              },
+            },
+          },
+        }
+      )
+    ).toEqual({
+      name: 'test',
+      phases: {
+        hot: {
+          actions: {
+            rollover: {
+              max_age: '30d',
+              max_size: '50gb',
+            },
+            set_priority: {
+              priority: 100,
+            },
+          },
+        },
+        warm: {
+          actions: {
+            allocate: {
+              include: { keep: 'this' },
+              exclude: { keep: 'this' },
+              require: {
+                another: 'thing',
+              },
+            },
+            set_priority: {
+              priority: 50,
+            },
+          },
+        },
+        cold: {
+          actions: {
+            allocate: {
+              include: { keep: 'this' },
+              exclude: { keep: 'this' },
+              require: {
+                another: 'thing',
+              },
+            },
+            set_priority: {
+              priority: 0,
+            },
+          },
+          min_age: '0d',
+        },
+        frozen: {
+          actions: {
+            allocate: {
+              include: { keep: 'this' },
+              exclude: { keep: 'this' },
+              require: {
+                another: 'thing',
+              },
+            },
+            set_priority: {
+              priority: 0,
+            },
+          },
+          min_age: '0d',
+        },
+      },
+    });
+  });
+
+  test('serialize a policy using "custom" data allocation with no node attributes', () => {
+    expect(
+      serializePolicy(
+        {
+          name: 'test',
+          phases: {
+            hot: { ...defaultNewHotPhase },
+            warm: {
+              ...defaultNewWarmPhase,
+              dataTierAllocationType: 'custom',
+              selectedNodeAttrs: '',
+              phaseEnabled: true,
+            },
+            cold: {
+              ...defaultNewColdPhase,
+              dataTierAllocationType: 'custom',
+              selectedNodeAttrs: '',
+              phaseEnabled: true,
+            },
+            frozen: {
+              ...defaultNewFrozenPhase,
+              dataTierAllocationType: 'custom',
+              selectedNodeAttrs: '',
+              phaseEnabled: true,
+            },
+            delete: { ...defaultNewDeletePhase },
+          },
+        },
+        {
+          name: 'test',
+          phases: {
+            hot: { actions: {} },
+            warm: {
+              actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+            },
+            cold: {
+              actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+            },
+            frozen: {
+              actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+            },
+          },
+        }
+      )
+    ).toEqual({
+      // There should be no allocation action in any phases...
+      name: 'test',
+      phases: {
+        hot: {
+          actions: {
+            rollover: {
+              max_age: '30d',
+              max_size: '50gb',
+            },
+            set_priority: {
+              priority: 100,
+            },
+          },
+        },
+        warm: {
+          actions: {
+            allocate: { include: {}, exclude: {}, require: { something: 'here' } },
+            set_priority: {
+              priority: 50,
+            },
+          },
+        },
+        cold: {
+          actions: {
+            allocate: { include: {}, exclude: {}, require: { something: 'here' } },
+            set_priority: {
+              priority: 0,
+            },
+          },
+          min_age: '0d',
+        },
+        frozen: {
+          actions: {
+            allocate: { include: {}, exclude: {}, require: { something: 'here' } },
+            set_priority: {
+              priority: 0,
+            },
+          },
+          min_age: '0d',
+        },
+      },
+    });
+  });
+
+  test('serialize a policy using "none" data allocation with no node attributes', () => {
+    expect(
+      serializePolicy(
+        {
+          name: 'test',
+          phases: {
+            hot: { ...defaultNewHotPhase },
+            warm: {
+              ...defaultNewWarmPhase,
+              dataTierAllocationType: 'none',
+              selectedNodeAttrs: 'ignore:this',
+              phaseEnabled: true,
+            },
+            cold: {
+              ...defaultNewColdPhase,
+              dataTierAllocationType: 'none',
+              selectedNodeAttrs: 'ignore:this',
+              phaseEnabled: true,
+            },
+            frozen: {
+              ...defaultNewFrozenPhase,
+              dataTierAllocationType: 'none',
+              selectedNodeAttrs: 'ignore:this',
+              phaseEnabled: true,
+            },
+            delete: { ...defaultNewDeletePhase },
+          },
+        },
+        {
+          name: 'test',
+          phases: {
+            hot: { actions: {} },
+            warm: {
+              actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+            },
+            cold: {
+              actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+            },
+            frozen: {
+              actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+            },
+          },
+        }
+      )
+    ).toEqual({
+      // There should be no allocation action in any phases...
+      name: 'test',
+      phases: {
+        hot: {
+          actions: {
+            rollover: {
+              max_age: '30d',
+              max_size: '50gb',
+            },
+            set_priority: {
+              priority: 100,
+            },
+          },
+        },
+        warm: {
+          actions: {
+            migrate: {
+              enabled: false,
+            },
+            set_priority: {
+              priority: 50,
+            },
+          },
+        },
+        cold: {
+          actions: {
+            migrate: {
+              enabled: false,
+            },
+            set_priority: {
+              priority: 0,
+            },
+          },
+          min_age: '0d',
+        },
+        frozen: {
+          actions: {
+            migrate: {
+              enabled: false,
+            },
+            set_priority: {
+              priority: 0,
+            },
+          },
+          min_age: '0d',
+        },
+      },
+    });
+  });
+
+  test('serialization does not alter the original policy', () => {
+    const originalPolicy = {
+      name: 'test',
+      phases: {
+        hot: { actions: {} },
+        warm: {
+          actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+        },
+        cold: {
+          actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+        },
+        frozen: {
+          actions: { allocate: { include: {}, exclude: {}, require: { something: 'here' } } },
+        },
+      },
+    };
+
+    const originalClone = cloneDeep(originalPolicy);
+
+    const deserializedPolicy = {
+      name: 'test',
+      phases: {
+        hot: { ...defaultNewHotPhase },
+        warm: {
+          ...defaultNewWarmPhase,
+          dataTierAllocationType: 'none' as DataTierAllocationType,
+          selectedNodeAttrs: 'ignore:this',
+          phaseEnabled: true,
+        },
+        cold: {
+          ...defaultNewColdPhase,
+          dataTierAllocationType: 'none' as DataTierAllocationType,
+          selectedNodeAttrs: 'ignore:this',
+          phaseEnabled: true,
+        },
+        frozen: {
+          ...defaultNewFrozenPhase,
+          dataTierAllocationType: 'none' as DataTierAllocationType,
+          selectedNodeAttrs: 'ignore:this',
+          phaseEnabled: true,
+        },
+        delete: { ...defaultNewDeletePhase },
+      },
+    };
+
+    serializePolicy(deserializedPolicy, originalPolicy);
+    deserializedPolicy.phases.warm.dataTierAllocationType = 'custom';
+    serializePolicy(deserializedPolicy, originalPolicy);
+    deserializedPolicy.phases.warm.dataTierAllocationType = 'default';
+    serializePolicy(deserializedPolicy, originalPolicy);
+    expect(originalPolicy).toEqual(originalClone);
+  });
+});
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/shared/index.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/shared/index.ts
new file mode 100644
index 0000000000000..fe97b85778a53
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/shared/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { serializePhaseWithAllocation } from './serialize_phase_with_allocation';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/shared/serialize_phase_with_allocation.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/shared/serialize_phase_with_allocation.ts
new file mode 100644
index 0000000000000..5a9db3069aea6
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/shared/serialize_phase_with_allocation.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import cloneDeep from 'lodash/cloneDeep';
+
+import {
+  AllocateAction,
+  PhaseWithAllocationAction,
+  SerializedPhase,
+} from '../../../../../common/types';
+
+export const serializePhaseWithAllocation = (
+  phase: PhaseWithAllocationAction,
+  originalPhaseActions: SerializedPhase['actions'] = {}
+): SerializedPhase['actions'] => {
+  const esPhaseActions: SerializedPhase['actions'] = cloneDeep(originalPhaseActions);
+
+  if (phase.dataTierAllocationType === 'custom' && phase.selectedNodeAttrs) {
+    const [name, value] = phase.selectedNodeAttrs.split(':');
+    esPhaseActions.allocate = esPhaseActions.allocate || ({} as AllocateAction);
+    esPhaseActions.allocate.require = {
+      [name]: value,
+    };
+  } else if (phase.dataTierAllocationType === 'none') {
+    esPhaseActions.migrate = { enabled: false };
+    if (esPhaseActions.allocate) {
+      delete esPhaseActions.allocate;
+    }
+  } else if (phase.dataTierAllocationType === 'default') {
+    if (esPhaseActions.allocate) {
+      delete esPhaseActions.allocate.require;
+    }
+    delete esPhaseActions.migrate;
+  }
+
+  return esPhaseActions;
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/warm_phase.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/warm_phase.ts
index cc815d67dbc18..6971f652f986b 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/warm_phase.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/warm_phase.ts
@@ -16,6 +16,9 @@ import {
   positiveNumbersAboveZeroErrorMessage,
 } from './policy_validation';
 
+import { determineDataTierAllocationType } from '../../lib';
+import { serializePhaseWithAllocation } from './shared';
+
 const warmPhaseInitialization: WarmPhase = {
   phaseEnabled: false,
   warmPhaseOnRollover: false,
@@ -28,6 +31,7 @@ const warmPhaseInitialization: WarmPhase = {
   forceMergeEnabled: false,
   selectedForceMergeSegments: '',
   phaseIndexPriority: '',
+  dataTierAllocationType: 'default',
 };
 
 export const warmPhaseFromES = (phaseSerialized?: SerializedWarmPhase): WarmPhase => {
@@ -39,6 +43,12 @@ export const warmPhaseFromES = (phaseSerialized?: SerializedWarmPhase): WarmPhas
 
   phase.phaseEnabled = true;
 
+  if (phaseSerialized.actions.allocate) {
+    phase.dataTierAllocationType = determineDataTierAllocationType(
+      phaseSerialized.actions.allocate
+    );
+  }
+
   if (phaseSerialized.min_age) {
     if (phaseSerialized.min_age === '0ms') {
       phase.warmPhaseOnRollover = true;
@@ -99,19 +109,7 @@ export const warmPhaseToES = (
     delete esPhase.min_age;
   }
 
-  esPhase.actions = esPhase.actions ? { ...esPhase.actions } : {};
-
-  if (phase.selectedNodeAttrs) {
-    const [name, value] = phase.selectedNodeAttrs.split(':');
-    esPhase.actions.allocate = esPhase.actions.allocate || ({} as AllocateAction);
-    esPhase.actions.allocate.require = {
-      [name]: value,
-    };
-  } else {
-    if (esPhase.actions.allocate) {
-      delete esPhase.actions.allocate.require;
-    }
-  }
+  esPhase.actions = serializePhaseWithAllocation(phase, esPhase.actions);
 
   if (isNumber(phase.selectedReplicaCount)) {
     esPhase.actions.allocate = esPhase.actions.allocate || ({} as AllocateAction);
diff --git a/x-pack/plugins/index_lifecycle_management/server/routes/api/nodes/register_list_route.ts b/x-pack/plugins/index_lifecycle_management/server/routes/api/nodes/register_list_route.ts
index b30a59c997e87..99df70e7df82d 100644
--- a/x-pack/plugins/index_lifecycle_management/server/routes/api/nodes/register_list_route.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/routes/api/nodes/register_list_route.ts
@@ -6,22 +6,45 @@
 
 import { LegacyAPICaller } from 'src/core/server';
 
+import { ListNodesRouteResponse, NodeDataRole } from '../../../../common/types';
+
 import { RouteDependencies } from '../../../types';
 import { addBasePath } from '../../../services';
 
-function convertStatsIntoList(stats: any, disallowedNodeAttributes: string[]): any {
-  return Object.entries(stats.nodes).reduce((accum: any, [nodeId, nodeStats]: [any, any]) => {
-    const attributes = nodeStats.attributes || {};
-    for (const [key, value] of Object.entries(attributes)) {
-      const isNodeAttributeAllowed = !disallowedNodeAttributes.includes(key);
-      if (isNodeAttributeAllowed) {
-        const attributeString = `${key}:${value}`;
-        accum[attributeString] = accum[attributeString] || [];
-        accum[attributeString].push(nodeId);
+interface Stats {
+  nodes: {
+    [nodeId: string]: {
+      attributes: Record<string, string>;
+      roles: string[];
+    };
+  };
+}
+
+function convertStatsIntoList(
+  stats: Stats,
+  disallowedNodeAttributes: string[]
+): ListNodesRouteResponse {
+  return Object.entries(stats.nodes).reduce(
+    (accum, [nodeId, nodeStats]) => {
+      const attributes = nodeStats.attributes || {};
+      for (const [key, value] of Object.entries(attributes)) {
+        const isNodeAttributeAllowed = !disallowedNodeAttributes.includes(key);
+        if (isNodeAttributeAllowed) {
+          const attributeString = `${key}:${value}`;
+          accum.nodesByAttributes[attributeString] = accum.nodesByAttributes[attributeString] ?? [];
+          accum.nodesByAttributes[attributeString].push(nodeId);
+        }
+      }
+
+      const dataRoles = nodeStats.roles.filter((r) => r.startsWith('data')) as NodeDataRole[];
+      for (const role of dataRoles) {
+        accum.nodesByRoles[role as NodeDataRole] = accum.nodesByRoles[role] ?? [];
+        accum.nodesByRoles[role as NodeDataRole]!.push(nodeId);
       }
-    }
-    return accum;
-  }, {});
+      return accum;
+    },
+    { nodesByAttributes: {}, nodesByRoles: {} } as ListNodesRouteResponse
+  );
 }
 
 async function fetchNodeStats(callAsCurrentUser: LegacyAPICaller): Promise<any> {
@@ -54,8 +77,8 @@ export function registerListRoute({ router, config, license, lib }: RouteDepende
         const stats = await fetchNodeStats(
           context.core.elasticsearch.legacy.client.callAsCurrentUser
         );
-        const okResponse = { body: convertStatsIntoList(stats, disallowedNodeAttributes) };
-        return response.ok(okResponse);
+        const body: ListNodesRouteResponse = convertStatsIntoList(stats, disallowedNodeAttributes);
+        return response.ok({ body });
       } catch (e) {
         if (lib.isEsError(e)) {
           return response.customError({
diff --git a/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts b/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts
index ba6b8665479a9..5ef38a0e46dc3 100644
--- a/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts
@@ -40,6 +40,8 @@ const setPrioritySchema = schema.maybe(
 
 const unfollowSchema = schema.maybe(schema.object({})); // Unfollow has no options
 
+const migrateSchema = schema.maybe(schema.object({ enabled: schema.literal(false) }));
+
 const allocateNodeSchema = schema.maybe(schema.recordOf(schema.string(), schema.string()));
 const allocateSchema = schema.maybe(
   schema.object({
@@ -76,6 +78,7 @@ const warmPhaseSchema = schema.maybe(
   schema.object({
     min_age: minAgeSchema,
     actions: schema.object({
+      migrate: migrateSchema,
       set_priority: setPrioritySchema,
       unfollow: unfollowSchema,
       readonly: schema.maybe(schema.object({})), // Readonly has no options
@@ -94,6 +97,7 @@ const coldPhaseSchema = schema.maybe(
   schema.object({
     min_age: minAgeSchema,
     actions: schema.object({
+      migrate: migrateSchema,
       set_priority: setPrioritySchema,
       unfollow: unfollowSchema,
       allocate: allocateSchema,
@@ -111,6 +115,7 @@ const frozenPhaseSchema = schema.maybe(
   schema.object({
     min_age: minAgeSchema,
     actions: schema.object({
+      migrate: migrateSchema,
       set_priority: setPrioritySchema,
       unfollow: unfollowSchema,
       allocate: allocateSchema,
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/field_parameters/index.ts b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/field_parameters/index.ts
index a2d5c7c8d5308..b3bf071948956 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/field_parameters/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/field_parameters/index.ts
@@ -69,6 +69,8 @@ export * from './other_type_name_parameter';
 
 export * from './other_type_json_parameter';
 
+export * from './meta_parameter';
+
 export * from './ignore_above_parameter';
 
 export const PARAMETER_SERIALIZERS = [relationsSerializer, dynamicSerializer];
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/field_parameters/meta_parameter.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/field_parameters/meta_parameter.tsx
new file mode 100644
index 0000000000000..c8af296318b61
--- /dev/null
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/field_parameters/meta_parameter.tsx
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+
+import { i18n } from '@kbn/i18n';
+
+import { documentationService } from '../../../../../services/documentation';
+import { UseField, JsonEditorField } from '../../../shared_imports';
+import { getFieldConfig } from '../../../lib';
+import { EditFieldFormRow } from '../fields/edit_field';
+
+interface Props {
+  defaultToggleValue: boolean;
+}
+
+export const MetaParameter: FunctionComponent<Props> = ({ defaultToggleValue }) => (
+  <EditFieldFormRow
+    title={i18n.translate('xpack.idxMgmt.mappingsEditor.metaParameterTitle', {
+      defaultMessage: 'Set metadata',
+    })}
+    description={i18n.translate('xpack.idxMgmt.mappingsEditor.metaParameterDescription', {
+      defaultMessage: 'Arbitrary information about the field. Specify as JSON key-value pairs.',
+    })}
+    defaultToggleValue={defaultToggleValue}
+    docLink={{
+      text: i18n.translate('xpack.idxMgmt.mappingsEditor.metaParameterDocLinkText', {
+        defaultMessage: 'Metadata documentation',
+      }),
+      href: documentationService.getMetaLink(),
+    }}
+  >
+    <UseField
+      path="meta"
+      config={getFieldConfig('meta')}
+      component={JsonEditorField}
+      componentProps={{
+        euiCodeEditorProps: {
+          height: '300px',
+          'aria-label': i18n.translate('xpack.idxMgmt.mappingsEditor.metaParameterAriaLabel', {
+            defaultMessage: 'metadata field data editor',
+          }),
+        },
+      }}
+    />
+  </EditFieldFormRow>
+);
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/binary_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/binary_type.tsx
index ba9c75baa1987..1550485ebad93 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/binary_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/binary_type.tsx
@@ -5,14 +5,25 @@
  */
 import React from 'react';
 
-import { StoreParameter, DocValuesParameter } from '../../field_parameters';
+import { NormalizedField, ParameterName, Field as FieldType } from '../../../../types';
+import { getFieldConfig } from '../../../../lib';
+import { StoreParameter, DocValuesParameter, MetaParameter } from '../../field_parameters';
 import { AdvancedParametersSection } from '../edit_field';
 
-export const BinaryType = () => {
+const getDefaultToggleValue = (param: ParameterName, field: FieldType) => {
+  return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
+};
+
+interface Props {
+  field: NormalizedField;
+}
+
+export const BinaryType = ({ field }: Props) => {
   return (
     <AdvancedParametersSection>
       <DocValuesParameter configPath="doc_values_binary" />
       <StoreParameter />
+      <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
     </AdvancedParametersSection>
   );
 };
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/boolean_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/boolean_type.tsx
index 962606b2f4ffd..1ee2bf22edb44 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/boolean_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/boolean_type.tsx
@@ -16,11 +16,13 @@ import {
   DocValuesParameter,
   BoostParameter,
   NullValueParameter,
+  MetaParameter,
 } from '../../field_parameters';
 import { BasicParametersSection, AdvancedParametersSection } from '../edit_field';
 
 const getDefaultToggleValue = (param: string, field: FieldType) => {
   switch (param) {
+    case 'meta':
     case 'boost': {
       return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
     }
@@ -90,6 +92,8 @@ export const BooleanType = ({ field }: Props) => {
 
         <StoreParameter />
 
+        <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
+
         <BoostParameter defaultToggleValue={getDefaultToggleValue('boost', field.source)} />
       </AdvancedParametersSection>
     </>
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/completion_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/completion_type.tsx
index 74331cb1b6b22..748dc54838270 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/completion_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/completion_type.tsx
@@ -10,11 +10,12 @@ import { i18n } from '@kbn/i18n';
 import { NormalizedField, Field as FieldType } from '../../../../types';
 import { getFieldConfig } from '../../../../lib';
 import { UseField, Field } from '../../../../shared_imports';
-import { AnalyzersParameter } from '../../field_parameters';
+import { AnalyzersParameter, MetaParameter } from '../../field_parameters';
 import { EditFieldFormRow, AdvancedParametersSection } from '../edit_field';
 
 const getDefaultToggleValue = (param: string, field: FieldType) => {
   switch (param) {
+    case 'meta':
     case 'max_input_length': {
       return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
     }
@@ -88,6 +89,8 @@ export const CompletionType = ({ field }: Props) => {
         )}
         formFieldPath="preserve_position_increments"
       />
+
+      <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
     </AdvancedParametersSection>
   );
 };
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/constant_keyword_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/constant_keyword_type.tsx
new file mode 100644
index 0000000000000..aa8aefba921e7
--- /dev/null
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/constant_keyword_type.tsx
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import { UseField, Field } from '../../../../shared_imports';
+import { getFieldConfig } from '../../../../lib';
+import { NormalizedField, Field as FieldType, ParameterName } from '../../../../types';
+import { MetaParameter } from '../../field_parameters';
+import { AdvancedParametersSection, EditFieldFormRow, BasicParametersSection } from '../edit_field';
+
+interface Props {
+  field: NormalizedField;
+}
+
+const getDefaultToggleValue = (param: ParameterName, field: FieldType) => {
+  return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
+};
+
+export const ConstantKeywordType: FunctionComponent<Props> = ({ field }) => {
+  return (
+    <>
+      <BasicParametersSection>
+        {/* Value field */}
+        <EditFieldFormRow
+          title={i18n.translate('xpack.idxMgmt.mappingsEditor.constantKeyword.valueFieldTitle', {
+            defaultMessage: 'Set value',
+          })}
+          description={i18n.translate(
+            'xpack.idxMgmt.mappingsEditor.constantKeyword.valueFieldDescription',
+            {
+              defaultMessage:
+                'The value of this field for all documents in the index. If not specified, defaults to the value specified in the first document indexed.',
+            }
+          )}
+          defaultToggleValue={getDefaultToggleValue('value', field.source)}
+        >
+          <UseField path="value" config={getFieldConfig('value')} component={Field} />
+        </EditFieldFormRow>
+      </BasicParametersSection>
+
+      <AdvancedParametersSection>
+        <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
+      </AdvancedParametersSection>
+    </>
+  );
+};
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/date_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/date_type.tsx
index 0c067d09046d7..35382506a3cd9 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/date_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/date_type.tsx
@@ -19,6 +19,7 @@ import {
   IgnoreMalformedParameter,
   FormatParameter,
   LocaleParameter,
+  MetaParameter,
 } from '../../field_parameters';
 import { BasicParametersSection, AdvancedParametersSection } from '../edit_field';
 
@@ -26,6 +27,7 @@ const getDefaultToggleValue = (param: string, field: FieldType) => {
   switch (param) {
     case 'locale':
     case 'format':
+    case 'meta':
     case 'boost': {
       return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
     }
@@ -73,6 +75,8 @@ export const DateType = ({ field }: Props) => {
 
         <StoreParameter />
 
+        <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
+
         <BoostParameter defaultToggleValue={getDefaultToggleValue('boost', field.source)} />
       </AdvancedParametersSection>
     </>
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/flattened_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/flattened_type.tsx
index e96426ece27e8..b1545d44885c8 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/flattened_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/flattened_type.tsx
@@ -18,6 +18,7 @@ import {
   NullValueParameter,
   SimilarityParameter,
   SplitQueriesOnWhitespaceParameter,
+  MetaParameter,
   IgnoreAboveParameter,
 } from '../../field_parameters';
 import { BasicParametersSection, EditFieldFormRow, AdvancedParametersSection } from '../edit_field';
@@ -30,6 +31,7 @@ const getDefaultToggleValue = (param: string, field: FieldType) => {
   switch (param) {
     case 'boost':
     case 'ignore_above':
+    case 'meta':
     case 'similarity': {
       return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
     }
@@ -83,6 +85,8 @@ export const FlattenedType = React.memo(({ field }: Props) => {
           defaultToggleValue={getDefaultToggleValue('null_value', field.source)}
         />
 
+        <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
+
         <BoostParameter defaultToggleValue={getDefaultToggleValue('boost', field.source)} />
       </AdvancedParametersSection>
     </>
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/geo_point_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/geo_point_type.tsx
index 997e866da35f0..0f28c5080d26d 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/geo_point_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/geo_point_type.tsx
@@ -14,11 +14,14 @@ import {
   IgnoreMalformedParameter,
   NullValueParameter,
   IgnoreZValueParameter,
+  MetaParameter,
 } from '../../field_parameters';
 import { BasicParametersSection, AdvancedParametersSection } from '../edit_field';
 
 const getDefaultToggleValue = (param: string, field: FieldType) => {
   switch (param) {
+    case 'meta':
+      return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
     case 'null_value': {
       return field.null_value !== undefined;
     }
@@ -65,6 +68,8 @@ export const GeoPointType = ({ field }: Props) => {
             config={getFieldConfig('null_value_geo_point')}
           />
         </NullValueParameter>
+
+        <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
       </AdvancedParametersSection>
     </>
   );
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/histogram_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/histogram_type.tsx
new file mode 100644
index 0000000000000..1ff97a8d72a21
--- /dev/null
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/histogram_type.tsx
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+
+import { NormalizedField, Field as FieldType, ParameterName } from '../../../../types';
+import { getFieldConfig } from '../../../../lib';
+import { IgnoreMalformedParameter, MetaParameter } from '../../field_parameters';
+import { AdvancedParametersSection } from '../edit_field';
+
+interface Props {
+  field: NormalizedField;
+}
+
+const getDefaultToggleValue = (param: ParameterName, field: FieldType) => {
+  return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
+};
+
+export const HistogramType = ({ field }: Props) => {
+  return (
+    <AdvancedParametersSection>
+      <IgnoreMalformedParameter />
+
+      <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
+    </AdvancedParametersSection>
+  );
+};
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/index.ts b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/index.ts
index d84d9c6ea40cf..8fcd02e4a362e 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/index.ts
@@ -28,6 +28,8 @@ import { ObjectType } from './object_type';
 import { OtherType } from './other_type';
 import { NestedType } from './nested_type';
 import { JoinType } from './join_type';
+import { HistogramType } from './histogram_type';
+import { ConstantKeywordType } from './constant_keyword_type';
 import { RankFeatureType } from './rank_feature_type';
 import { WildcardType } from './wildcard_type';
 
@@ -54,6 +56,8 @@ const typeToParametersFormMap: { [key in DataType]?: ComponentType<any> } = {
   other: OtherType,
   nested: NestedType,
   join: JoinType,
+  histogram: HistogramType,
+  constant_keyword: ConstantKeywordType,
   rank_feature: RankFeatureType,
   wildcard: WildcardType,
 };
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/numeric_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/numeric_type.tsx
index 3d78205934eea..6ad3c9c5d0bd4 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/numeric_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/numeric_type.tsx
@@ -18,6 +18,7 @@ import {
   CoerceNumberParameter,
   IgnoreMalformedParameter,
   CopyToParameter,
+  MetaParameter,
 } from '../../field_parameters';
 import { BasicParametersSection, EditFieldFormRow, AdvancedParametersSection } from '../edit_field';
 import { PARAMETERS_DEFINITION } from '../../../../constants';
@@ -26,6 +27,7 @@ const getDefaultToggleValue = (param: string, field: FieldType) => {
   switch (param) {
     case 'copy_to':
     case 'boost':
+    case 'meta':
     case 'ignore_malformed': {
       return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
     }
@@ -95,6 +97,8 @@ export const NumericType = ({ field }: Props) => {
 
         <StoreParameter />
 
+        <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
+
         <BoostParameter defaultToggleValue={getDefaultToggleValue('boost', field.source)} />
       </AdvancedParametersSection>
     </>
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/range_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/range_type.tsx
index f87d1f9400101..9a37f55ac8e9d 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/range_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/range_type.tsx
@@ -5,7 +5,7 @@
  */
 import React from 'react';
 
-import { NormalizedField, Field as FieldType } from '../../../../types';
+import { NormalizedField, Field as FieldType, ParameterName } from '../../../../types';
 import { getFieldConfig } from '../../../../lib';
 import {
   StoreParameter,
@@ -14,11 +14,12 @@ import {
   CoerceNumberParameter,
   FormatParameter,
   LocaleParameter,
+  MetaParameter,
 } from '../../field_parameters';
 import { BasicParametersSection, AdvancedParametersSection } from '../edit_field';
 import { FormDataProvider } from '../../../../shared_imports';
 
-const getDefaultToggleValue = (param: 'locale' | 'format' | 'boost', field: FieldType) => {
+const getDefaultToggleValue = (param: ParameterName, field: FieldType) => {
   return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
 };
 
@@ -57,6 +58,8 @@ export const RangeType = ({ field }: Props) => {
 
         <StoreParameter />
 
+        <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
+
         <BoostParameter defaultToggleValue={getDefaultToggleValue('boost', field.source)} />
       </AdvancedParametersSection>
     </>
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/search_as_you_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/search_as_you_type.tsx
index dafbebd24b3fa..3fa456c33f5e9 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/search_as_you_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/search_as_you_type.tsx
@@ -15,6 +15,7 @@ import {
   SimilarityParameter,
   TermVectorParameter,
   MaxShingleSizeParameter,
+  MetaParameter,
 } from '../../field_parameters';
 import { BasicParametersSection, AdvancedParametersSection } from '../edit_field';
 
@@ -26,6 +27,7 @@ const getDefaultToggleValue = (param: string, field: FieldType) => {
   switch (param) {
     case 'similarity':
     case 'term_vector':
+    case 'meta':
     case 'max_shingle_size': {
       return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
     }
@@ -65,6 +67,8 @@ export const SearchAsYouType = React.memo(({ field }: Props) => {
         />
 
         <StoreParameter />
+
+        <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
       </AdvancedParametersSection>
     </>
   );
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/text_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/text_type.tsx
index c4ed11097b609..07def791096e7 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/text_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/text_type.tsx
@@ -28,6 +28,7 @@ import {
   CopyToParameter,
   TermVectorParameter,
   FieldDataParameter,
+  MetaParameter,
 } from '../../field_parameters';
 import { BasicParametersSection, EditFieldFormRow, AdvancedParametersSection } from '../edit_field';
 
@@ -40,6 +41,7 @@ const getDefaultToggleValue = (param: string, field: FieldType) => {
     case 'boost':
     case 'position_increment_gap':
     case 'similarity':
+    case 'meta':
     case 'term_vector': {
       return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
     }
@@ -47,7 +49,7 @@ const getDefaultToggleValue = (param: string, field: FieldType) => {
       return field.search_analyzer !== undefined && field.search_analyzer !== field.analyzer;
     }
     case 'copy_to': {
-      return field.null_value !== undefined && field.null_value !== '';
+      return field[param] !== undefined && field[param] !== '';
     }
     case 'indexPrefixes': {
       if (field.index_prefixes === undefined) {
@@ -241,6 +243,8 @@ export const TextType = React.memo(({ field }: Props) => {
 
         <StoreParameter />
 
+        <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
+
         <BoostParameter defaultToggleValue={getDefaultToggleValue('boost', field.source)} />
       </AdvancedParametersSection>
     </>
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/token_count_type.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/token_count_type.tsx
index 42854673269ae..5cc2addba53b8 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/token_count_type.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/field_types/token_count_type.tsx
@@ -20,12 +20,14 @@ import {
   BoostParameter,
   AnalyzerParameter,
   NullValueParameter,
+  MetaParameter,
 } from '../../field_parameters';
 import { BasicParametersSection, EditFieldFormRow, AdvancedParametersSection } from '../edit_field';
 
 const getDefaultToggleValue = (param: string, field: FieldType) => {
   switch (param) {
     case 'analyzer':
+    case 'meta':
     case 'boost': {
       return field[param] !== undefined && field[param] !== getFieldConfig(param).defaultValue;
     }
@@ -107,6 +109,8 @@ export const TokenCountType = ({ field }: Props) => {
 
         <StoreParameter />
 
+        <MetaParameter defaultToggleValue={getDefaultToggleValue('meta', field.source)} />
+
         <BoostParameter defaultToggleValue={getDefaultToggleValue('boost', field.source)} />
       </AdvancedParametersSection>
     </>
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/constants/data_types_definition.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/constants/data_types_definition.tsx
index a8844c7a9b270..a4d3bf3832d5c 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/constants/data_types_definition.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/constants/data_types_definition.tsx
@@ -71,6 +71,26 @@ export const TYPE_DEFINITION: { [key in DataType]: DataTypeDefinition } = {
       </p>
     ),
   },
+  constant_keyword: {
+    value: 'constant_keyword',
+    label: i18n.translate('xpack.idxMgmt.mappingsEditor.dataType.constantKeywordDescription', {
+      defaultMessage: 'Constant keyword',
+    }),
+    documentation: {
+      main: '/keyword.html#constant-keyword-field-type',
+    },
+    description: () => (
+      <p>
+        <FormattedMessage
+          id="xpack.idxMgmt.mappingsEditor.dataType.constantKeywordLongDescription"
+          defaultMessage="Constant keyword fields are a special type of keyword fields for fields that contain the same keyword across all documents in the index. Supports the same queries and aggregations as {keyword} fields."
+          values={{
+            keyword: <EuiCode inline>{'keyword'}</EuiCode>,
+          }}
+        />
+      </p>
+    ),
+  },
   numeric: {
     value: 'numeric',
     label: i18n.translate('xpack.idxMgmt.mappingsEditor.dataType.numericDescription', {
@@ -699,6 +719,23 @@ export const TYPE_DEFINITION: { [key in DataType]: DataTypeDefinition } = {
       </p>
     ),
   },
+  histogram: {
+    label: i18n.translate('xpack.idxMgmt.mappingsEditor.dataType.histogramDescription', {
+      defaultMessage: 'Histogram',
+    }),
+    value: 'histogram',
+    documentation: {
+      main: '/histogram.html',
+    },
+    description: () => (
+      <p>
+        <FormattedMessage
+          id="xpack.idxMgmt.mappingsEditor.dataType.histogramLongDescription"
+          defaultMessage="Histogram fields store pre-aggregated numerical data representing a histogram, and are intended for use with aggregations."
+        />
+      </p>
+    ),
+  },
   join: {
     label: i18n.translate('xpack.idxMgmt.mappingsEditor.dataType.joinDescription', {
       defaultMessage: 'Join',
@@ -822,6 +859,7 @@ export const MAIN_TYPES: MainType[] = [
   'binary',
   'boolean',
   'completion',
+  'constant_keyword',
   'date',
   'date_nanos',
   'dense_vector',
@@ -842,6 +880,7 @@ export const MAIN_TYPES: MainType[] = [
   'shape',
   'text',
   'token_count',
+  'histogram',
   'wildcard',
   'other',
 ];
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/constants/parameters_definition.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/constants/parameters_definition.tsx
index f2148f1f657a6..fd17dc1b8fd1e 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/constants/parameters_definition.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/constants/parameters_definition.tsx
@@ -29,7 +29,7 @@ import { INDEX_DEFAULT } from './default_values';
 import { TYPE_DEFINITION } from './data_types_definition';
 
 const { toInt } = fieldFormatters;
-const { emptyField, containsCharsField, numberGreaterThanField } = fieldValidators;
+const { emptyField, containsCharsField, numberGreaterThanField, isJsonField } = fieldValidators;
 
 const commonErrorMessages = {
   smallerThanZero: i18n.translate(
@@ -404,6 +404,88 @@ export const PARAMETERS_DEFINITION: { [key in ParameterName]: ParameterDefinitio
     },
     schema: t.string,
   },
+  value: {
+    fieldConfig: {
+      defaultValue: '',
+      type: FIELD_TYPES.TEXT,
+      label: i18n.translate('xpack.idxMgmt.mappingsEditor.parameters.valueLabel', {
+        defaultMessage: 'Value',
+      }),
+    },
+    schema: t.string,
+  },
+  meta: {
+    fieldConfig: {
+      defaultValue: '',
+      label: i18n.translate('xpack.idxMgmt.mappingsEditor.parameters.metaLabel', {
+        defaultMessage: 'Metadata',
+      }),
+      helpText: (
+        <FormattedMessage
+          id="xpack.idxMgmt.mappingsEditor.parameters.metaHelpText"
+          defaultMessage="Use JSON format: {code}"
+          values={{
+            code: <EuiCode>{JSON.stringify({ arbitrary_key: 'anything_goes' })}</EuiCode>,
+          }}
+        />
+      ),
+      validations: [
+        {
+          validator: isJsonField(
+            i18n.translate('xpack.idxMgmt.mappingsEditor.parameters.metaFieldEditorJsonError', {
+              defaultMessage: 'Invalid JSON.',
+            }),
+            { allowEmptyString: true }
+          ),
+        },
+        {
+          validator: ({ value }: ValidationFuncArg<any, string>) => {
+            if (typeof value !== 'string' || value.trim() === '') {
+              return;
+            }
+
+            const json = JSON.parse(value);
+            const valuesAreNotString = Object.values(json).some((v) => typeof v !== 'string');
+
+            if (Array.isArray(json)) {
+              return {
+                message: i18n.translate(
+                  'xpack.idxMgmt.mappingsEditor.parameters.metaFieldEditorArraysNotAllowedError',
+                  {
+                    defaultMessage: 'Arrays are not allowed.',
+                  }
+                ),
+              };
+            } else if (valuesAreNotString) {
+              return {
+                message: i18n.translate(
+                  'xpack.idxMgmt.mappingsEditor.parameters.metaFieldEditorOnlyStringValuesAllowedError',
+                  {
+                    defaultMessage: 'Values must be a string.',
+                  }
+                ),
+              };
+            }
+          },
+        },
+      ],
+      deserializer: (value: any) => {
+        if (value === '') {
+          return value;
+        }
+        return JSON.stringify(value, null, 2);
+      },
+      serializer: (value: string) => {
+        const parsed = JSON.parse(value);
+        // If an empty object was passed, strip out this value entirely.
+        if (!Object.keys(parsed).length) {
+          return undefined;
+        }
+        return parsed;
+      },
+    },
+    schema: t.any,
+  },
   max_input_length: {
     fieldConfig: {
       defaultValue: 50,
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/types/document_fields.ts b/x-pack/plugins/index_management/public/application/components/mappings_editor/types/document_fields.ts
index fd0e4ed32bfe8..97dca49fc93ed 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/types/document_fields.ts
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/types/document_fields.ts
@@ -59,6 +59,8 @@ export type MainType =
   | 'geo_point'
   | 'geo_shape'
   | 'token_count'
+  | 'histogram'
+  | 'constant_keyword'
   | 'wildcard'
   /**
    * 'other' is a special type that only exists inside of MappingsEditor as a placeholder
@@ -146,7 +148,9 @@ export type ParameterName =
   | 'dims'
   | 'depth_limit'
   | 'relations'
-  | 'max_shingle_size';
+  | 'max_shingle_size'
+  | 'value'
+  | 'meta';
 
 export interface Parameter {
   fieldConfig: FieldConfig;
diff --git a/x-pack/plugins/index_management/public/application/services/documentation.ts b/x-pack/plugins/index_management/public/application/services/documentation.ts
index afc9c76f1afbe..c52b958d94ae1 100644
--- a/x-pack/plugins/index_management/public/application/services/documentation.ts
+++ b/x-pack/plugins/index_management/public/application/services/documentation.ts
@@ -123,6 +123,10 @@ class DocumentationService {
     return `${this.esDocsBase}/ignore-malformed.html`;
   }
 
+  public getMetaLink() {
+    return `${this.esDocsBase}/mapping-field-meta.html`;
+  }
+
   public getFormatLink() {
     return `${this.esDocsBase}/mapping-date-format.html`;
   }
diff --git a/x-pack/plugins/ingest_manager/server/index.ts b/x-pack/plugins/ingest_manager/server/index.ts
index e8ea886cbf9f5..f87ebb3d2c404 100644
--- a/x-pack/plugins/ingest_manager/server/index.ts
+++ b/x-pack/plugins/ingest_manager/server/index.ts
@@ -11,7 +11,7 @@ import {
   AGENT_POLICY_ROLLOUT_RATE_LIMIT_REQUEST_PER_INTERVAL,
   AGENT_POLLING_REQUEST_TIMEOUT_MS,
 } from '../common';
-export { AgentService, ESIndexPatternService, getRegistryUrl } from './services';
+export { AgentService, ESIndexPatternService, getRegistryUrl, PackageService } from './services';
 export {
   IngestManagerSetupContract,
   IngestManagerSetupDeps,
diff --git a/x-pack/plugins/ingest_manager/server/plugin.ts b/x-pack/plugins/ingest_manager/server/plugin.ts
index b10f3527a0459..47900415466b9 100644
--- a/x-pack/plugins/ingest_manager/server/plugin.ts
+++ b/x-pack/plugins/ingest_manager/server/plugin.ts
@@ -13,6 +13,7 @@ import {
   PluginInitializerContext,
   SavedObjectsServiceStart,
   HttpServiceSetup,
+  SavedObjectsClientContract,
 } from 'kibana/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { LicensingPluginSetup, ILicense } from '../../licensing/server';
@@ -47,7 +48,7 @@ import {
   registerSettingsRoutes,
   registerAppRoutes,
 } from './routes';
-import { IngestManagerConfigType, NewPackagePolicy } from '../common';
+import { EsAssetReference, IngestManagerConfigType, NewPackagePolicy } from '../common';
 import {
   appContextService,
   licenseService,
@@ -55,6 +56,7 @@ import {
   ESIndexPatternService,
   AgentService,
   packagePolicyService,
+  PackageService,
 } from './services';
 import {
   getAgentStatusById,
@@ -65,6 +67,7 @@ import {
 import { CloudSetup } from '../../cloud/server';
 import { agentCheckinState } from './services/agents/checkin/state';
 import { registerIngestManagerUsageCollector } from './collectors/register';
+import { getInstallation } from './services/epm/packages';
 
 export interface IngestManagerSetupDeps {
   licensing: LicensingPluginSetup;
@@ -118,6 +121,7 @@ export type ExternalCallbacksStorage = Map<ExternalCallback[0], Set<ExternalCall
  */
 export interface IngestManagerStartContract {
   esIndexPatternService: ESIndexPatternService;
+  packageService: PackageService;
   agentService: AgentService;
   /**
    * Services for Ingest's package policies
@@ -273,6 +277,15 @@ export class IngestManagerPlugin
 
     return {
       esIndexPatternService: new ESIndexPatternSavedObjectService(),
+      packageService: {
+        getInstalledEsAssetReferences: async (
+          savedObjectsClient: SavedObjectsClientContract,
+          pkgName: string
+        ): Promise<EsAssetReference[]> => {
+          const installation = await getInstallation({ savedObjectsClient, pkgName });
+          return installation?.installed_es || [];
+        },
+      },
       agentService: {
         getAgent,
         listAgents,
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts b/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
index 605e4db230ce5..b9789b770eb2e 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
@@ -30,6 +30,7 @@ import {
 import * as AgentService from '../../services/agents';
 import * as APIKeyService from '../../services/api_keys';
 import { appContextService } from '../../services/app_context';
+import { defaultIngestErrorHandler } from '../../errors';
 
 export const getAgentHandler: RequestHandler<TypeOf<
   typeof GetOneAgentRequestSchema.params
@@ -83,17 +84,13 @@ export const getAgentEventsHandler: RequestHandler<
     return response.ok({
       body,
     });
-  } catch (e) {
-    if (e.isBoom && e.output.statusCode === 404) {
+  } catch (error) {
+    if (error.isBoom && error.output.statusCode === 404) {
       return response.notFound({
         body: { message: `Agent ${request.params.agentId} not found` },
       });
     }
-
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+    return defaultIngestErrorHandler({ error, response });
   }
 };
 
@@ -288,11 +285,8 @@ export const getAgentsHandler: RequestHandler<
       perPage,
     };
     return response.ok({ body });
-  } catch (e) {
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+  } catch (error) {
+    return defaultIngestErrorHandler({ error, response });
   }
 };
 
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/install.ts b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/install.ts
index 1e58319183c7d..83ad08d09de76 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/install.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/install.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SavedObjectsClientContract } from 'kibana/server';
+import { Logger, SavedObjectsClientContract } from 'kibana/server';
 
 import { saveInstalledEsRefs } from '../../packages/install';
 import * as Registry from '../../registry';
@@ -33,89 +33,100 @@ export const installTransformForDataset = async (
   registryPackage: RegistryPackage,
   paths: string[],
   callCluster: CallESAsCurrentUser,
-  savedObjectsClient: SavedObjectsClientContract
+  savedObjectsClient: SavedObjectsClientContract,
+  logger: Logger
 ) => {
-  const installation = await getInstallation({ savedObjectsClient, pkgName: registryPackage.name });
-  let previousInstalledTransformEsAssets: EsAssetReference[] = [];
-  if (installation) {
-    previousInstalledTransformEsAssets = installation.installed_es.filter(
-      ({ type, id }) => type === ElasticsearchAssetType.transform
+  try {
+    const installation = await getInstallation({
+      savedObjectsClient,
+      pkgName: registryPackage.name,
+    });
+    let previousInstalledTransformEsAssets: EsAssetReference[] = [];
+    if (installation) {
+      previousInstalledTransformEsAssets = installation.installed_es.filter(
+        ({ type, id }) => type === ElasticsearchAssetType.transform
+      );
+    }
+
+    // delete all previous transform
+    await deleteTransforms(
+      callCluster,
+      previousInstalledTransformEsAssets.map((asset) => asset.id)
     );
-  }
-
-  // delete all previous transform
-  await deleteTransforms(
-    callCluster,
-    previousInstalledTransformEsAssets.map((asset) => asset.id)
-  );
-  // install the latest dataset
-  const datasets = registryPackage.datasets;
-  if (!datasets?.length) return [];
-  const installNameSuffix = `${registryPackage.version}`;
-
-  const transformPaths = paths.filter((path) => isTransform(path));
-  let installedTransforms: EsAssetReference[] = [];
-  if (transformPaths.length > 0) {
-    const transformPathDatasets = datasets.reduce<TransformPathDataset[]>((acc, dataset) => {
-      transformPaths.forEach((path) => {
-        if (isDatasetTransform(path, dataset.path)) {
-          acc.push({ path, dataset });
-        }
-      });
-      return acc;
-    }, []);
-
-    const transformRefs = transformPathDatasets.reduce<EsAssetReference[]>(
-      (acc, transformPathDataset) => {
-        if (transformPathDataset) {
-          acc.push({
-            id: getTransformNameForInstallation(transformPathDataset, installNameSuffix),
-            type: ElasticsearchAssetType.transform,
-          });
-        }
+    // install the latest dataset
+    const datasets = registryPackage.datasets;
+    if (!datasets?.length) return [];
+    const installNameSuffix = `${registryPackage.version}`;
+
+    const transformPaths = paths.filter((path) => isTransform(path));
+    let installedTransforms: EsAssetReference[] = [];
+    if (transformPaths.length > 0) {
+      const transformPathDatasets = datasets.reduce<TransformPathDataset[]>((acc, dataset) => {
+        transformPaths.forEach((path) => {
+          if (isDatasetTransform(path, dataset.path)) {
+            acc.push({ path, dataset });
+          }
+        });
         return acc;
-      },
-      []
-    );
-
-    // get and save transform refs before installing transforms
-    await saveInstalledEsRefs(savedObjectsClient, registryPackage.name, transformRefs);
-
-    const transforms: TransformInstallation[] = transformPathDatasets.map(
-      (transformPathDataset: TransformPathDataset) => {
-        return {
-          installationName: getTransformNameForInstallation(
-            transformPathDataset,
-            installNameSuffix
-          ),
-          content: getAsset(transformPathDataset.path).toString('utf-8'),
-        };
-      }
-    );
+      }, []);
+
+      const transformRefs = transformPathDatasets.reduce<EsAssetReference[]>(
+        (acc, transformPathDataset) => {
+          if (transformPathDataset) {
+            acc.push({
+              id: getTransformNameForInstallation(transformPathDataset, installNameSuffix),
+              type: ElasticsearchAssetType.transform,
+            });
+          }
+          return acc;
+        },
+        []
+      );
+
+      // get and save transform refs before installing transforms
+      await saveInstalledEsRefs(savedObjectsClient, registryPackage.name, transformRefs);
+
+      const transforms: TransformInstallation[] = transformPathDatasets.map(
+        (transformPathDataset: TransformPathDataset) => {
+          return {
+            installationName: getTransformNameForInstallation(
+              transformPathDataset,
+              installNameSuffix
+            ),
+            content: getAsset(transformPathDataset.path).toString('utf-8'),
+          };
+        }
+      );
 
-    const installationPromises = transforms.map(async (transform) => {
-      return installTransform({ callCluster, transform });
-    });
+      const installationPromises = transforms.map(async (transform) => {
+        return installTransform({ callCluster, transform, logger });
+      });
 
-    installedTransforms = await Promise.all(installationPromises).then((results) => results.flat());
-  }
+      installedTransforms = await Promise.all(installationPromises).then((results) =>
+        results.flat()
+      );
+    }
 
-  if (previousInstalledTransformEsAssets.length > 0) {
-    const currentInstallation = await getInstallation({
-      savedObjectsClient,
-      pkgName: registryPackage.name,
-    });
+    if (previousInstalledTransformEsAssets.length > 0) {
+      const currentInstallation = await getInstallation({
+        savedObjectsClient,
+        pkgName: registryPackage.name,
+      });
 
-    // remove the saved object reference
-    await deleteTransformRefs(
-      savedObjectsClient,
-      currentInstallation?.installed_es || [],
-      registryPackage.name,
-      previousInstalledTransformEsAssets.map((asset) => asset.id),
-      installedTransforms.map((installed) => installed.id)
-    );
+      // remove the saved object reference
+      await deleteTransformRefs(
+        savedObjectsClient,
+        currentInstallation?.installed_es || [],
+        registryPackage.name,
+        previousInstalledTransformEsAssets.map((asset) => asset.id),
+        installedTransforms.map((installed) => installed.id)
+      );
+    }
+    return installedTransforms;
+  } catch (err) {
+    logger.error(err);
+    throw err;
   }
-  return installedTransforms;
 };
 
 const isTransform = (path: string) => {
@@ -136,24 +147,31 @@ const isDatasetTransform = (path: string, datasetName: string) => {
 async function installTransform({
   callCluster,
   transform,
+  logger,
 }: {
   callCluster: CallESAsCurrentUser;
   transform: TransformInstallation;
+  logger: Logger;
 }): Promise<EsAssetReference> {
-  // defer validation on put if the source index is not available
-  await callCluster('transport.request', {
-    method: 'PUT',
-    path: `_transform/${transform.installationName}`,
-    query: 'defer_validation=true',
-    body: transform.content,
-  });
-
-  await callCluster('transport.request', {
-    method: 'POST',
-    path: `_transform/${transform.installationName}/_start`,
-  });
-
-  return { id: transform.installationName, type: ElasticsearchAssetType.transform };
+  try {
+    // defer validation on put if the source index is not available
+    await callCluster('transport.request', {
+      method: 'PUT',
+      path: `/_transform/${transform.installationName}`,
+      query: 'defer_validation=true',
+      body: transform.content,
+    });
+
+    await callCluster('transport.request', {
+      method: 'POST',
+      path: `/_transform/${transform.installationName}/_start`,
+    });
+
+    return { id: transform.installationName, type: ElasticsearchAssetType.transform };
+  } catch (err) {
+    logger.error(err);
+    throw err;
+  }
 }
 
 const getTransformNameForInstallation = (
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/remove.ts b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/remove.ts
index 5c9d3e2846200..a527d05f1c49b 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/remove.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/remove.ts
@@ -12,7 +12,7 @@ export const stopTransforms = async (transformIds: string[], callCluster: CallES
   for (const transformId of transformIds) {
     await callCluster('transport.request', {
       method: 'POST',
-      path: `_transform/${transformId}/_stop`,
+      path: `/_transform/${transformId}/_stop`,
       query: 'force=true',
       ignore: [404],
     });
@@ -29,7 +29,7 @@ export const deleteTransforms = async (
       await callCluster('transport.request', {
         method: 'DELETE',
         query: 'force=true',
-        path: `_transform/${transformId}`,
+        path: `/_transform/${transformId}`,
         ignore: [404],
       });
     })
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/transform.test.ts b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/transform.test.ts
index 0b66077b8699a..bb506ecad0ade 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/transform.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/transform/transform.test.ts
@@ -4,6 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { loggingSystemMock } from '../../../../../../../../src/core/server/logging/logging_system.mock';
+
 jest.mock('../../packages/get', () => {
   return { getInstallation: jest.fn(), getInstallationObject: jest.fn() };
 });
@@ -15,7 +18,12 @@ jest.mock('./common', () => {
 });
 
 import { installTransformForDataset } from './install';
-import { ILegacyScopedClusterClient, SavedObject, SavedObjectsClientContract } from 'kibana/server';
+import {
+  ILegacyScopedClusterClient,
+  LoggerFactory,
+  SavedObject,
+  SavedObjectsClientContract,
+} from 'kibana/server';
 import { ElasticsearchAssetType, Installation, RegistryPackage } from '../../../../types';
 import { getInstallation, getInstallationObject } from '../../packages';
 import { getAsset } from './common';
@@ -25,6 +33,7 @@ import { savedObjectsClientMock } from '../../../../../../../../src/core/server/
 describe('test transform install', () => {
   let legacyScopedClusterClient: jest.Mocked<ILegacyScopedClusterClient>;
   let savedObjectsClient: jest.Mocked<SavedObjectsClientContract>;
+  let logger: jest.Mocked<LoggerFactory>;
   beforeEach(() => {
     legacyScopedClusterClient = {
       callAsInternalUser: jest.fn(),
@@ -33,6 +42,7 @@ describe('test transform install', () => {
     (getInstallation as jest.MockedFunction<typeof getInstallation>).mockReset();
     (getInstallationObject as jest.MockedFunction<typeof getInstallationObject>).mockReset();
     savedObjectsClient = savedObjectsClientMock.create();
+    logger = loggingSystemMock.create();
   });
 
   afterEach(() => {
@@ -132,15 +142,15 @@ describe('test transform install', () => {
         'endpoint-0.16.0-dev.0/dataset/metadata_current/elasticsearch/transform/default.json',
       ],
       legacyScopedClusterClient.callAsCurrentUser,
-      savedObjectsClient
+      savedObjectsClient,
+      logger.get('ingest')
     );
-
     expect(legacyScopedClusterClient.callAsCurrentUser.mock.calls).toEqual([
       [
         'transport.request',
         {
           method: 'POST',
-          path: '_transform/metrics-endpoint.metadata_current-default-0.15.0-dev.0/_stop',
+          path: '/_transform/metrics-endpoint.metadata_current-default-0.15.0-dev.0/_stop',
           query: 'force=true',
           ignore: [404],
         },
@@ -150,7 +160,7 @@ describe('test transform install', () => {
         {
           method: 'DELETE',
           query: 'force=true',
-          path: '_transform/metrics-endpoint.metadata_current-default-0.15.0-dev.0',
+          path: '/_transform/metrics-endpoint.metadata_current-default-0.15.0-dev.0',
           ignore: [404],
         },
       ],
@@ -158,7 +168,7 @@ describe('test transform install', () => {
         'transport.request',
         {
           method: 'PUT',
-          path: '_transform/metrics-endpoint.metadata-default-0.16.0-dev.0',
+          path: '/_transform/metrics-endpoint.metadata-default-0.16.0-dev.0',
           query: 'defer_validation=true',
           body: '{"content": "data"}',
         },
@@ -167,7 +177,7 @@ describe('test transform install', () => {
         'transport.request',
         {
           method: 'PUT',
-          path: '_transform/metrics-endpoint.metadata_current-default-0.16.0-dev.0',
+          path: '/_transform/metrics-endpoint.metadata_current-default-0.16.0-dev.0',
           query: 'defer_validation=true',
           body: '{"content": "data"}',
         },
@@ -176,14 +186,14 @@ describe('test transform install', () => {
         'transport.request',
         {
           method: 'POST',
-          path: '_transform/metrics-endpoint.metadata-default-0.16.0-dev.0/_start',
+          path: '/_transform/metrics-endpoint.metadata-default-0.16.0-dev.0/_start',
         },
       ],
       [
         'transport.request',
         {
           method: 'POST',
-          path: '_transform/metrics-endpoint.metadata_current-default-0.16.0-dev.0/_start',
+          path: '/_transform/metrics-endpoint.metadata_current-default-0.16.0-dev.0/_start',
         },
       ],
     ]);
@@ -287,7 +297,8 @@ describe('test transform install', () => {
       } as unknown) as RegistryPackage,
       ['endpoint-0.16.0-dev.0/dataset/metadata_current/elasticsearch/transform/default.json'],
       legacyScopedClusterClient.callAsCurrentUser,
-      savedObjectsClient
+      savedObjectsClient,
+      logger.get('ingest')
     );
 
     expect(legacyScopedClusterClient.callAsCurrentUser.mock.calls).toEqual([
@@ -295,7 +306,7 @@ describe('test transform install', () => {
         'transport.request',
         {
           method: 'PUT',
-          path: '_transform/metrics-endpoint.metadata_current-default-0.16.0-dev.0',
+          path: '/_transform/metrics-endpoint.metadata_current-default-0.16.0-dev.0',
           query: 'defer_validation=true',
           body: '{"content": "data"}',
         },
@@ -304,7 +315,7 @@ describe('test transform install', () => {
         'transport.request',
         {
           method: 'POST',
-          path: '_transform/metrics-endpoint.metadata_current-default-0.16.0-dev.0/_start',
+          path: '/_transform/metrics-endpoint.metadata_current-default-0.16.0-dev.0/_start',
         },
       ],
     ]);
@@ -384,26 +395,27 @@ describe('test transform install', () => {
       } as unknown) as RegistryPackage,
       [],
       legacyScopedClusterClient.callAsCurrentUser,
-      savedObjectsClient
+      savedObjectsClient,
+      logger.get('ingest')
     );
 
     expect(legacyScopedClusterClient.callAsCurrentUser.mock.calls).toEqual([
       [
         'transport.request',
         {
-          ignore: [404],
           method: 'POST',
-          path: '_transform/metrics-endpoint.metadata-current-default-0.15.0-dev.0/_stop',
+          path: '/_transform/metrics-endpoint.metadata-current-default-0.15.0-dev.0/_stop',
           query: 'force=true',
+          ignore: [404],
         },
       ],
       [
         'transport.request',
         {
-          ignore: [404],
           method: 'DELETE',
-          path: '_transform/metrics-endpoint.metadata-current-default-0.15.0-dev.0',
           query: 'force=true',
+          path: '/_transform/metrics-endpoint.metadata-current-default-0.15.0-dev.0',
+          ignore: [404],
         },
       ],
     ]);
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts b/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
index 54b9c4d3fbb17..4179e82d6ad1d 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
@@ -36,6 +36,7 @@ import { deleteKibanaSavedObjectsAssets } from './remove';
 import { PackageOutdatedError } from '../../../errors';
 import { getPackageSavedObjects } from './get';
 import { installTransformForDataset } from '../elasticsearch/transform/install';
+import { appContextService } from '../../app_context';
 
 export async function installLatestPackage(options: {
   savedObjectsClient: SavedObjectsClientContract;
@@ -196,7 +197,8 @@ export async function installPackage({
     registryPackageInfo,
     paths,
     callCluster,
-    savedObjectsClient
+    savedObjectsClient,
+    appContextService.getLogger()
   );
 
   // if this is an update or retrying an update, delete the previous version's pipelines
diff --git a/x-pack/plugins/ingest_manager/server/services/index.ts b/x-pack/plugins/ingest_manager/server/services/index.ts
index e768862d2dee1..5942277e90824 100644
--- a/x-pack/plugins/ingest_manager/server/services/index.ts
+++ b/x-pack/plugins/ingest_manager/server/services/index.ts
@@ -5,7 +5,7 @@
  */
 
 import { SavedObjectsClientContract, KibanaRequest } from 'kibana/server';
-import { AgentStatus, Agent } from '../types';
+import { AgentStatus, Agent, EsAssetReference } from '../types';
 import * as settingsService from './settings';
 export { ESIndexPatternSavedObjectService } from './es_index_pattern';
 
@@ -22,6 +22,17 @@ export interface ESIndexPatternService {
   ): Promise<string | undefined>;
 }
 
+/**
+ * Service that provides exported function that return information about EPM packages
+ */
+
+export interface PackageService {
+  getInstalledEsAssetReferences(
+    savedObjectsClient: SavedObjectsClientContract,
+    pkgName: string
+  ): Promise<EsAssetReference[]>;
+}
+
 /**
  * A service that provides exported functions that return information about an Agent
  */
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/trim.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/trim.tsx
index aca5a3b4121b5..18f3e84fb2706 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/trim.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/trim.tsx
@@ -17,7 +17,7 @@ export const Trim: FunctionComponent = () => {
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.trimForm.fieldNameHelpText',
-          { defaultMessage: 'The field to trim whitespace from.' }
+          { defaultMessage: 'Field to trim. For an array of strings, each element is trimmed.' }
         )}
       />
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/uppercase.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/uppercase.tsx
index 336b68f8c2b7b..e32b75a215155 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/uppercase.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/uppercase.tsx
@@ -17,7 +17,10 @@ export const Uppercase: FunctionComponent = () => {
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.uppercaseForm.fieldNameHelpText',
-          { defaultMessage: 'The field to make uppercase.' }
+          {
+            defaultMessage:
+              'Field to uppercase. For an array of strings, each element is uppercased.',
+          }
         )}
       />
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/url_decode.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/url_decode.tsx
index 196645a89f707..2cccdec9b8885 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/url_decode.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/url_decode.tsx
@@ -17,7 +17,7 @@ export const UrlDecode: FunctionComponent = () => {
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.urlDecodeForm.fieldNameHelpText',
-          { defaultMessage: 'The field to decode.' }
+          { defaultMessage: 'Field to decode. For an array of strings, each element is decoded.' }
         )}
       />
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/user_agent.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/user_agent.tsx
index 8395833c09f28..a7866d08ef022 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/user_agent.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/user_agent.tsx
@@ -5,6 +5,8 @@
  */
 
 import React, { FunctionComponent } from 'react';
+import { EuiCode } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 
 import { EuiComboBoxOptionOption } from '@elastic/eui';
@@ -39,7 +41,7 @@ const fieldsConfig: FieldsConfig = {
       'xpack.ingestPipelines.pipelineEditor.userAgentForm.regexFileFieldHelpText',
       {
         defaultMessage:
-          'A filename containing the regular expressions for parsing the user agent string.',
+          'File containing the regular expressions used to parse the user agent string.',
       }
     ),
   },
@@ -51,13 +53,23 @@ export const UserAgent: FunctionComponent = () => {
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.userAgentForm.fieldNameHelpText',
-          { defaultMessage: 'The field containing the user agent string.' }
+          { defaultMessage: 'Field containing the user agent string.' }
         )}
       />
 
       <UseField config={fieldsConfig.regex_file} component={Field} path="fields.regex_file" />
 
-      <TargetField />
+      <TargetField
+        helpText={
+          <FormattedMessage
+            id="xpack.ingestPipelines.pipelineEditor.userAgentForm.targetFieldHelpText"
+            defaultMessage="Output field. Defaults to {defaultField}."
+            values={{
+              defaultField: <EuiCode inline>{'user_agent'}</EuiCode>,
+            }}
+          />
+        }
+      />
 
       <PropertiesField
         helpText={i18n.translate(
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx
index 8d9260f3c822c..0a094009da2c6 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx
@@ -413,6 +413,9 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.trim', {
       defaultMessage: 'Trim',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.trim', {
+      defaultMessage: 'Removes leading and trailing whitespace from a string.',
+    }),
   },
   uppercase: {
     FieldsComponent: Uppercase,
@@ -420,6 +423,9 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.uppercase', {
       defaultMessage: 'Uppercase',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.uppercase', {
+      defaultMessage: 'Converts a string to uppercase.',
+    }),
   },
   urldecode: {
     FieldsComponent: UrlDecode,
@@ -427,6 +433,9 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.urldecode', {
       defaultMessage: 'URL decode',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.urldecode', {
+      defaultMessage: 'Decodes a URL-encoded string.',
+    }),
   },
   user_agent: {
     FieldsComponent: UserAgent,
@@ -434,6 +443,9 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.userAgent', {
       defaultMessage: 'User agent',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.userAgent', {
+      defaultMessage: "Extracts values from a browser's user agent string.",
+    }),
   },
 };
 
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/bucket_nesting_editor.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/bucket_nesting_editor.tsx
index 281c72915e46e..325f18ee9833a 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/bucket_nesting_editor.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/bucket_nesting_editor.tsx
@@ -69,7 +69,7 @@ export function BucketNestingEditor({
         values: { field: fieldName },
       }),
       filters: i18n.translate('xpack.lens.indexPattern.groupingOverallFilters', {
-        defaultMessage: 'Top values for each custom query',
+        defaultMessage: 'Top values for each filter',
       }),
       date_histogram: i18n.translate('xpack.lens.indexPattern.groupingOverallDateHistogram', {
         defaultMessage: 'Top values for each {field}',
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.test.tsx
index 6364d3913bf57..2d79c5faf74fe 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.test.tsx
@@ -54,7 +54,7 @@ describe('filters', () => {
           columnOrder: ['col1', 'col2'],
           columns: {
             col1: {
-              label: 'Custom query',
+              label: 'filters',
               dataType: 'document',
               operationType: 'filters',
               scale: 'ordinal',
@@ -209,7 +209,7 @@ describe('filters', () => {
       });
     });
 
-    describe('Modify custom query', () => {
+    describe('Modify filters', () => {
       it('should correctly show existing filters ', () => {
         const setStateSpy = jest.fn();
         const instance = mount(
@@ -236,7 +236,7 @@ describe('filters', () => {
         ).toEqual('src : 2');
       });
 
-      it('should remove custom query', () => {
+      it('should remove filter', () => {
         const setStateSpy = jest.fn();
         const instance = mount(
           <InlineOptions
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.tsx
index bca64d1f2f362..cc1e23cb82a49 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.tsx
@@ -31,8 +31,8 @@ export interface FilterValue {
   label: string;
 }
 
-const customQueryLabel = i18n.translate('xpack.lens.indexPattern.customQuery', {
-  defaultMessage: 'Custom query',
+const filtersLabel = i18n.translate('xpack.lens.indexPattern.filters', {
+  defaultMessage: 'Filters',
 });
 
 export const defaultLabel = i18n.translate('xpack.lens.indexPattern.filters.label.placeholder', {
@@ -70,7 +70,7 @@ export interface FiltersIndexPatternColumn extends FieldBasedIndexPatternColumn
 
 export const filtersOperation: OperationDefinition<FiltersIndexPatternColumn> = {
   type: 'filters',
-  displayName: customQueryLabel,
+  displayName: filtersLabel,
   priority: 3, // Higher than any metric
   getPossibleOperationForField: ({ type }) => {
     if (type === 'document') {
@@ -102,7 +102,7 @@ export const filtersOperation: OperationDefinition<FiltersIndexPatternColumn> =
     }
 
     return {
-      label: customQueryLabel,
+      label: filtersLabel,
       dataType: 'string',
       operationType: 'filters',
       scale: 'ordinal',
@@ -223,8 +223,8 @@ export const FilterList = ({
                 defaultMessage: 'This query is invalid',
               })}
               onRemoveClick={() => onRemoveFilter(filter.id)}
-              removeTitle={i18n.translate('xpack.lens.indexPattern.filters.removeCustomQuery', {
-                defaultMessage: 'Remove custom query',
+              removeTitle={i18n.translate('xpack.lens.indexPattern.filters.removeFilter', {
+                defaultMessage: 'Remove a filter',
               })}
             >
               <FilterPopover
@@ -259,8 +259,8 @@ export const FilterList = ({
           onAddFilter();
           setIsOpenByCreation(true);
         }}
-        label={i18n.translate('xpack.lens.indexPattern.filters.addCustomQuery', {
-          defaultMessage: 'Add a custom query',
+        label={i18n.translate('xpack.lens.indexPattern.filters.addaFilter', {
+          defaultMessage: 'Add a filter',
         })}
       />
     </>
diff --git a/x-pack/plugins/lens/public/shared_components/toolbar_popover.tsx b/x-pack/plugins/lens/public/shared_components/toolbar_popover.tsx
index 98f5878ec927e..07baf29fdd32a 100644
--- a/x-pack/plugins/lens/public/shared_components/toolbar_popover.tsx
+++ b/x-pack/plugins/lens/public/shared_components/toolbar_popover.tsx
@@ -56,6 +56,7 @@ export const ToolbarPopover: React.FunctionComponent<ToolbarPopoverProps> = ({
             onClick={() => {
               setOpen(!open);
             }}
+            title={title}
             hasArrow={false}
             isDisabled={isDisabled}
             groupPosition={groupPosition}
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx
index 7e2e8f0453588..2114d63fcfacd 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx
@@ -7,7 +7,7 @@
 import React from 'react';
 import { mountWithIntl as mount, shallowWithIntl as shallow } from 'test_utils/enzyme_helpers';
 import { EuiButtonGroupProps, EuiSuperSelect, EuiButtonGroup } from '@elastic/eui';
-import { LayerContextMenu, XyToolbar } from './xy_config_panel';
+import { LayerContextMenu, XyToolbar, DimensionEditor } from './xy_config_panel';
 import { ToolbarPopover } from '../shared_components';
 import { AxisSettingsPopover } from './axis_settings_popover';
 import { FramePublicAPI } from '../types';
@@ -171,4 +171,48 @@ describe('XY Config panels', () => {
       expect(component.find(AxisSettingsPopover).length).toEqual(3);
     });
   });
+
+  describe('Dimension Editor', () => {
+    test('shows the correct axis side options when in horizontal mode', () => {
+      const state = testState();
+      const component = mount(
+        <DimensionEditor
+          layerId={state.layers[0].layerId}
+          frame={frame}
+          setState={jest.fn()}
+          accessor="bar"
+          groupId="left"
+          state={{ ...state, layers: [{ ...state.layers[0], seriesType: 'bar_horizontal' }] }}
+        />
+      );
+
+      const options = component
+        .find(EuiButtonGroup)
+        .first()
+        .prop('options') as EuiButtonGroupProps['options'];
+
+      expect(options!.map(({ label }) => label)).toEqual(['Auto', 'Bottom', 'Top']);
+    });
+
+    test('shows the default axis side options when not in horizontal mode', () => {
+      const state = testState();
+      const component = mount(
+        <DimensionEditor
+          layerId={state.layers[0].layerId}
+          frame={frame}
+          setState={jest.fn()}
+          accessor="bar"
+          groupId="left"
+          state={state}
+        />
+      );
+
+      const options = component
+        .find(EuiButtonGroup)
+        .first()
+        .prop('options') as EuiButtonGroupProps['options'];
+
+      expect(options!.map(({ label }) => label)).toEqual(['Auto', 'Left', 'Right']);
+    });
+  });
 });
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
index bc98bf53d9f12..4aa5bd62c05a5 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
@@ -274,9 +274,15 @@ export function XyToolbar(props: VisualizationToolbarProps<State>) {
       <EuiFlexItem>
         <EuiFlexGroup gutterSize="none" responsive={false}>
           <TooltipWrapper
-            tooltipContent={i18n.translate('xpack.lens.xyChart.leftAxisDisabledHelpText', {
-              defaultMessage: 'This setting only applies when left axis is enabled.',
-            })}
+            tooltipContent={
+              shouldRotate
+                ? i18n.translate('xpack.lens.xyChart.bottomAxisDisabledHelpText', {
+                    defaultMessage: 'This setting only applies when bottom axis is enabled.',
+                  })
+                : i18n.translate('xpack.lens.xyChart.leftAxisDisabledHelpText', {
+                    defaultMessage: 'This setting only applies when left axis is enabled.',
+                  })
+            }
             condition={
               Object.keys(axisGroups.find((group) => group.groupId === 'left') || {}).length === 0
             }
@@ -310,9 +316,15 @@ export function XyToolbar(props: VisualizationToolbarProps<State>) {
             toggleAxisTitleVisibility={onAxisTitlesVisibilitySettingsChange}
           />
           <TooltipWrapper
-            tooltipContent={i18n.translate('xpack.lens.xyChart.rightAxisDisabledHelpText', {
-              defaultMessage: 'This setting only applies when right axis is enabled.',
-            })}
+            tooltipContent={
+              shouldRotate
+                ? i18n.translate('xpack.lens.xyChart.topAxisDisabledHelpText', {
+                    defaultMessage: 'This setting only applies when top axis is enabled.',
+                  })
+                : i18n.translate('xpack.lens.xyChart.rightAxisDisabledHelpText', {
+                    defaultMessage: 'This setting only applies when right axis is enabled.',
+                  })
+            }
             condition={
               Object.keys(axisGroups.find((group) => group.groupId === 'right') || {}).length === 0
             }
@@ -345,6 +357,7 @@ export function DimensionEditor(props: VisualizationDimensionEditorProps<State>)
   const { state, setState, layerId, accessor } = props;
   const index = state.layers.findIndex((l) => l.layerId === layerId);
   const layer = state.layers[index];
+  const isHorizontal = isHorizontalChart(state.layers);
   const axisMode =
     (layer.yConfig &&
       layer.yConfig?.find((yAxisConfig) => yAxisConfig.forAccessor === accessor)?.axisMode) ||
@@ -377,15 +390,23 @@ export function DimensionEditor(props: VisualizationDimensionEditorProps<State>)
             },
             {
               id: `${idPrefix}left`,
-              label: i18n.translate('xpack.lens.xyChart.axisSide.left', {
-                defaultMessage: 'Left',
-              }),
+              label: isHorizontal
+                ? i18n.translate('xpack.lens.xyChart.axisSide.bottom', {
+                    defaultMessage: 'Bottom',
+                  })
+                : i18n.translate('xpack.lens.xyChart.axisSide.left', {
+                    defaultMessage: 'Left',
+                  }),
             },
             {
               id: `${idPrefix}right`,
-              label: i18n.translate('xpack.lens.xyChart.axisSide.right', {
-                defaultMessage: 'Right',
-              }),
+              label: isHorizontal
+                ? i18n.translate('xpack.lens.xyChart.axisSide.top', {
+                    defaultMessage: 'Top',
+                  })
+                : i18n.translate('xpack.lens.xyChart.axisSide.right', {
+                    defaultMessage: 'Right',
+                  }),
             },
           ]}
           idSelected={`${idPrefix}${axisMode}`}
diff --git a/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx b/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx
index 7e18088444129..3aed5af5c5c25 100644
--- a/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx
+++ b/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx
@@ -27,7 +27,7 @@ export type FieldProps = {
   name: string;
 };
 
-type FieldOptions = Array<EuiSelectableOption<{ value: string }>>;
+type FieldOption = EuiSelectableOption<{ value: string }>;
 
 function sortByLabel(a: EuiSelectableOption, b: EuiSelectableOption): number {
   return a.label.localeCompare(b.label);
@@ -68,7 +68,7 @@ interface Props {
 interface State {
   isPopoverOpen: boolean;
   checkedFields: string[];
-  options?: FieldOptions;
+  options?: FieldOption[];
   prevFields?: FieldProps[];
   prevSelectedFields?: FieldProps[];
 }
@@ -107,15 +107,13 @@ export class AddTooltipFieldPopover extends Component<Props, State> {
     });
   };
 
-  _onSelect = (selectableOptions: EuiSelectableOption[]) => {
-    // EUI team to remove casting: https://github.com/elastic/eui/issues/3966
-    const options = selectableOptions as FieldOptions;
+  _onSelect = (options: FieldOption[]) => {
     const checkedFields: string[] = options
       .filter((option) => {
         return option.checked === 'on';
       })
       .map((option) => {
-        return option.value!;
+        return option.value;
       });
 
     this.setState({
@@ -156,7 +154,7 @@ export class AddTooltipFieldPopover extends Component<Props, State> {
 
     return (
       <Fragment>
-        <EuiSelectable
+        <EuiSelectable<FieldOption>
           searchable
           searchProps={{ compressed: true }}
           options={this.state.options}
diff --git a/x-pack/plugins/ml/common/constants/app.ts b/x-pack/plugins/ml/common/constants/app.ts
index 97dd7a7b0fef5..3d54e9e150fef 100644
--- a/x-pack/plugins/ml/common/constants/app.ts
+++ b/x-pack/plugins/ml/common/constants/app.ts
@@ -4,6 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { i18n } from '@kbn/i18n';
+
 export const PLUGIN_ID = 'ml';
 export const PLUGIN_ICON = 'machineLearningApp';
 export const PLUGIN_ICON_SOLUTION = 'logoKibana';
+export const ML_APP_NAME = i18n.translate('xpack.ml.navMenu.mlAppNameText', {
+  defaultMessage: 'Machine Learning',
+});
diff --git a/x-pack/plugins/ml/common/constants/data_frame_analytics.ts b/x-pack/plugins/ml/common/constants/data_frame_analytics.ts
index 830537cbadbc8..9a7af2496c03f 100644
--- a/x-pack/plugins/ml/common/constants/data_frame_analytics.ts
+++ b/x-pack/plugins/ml/common/constants/data_frame_analytics.ts
@@ -4,4 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+export const ANALYSIS_CONFIG_TYPE = {
+  OUTLIER_DETECTION: 'outlier_detection',
+  REGRESSION: 'regression',
+  CLASSIFICATION: 'classification',
+} as const;
 export const DEFAULT_RESULTS_FIELD = 'ml';
diff --git a/x-pack/plugins/ml/common/constants/ml_url_generator.ts b/x-pack/plugins/ml/common/constants/ml_url_generator.ts
index 44f33aa329e7a..541b8af6fc0fc 100644
--- a/x-pack/plugins/ml/common/constants/ml_url_generator.ts
+++ b/x-pack/plugins/ml/common/constants/ml_url_generator.ts
@@ -31,8 +31,16 @@ export const ML_PAGES = {
    * Open index data visualizer viewer page
    */
   DATA_VISUALIZER_INDEX_VIEWER: 'jobs/new_job/datavisualizer',
+  ANOMALY_DETECTION_CREATE_JOB: `jobs/new_job`,
   ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE: `jobs/new_job/step/job_type`,
+  ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX: `jobs/new_job/step/index_or_search`,
   SETTINGS: 'settings',
   CALENDARS_MANAGE: 'settings/calendars_list',
+  CALENDARS_NEW: 'settings/calendars_list/new_calendar',
+  CALENDARS_EDIT: 'settings/calendars_list/edit_calendar',
   FILTER_LISTS_MANAGE: 'settings/filter_lists',
+  FILTER_LISTS_NEW: 'settings/filter_lists/new_filter_list',
+  FILTER_LISTS_EDIT: 'settings/filter_lists/edit_filter_list',
+  ACCESS_DENIED: 'access-denied',
+  OVERVIEW: 'overview',
 } as const;
diff --git a/x-pack/plugins/ml/common/types/data_frame_analytics.ts b/x-pack/plugins/ml/common/types/data_frame_analytics.ts
index 96d6c81a3d309..5d0ecf96fb6b5 100644
--- a/x-pack/plugins/ml/common/types/data_frame_analytics.ts
+++ b/x-pack/plugins/ml/common/types/data_frame_analytics.ts
@@ -6,6 +6,7 @@
 
 import Boom from 'boom';
 import { EsErrorBody } from '../util/errors';
+import { ANALYSIS_CONFIG_TYPE } from '../constants/data_frame_analytics';
 
 export interface DeleteDataFrameAnalyticsWithIndexStatus {
   success: boolean;
@@ -81,8 +82,4 @@ export interface DataFrameAnalyticsConfig {
   allow_lazy_start?: boolean;
 }
 
-export enum ANALYSIS_CONFIG_TYPE {
-  OUTLIER_DETECTION = 'outlier_detection',
-  REGRESSION = 'regression',
-  CLASSIFICATION = 'classification',
-}
+export type DataFrameAnalysisConfigType = typeof ANALYSIS_CONFIG_TYPE[keyof typeof ANALYSIS_CONFIG_TYPE];
diff --git a/x-pack/plugins/ml/common/types/ml_url_generator.ts b/x-pack/plugins/ml/common/types/ml_url_generator.ts
index 234be8b6faf90..d176c22bdbb62 100644
--- a/x-pack/plugins/ml/common/types/ml_url_generator.ts
+++ b/x-pack/plugins/ml/common/types/ml_url_generator.ts
@@ -5,27 +5,21 @@
  */
 
 import { RefreshInterval, TimeRange } from '../../../../../src/plugins/data/common/query';
-import { JobId } from '../../../reporting/common/types';
+import { JobId } from './anomaly_detection_jobs/job';
 import { ML_PAGES } from '../constants/ml_url_generator';
+import { DataFrameAnalysisConfigType } from './data_frame_analytics';
 
 type OptionalPageState = object | undefined;
 
 export type MLPageState<PageType, PageState> = PageState extends OptionalPageState
-  ? { page: PageType; pageState?: PageState }
+  ? { page: PageType; pageState?: PageState; excludeBasePath?: boolean }
   : PageState extends object
-  ? { page: PageType; pageState: PageState }
-  : { page: PageType };
-
-export const ANALYSIS_CONFIG_TYPE = {
-  OUTLIER_DETECTION: 'outlier_detection',
-  REGRESSION: 'regression',
-  CLASSIFICATION: 'classification',
-} as const;
-
-type DataFrameAnalyticsType = typeof ANALYSIS_CONFIG_TYPE[keyof typeof ANALYSIS_CONFIG_TYPE];
+  ? { page: PageType; pageState: PageState; excludeBasePath?: boolean }
+  : { page: PageType; excludeBasePath?: boolean };
 
 export interface MlCommonGlobalState {
   time?: TimeRange;
+  refreshInterval?: RefreshInterval;
 }
 export interface MlCommonAppState {
   [key: string]: any;
@@ -42,16 +36,28 @@ export interface MlGenericUrlPageState extends MlIndexBasedSearchState {
   [key: string]: any;
 }
 
-export interface MlGenericUrlState {
-  page:
-    | typeof ML_PAGES.DATA_VISUALIZER_INDEX_VIEWER
-    | typeof ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE;
-  pageState: MlGenericUrlPageState;
-}
+export type MlGenericUrlState = MLPageState<
+  | typeof ML_PAGES.DATA_VISUALIZER_INDEX_VIEWER
+  | typeof ML_PAGES.ANOMALY_DETECTION_CREATE_JOB
+  | typeof ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE
+  | typeof ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX
+  | typeof ML_PAGES.OVERVIEW
+  | typeof ML_PAGES.CALENDARS_MANAGE
+  | typeof ML_PAGES.CALENDARS_NEW
+  | typeof ML_PAGES.FILTER_LISTS_MANAGE
+  | typeof ML_PAGES.FILTER_LISTS_NEW
+  | typeof ML_PAGES.SETTINGS
+  | typeof ML_PAGES.ACCESS_DENIED
+  | typeof ML_PAGES.DATA_VISUALIZER
+  | typeof ML_PAGES.DATA_VISUALIZER_FILE
+  | typeof ML_PAGES.DATA_VISUALIZER_INDEX_SELECT,
+  MlGenericUrlPageState | undefined
+>;
 
 export interface AnomalyDetectionQueryState {
   jobId?: JobId;
   groupIds?: string[];
+  globalState?: MlCommonGlobalState;
 }
 
 export type AnomalyDetectionUrlState = MLPageState<
@@ -86,7 +92,7 @@ export interface ExplorerUrlPageState {
   /**
    * Job IDs
    */
-  jobIds: JobId[];
+  jobIds?: JobId[];
   /**
    * Optionally set the time range in the time picker.
    */
@@ -104,6 +110,7 @@ export interface ExplorerUrlPageState {
    */
   mlExplorerSwimlane?: ExplorerAppState['mlExplorerSwimlane'];
   mlExplorerFilter?: ExplorerAppState['mlExplorerFilter'];
+  globalState?: MlCommonGlobalState;
 }
 
 export type ExplorerUrlState = MLPageState<typeof ML_PAGES.ANOMALY_EXPLORER, ExplorerUrlPageState>;
@@ -122,6 +129,7 @@ export interface TimeSeriesExplorerAppState {
     to?: string;
   };
   mlTimeSeriesExplorer?: {
+    forecastId?: string;
     detectorIndex?: number;
     entities?: Record<string, string>;
   };
@@ -131,10 +139,12 @@ export interface TimeSeriesExplorerAppState {
 export interface TimeSeriesExplorerPageState
   extends Pick<TimeSeriesExplorerAppState, 'zoom' | 'query'>,
     Pick<TimeSeriesExplorerGlobalState, 'refreshInterval'> {
-  jobIds: JobId[];
+  jobIds?: JobId[];
   timeRange?: TimeRange;
   detectorIndex?: number;
   entities?: Record<string, string>;
+  forecastId?: string;
+  globalState?: MlCommonGlobalState;
 }
 
 export type TimeSeriesExplorerUrlState = MLPageState<
@@ -145,6 +155,7 @@ export type TimeSeriesExplorerUrlState = MLPageState<
 export interface DataFrameAnalyticsQueryState {
   jobId?: JobId | JobId[];
   groupIds?: string[];
+  globalState?: MlCommonGlobalState;
 }
 
 export type DataFrameAnalyticsUrlState = MLPageState<
@@ -152,17 +163,10 @@ export type DataFrameAnalyticsUrlState = MLPageState<
   DataFrameAnalyticsQueryState | undefined
 >;
 
-export interface DataVisualizerUrlState {
-  page:
-    | typeof ML_PAGES.DATA_VISUALIZER
-    | typeof ML_PAGES.DATA_VISUALIZER_FILE
-    | typeof ML_PAGES.DATA_VISUALIZER_INDEX_SELECT;
-}
-
 export interface DataFrameAnalyticsExplorationQueryState {
   ml: {
     jobId: JobId;
-    analysisType: DataFrameAnalyticsType;
+    analysisType: DataFrameAnalysisConfigType;
   };
 }
 
@@ -170,7 +174,24 @@ export type DataFrameAnalyticsExplorationUrlState = MLPageState<
   typeof ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION,
   {
     jobId: JobId;
-    analysisType: DataFrameAnalyticsType;
+    analysisType: DataFrameAnalysisConfigType;
+    globalState?: MlCommonGlobalState;
+  }
+>;
+
+export type CalendarEditUrlState = MLPageState<
+  typeof ML_PAGES.CALENDARS_EDIT,
+  {
+    calendarId: string;
+    globalState?: MlCommonGlobalState;
+  }
+>;
+
+export type FilterEditUrlState = MLPageState<
+  typeof ML_PAGES.FILTER_LISTS_EDIT,
+  {
+    filterId: string;
+    globalState?: MlCommonGlobalState;
   }
 >;
 
@@ -183,5 +204,6 @@ export type MlUrlGeneratorState =
   | TimeSeriesExplorerUrlState
   | DataFrameAnalyticsUrlState
   | DataFrameAnalyticsExplorationUrlState
-  | DataVisualizerUrlState
+  | CalendarEditUrlState
+  | FilterEditUrlState
   | MlGenericUrlState;
diff --git a/x-pack/plugins/ml/common/util/analytics_utils.ts b/x-pack/plugins/ml/common/util/analytics_utils.ts
index d725984a47d66..d231ed4344389 100644
--- a/x-pack/plugins/ml/common/util/analytics_utils.ts
+++ b/x-pack/plugins/ml/common/util/analytics_utils.ts
@@ -9,8 +9,8 @@ import {
   ClassificationAnalysis,
   OutlierAnalysis,
   RegressionAnalysis,
-  ANALYSIS_CONFIG_TYPE,
 } from '../types/data_frame_analytics';
+import { ANALYSIS_CONFIG_TYPE } from '../../common/constants/data_frame_analytics';
 
 export const isOutlierAnalysis = (arg: any): arg is OutlierAnalysis => {
   const keys = Object.keys(arg);
diff --git a/x-pack/plugins/ml/kibana.json b/x-pack/plugins/ml/kibana.json
index fc673397ef177..2c5dbe108ab1e 100644
--- a/x-pack/plugins/ml/kibana.json
+++ b/x-pack/plugins/ml/kibana.json
@@ -16,7 +16,8 @@
     "embeddable",
     "uiActions",
     "kibanaLegacy",
-    "indexPatternManagement"
+    "indexPatternManagement",
+    "discover"
   ],
   "optionalPlugins": [
     "home",
diff --git a/x-pack/plugins/ml/public/application/app.tsx b/x-pack/plugins/ml/public/application/app.tsx
index c281dc4e9ae05..e3bcc53fe697f 100644
--- a/x-pack/plugins/ml/public/application/app.tsx
+++ b/x-pack/plugins/ml/public/application/app.tsx
@@ -20,6 +20,7 @@ import { MlSetupDependencies, MlStartDependencies } from '../plugin';
 import { MlRouter } from './routing';
 import { mlApiServicesProvider } from './services/ml_api_service';
 import { HttpService } from './services/http_service';
+import { ML_APP_URL_GENERATOR, ML_PAGES } from '../../common/constants/ml_url_generator';
 
 export type MlDependencies = Omit<MlSetupDependencies, 'share' | 'indexPatternManagement'> &
   MlStartDependencies;
@@ -50,11 +51,21 @@ export interface MlServicesContext {
 export type MlGlobalServices = ReturnType<typeof getMlGlobalServices>;
 
 const App: FC<AppProps> = ({ coreStart, deps, appMountParams }) => {
+  const redirectToMlAccessDeniedPage = async () => {
+    const accessDeniedPageUrl = await deps.share.urlGenerators
+      .getUrlGenerator(ML_APP_URL_GENERATOR)
+      .createUrl({
+        page: ML_PAGES.ACCESS_DENIED,
+      });
+    await coreStart.application.navigateToUrl(accessDeniedPageUrl);
+  };
+
   const pageDeps = {
     history: appMountParams.history,
     indexPatterns: deps.data.indexPatterns,
     config: coreStart.uiSettings!,
     setBreadcrumbs: coreStart.chrome!.setBreadcrumbs,
+    redirectToMlAccessDeniedPage,
   };
   const services = {
     appName: 'ML',
diff --git a/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts b/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts
index 653eca126006d..cdd25821ea5ca 100644
--- a/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts
+++ b/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts
@@ -33,10 +33,12 @@ export function checkGetManagementMlJobsResolver() {
   });
 }
 
-export function checkGetJobsCapabilitiesResolver(): Promise<MlCapabilities> {
+export function checkGetJobsCapabilitiesResolver(
+  redirectToMlAccessDeniedPage: () => Promise<void>
+): Promise<MlCapabilities> {
   return new Promise((resolve, reject) => {
     getCapabilities()
-      .then(({ capabilities, isPlatinumOrTrialLicense }) => {
+      .then(async ({ capabilities, isPlatinumOrTrialLicense }) => {
         _capabilities = capabilities;
         // the minimum privilege for using ML with a platinum or trial license is being able to get the transforms list.
         // all other functionality is controlled by the return capabilities object.
@@ -46,21 +48,23 @@ export function checkGetJobsCapabilitiesResolver(): Promise<MlCapabilities> {
         if (_capabilities.canGetJobs || isPlatinumOrTrialLicense === false) {
           return resolve(_capabilities);
         } else {
-          window.location.href = '#/access-denied';
+          await redirectToMlAccessDeniedPage();
           return reject();
         }
       })
-      .catch((e) => {
-        window.location.href = '#/access-denied';
+      .catch(async (e) => {
+        await redirectToMlAccessDeniedPage();
         return reject();
       });
   });
 }
 
-export function checkCreateJobsCapabilitiesResolver(): Promise<MlCapabilities> {
+export function checkCreateJobsCapabilitiesResolver(
+  redirectToJobsManagementPage: () => Promise<void>
+): Promise<MlCapabilities> {
   return new Promise((resolve, reject) => {
     getCapabilities()
-      .then(({ capabilities, isPlatinumOrTrialLicense }) => {
+      .then(async ({ capabilities, isPlatinumOrTrialLicense }) => {
         _capabilities = capabilities;
         // if the license is basic (isPlatinumOrTrialLicense === false) then do not redirect,
         // allow the promise to resolve as the separate license check will redirect then user to
@@ -69,34 +73,36 @@ export function checkCreateJobsCapabilitiesResolver(): Promise<MlCapabilities> {
           return resolve(_capabilities);
         } else {
           // if the user has no permission to create a job,
-          // redirect them back to the Transforms Management page
-          window.location.href = '#/jobs';
+          // redirect them back to the Anomaly Detection Management page
+          await redirectToJobsManagementPage();
           return reject();
         }
       })
-      .catch((e) => {
-        window.location.href = '#/jobs';
+      .catch(async (e) => {
+        await redirectToJobsManagementPage();
         return reject();
       });
   });
 }
 
-export function checkFindFileStructurePrivilegeResolver(): Promise<MlCapabilities> {
+export function checkFindFileStructurePrivilegeResolver(
+  redirectToMlAccessDeniedPage: () => Promise<void>
+): Promise<MlCapabilities> {
   return new Promise((resolve, reject) => {
     getCapabilities()
-      .then(({ capabilities }) => {
+      .then(async ({ capabilities }) => {
         _capabilities = capabilities;
         // the minimum privilege for using ML with a basic license is being able to use the datavisualizer.
         // all other functionality is controlled by the return _capabilities object
         if (_capabilities.canFindFileStructure) {
           return resolve(_capabilities);
         } else {
-          window.location.href = '#/access-denied';
+          await redirectToMlAccessDeniedPage();
           return reject();
         }
       })
-      .catch((e) => {
-        window.location.href = '#/access-denied';
+      .catch(async (e) => {
+        await redirectToMlAccessDeniedPage();
         return reject();
       });
   });
diff --git a/x-pack/plugins/ml/public/application/components/annotations/annotations_table/__snapshots__/annotations_table.test.js.snap b/x-pack/plugins/ml/public/application/components/annotations/annotations_table/__snapshots__/annotations_table.test.js.snap
index 9eb44c71aa799..114a6b235d1ad 100644
--- a/x-pack/plugins/ml/public/application/components/annotations/annotations_table/__snapshots__/annotations_table.test.js.snap
+++ b/x-pack/plugins/ml/public/application/components/annotations/annotations_table/__snapshots__/annotations_table.test.js.snap
@@ -1,170 +1,527 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`AnnotationsTable Initialization with annotations prop. 1`] = `
-<Fragment>
-  <EuiInMemoryTable
-    className="eui-textOverflowWrap"
-    columns={
-      Array [
-        Object {
-          "field": "annotation",
-          "name": "Annotation",
-          "scope": "row",
-          "sortable": true,
-          "width": "40%",
-        },
-        Object {
-          "dataType": "date",
-          "field": "timestamp",
-          "name": "From",
-          "render": [Function],
-          "sortable": true,
-        },
-        Object {
-          "dataType": "date",
-          "field": "end_timestamp",
-          "name": "To",
-          "render": [Function],
-          "sortable": true,
-        },
-        Object {
-          "dataType": "date",
-          "field": "modified_time",
-          "name": "Last modified date",
-          "render": [Function],
-          "sortable": true,
-        },
-        Object {
-          "field": "modified_username",
-          "name": "Last modified by",
-          "sortable": true,
-        },
-        Object {
-          "field": "event",
-          "name": "Event",
-          "sortable": true,
-          "width": "10%",
-        },
-        Object {
-          "field": "partition_field_value",
-          "name": "Partition",
-          "sortable": true,
-        },
-        Object {
-          "field": "over_field_value",
-          "name": "Over",
-          "sortable": true,
-        },
-        Object {
-          "field": "by_field_value",
-          "name": "By",
-          "sortable": true,
-        },
-        Object {
-          "actions": Array [
+<AnnotationsTableUI
+  annotations={
+    Array [
+      Object {
+        "_id": "KCCkDWgB_ZdQ1MFDSYPi",
+        "annotation": "Major spike.",
+        "create_time": 1546417097181,
+        "create_username": "<user unknown>",
+        "end_timestamp": 1455041968976,
+        "job_id": "farequote",
+        "modified_time": 1546417097181,
+        "modified_username": "<user unknown>",
+        "timestamp": 1455026177994,
+        "type": "annotation",
+      },
+    ]
+  }
+  intl={
+    Object {
+      "defaultFormats": Object {},
+      "defaultLocale": "en",
+      "formatDate": [Function],
+      "formatHTMLMessage": [Function],
+      "formatMessage": [Function],
+      "formatNumber": [Function],
+      "formatPlural": [Function],
+      "formatRelative": [Function],
+      "formatTime": [Function],
+      "formats": Object {
+        "date": Object {
+          "full": Object {
+            "day": "numeric",
+            "month": "long",
+            "weekday": "long",
+            "year": "numeric",
+          },
+          "long": Object {
+            "day": "numeric",
+            "month": "long",
+            "year": "numeric",
+          },
+          "medium": Object {
+            "day": "numeric",
+            "month": "short",
+            "year": "numeric",
+          },
+          "short": Object {
+            "day": "numeric",
+            "month": "numeric",
+            "year": "2-digit",
+          },
+        },
+        "number": Object {
+          "currency": Object {
+            "style": "currency",
+          },
+          "percent": Object {
+            "style": "percent",
+          },
+        },
+        "relative": Object {
+          "days": Object {
+            "units": "day",
+          },
+          "hours": Object {
+            "units": "hour",
+          },
+          "minutes": Object {
+            "units": "minute",
+          },
+          "months": Object {
+            "units": "month",
+          },
+          "seconds": Object {
+            "units": "second",
+          },
+          "years": Object {
+            "units": "year",
+          },
+        },
+        "time": Object {
+          "full": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "long": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "medium": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+          },
+          "short": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+          },
+        },
+      },
+      "formatters": Object {
+        "getDateTimeFormat": [Function],
+        "getMessageFormat": [Function],
+        "getNumberFormat": [Function],
+        "getPluralFormat": [Function],
+        "getRelativeFormat": [Function],
+      },
+      "locale": "en",
+      "messages": Object {},
+      "now": [Function],
+      "onError": [Function],
+      "textComponent": Symbol(react.fragment),
+      "timeZone": null,
+    }
+  }
+  kibana={
+    Object {
+      "notifications": Object {
+        "toasts": Object {
+          "danger": [Function],
+          "show": [Function],
+          "success": [Function],
+          "warning": [Function],
+        },
+      },
+      "overlays": Object {
+        "openFlyout": [Function],
+        "openModal": [Function],
+      },
+      "services": Object {},
+    }
+  }
+/>
+`;
+
+exports[`AnnotationsTable Initialization with job config prop. 1`] = `
+<AnnotationsTableUI
+  intl={
+    Object {
+      "defaultFormats": Object {},
+      "defaultLocale": "en",
+      "formatDate": [Function],
+      "formatHTMLMessage": [Function],
+      "formatMessage": [Function],
+      "formatNumber": [Function],
+      "formatPlural": [Function],
+      "formatRelative": [Function],
+      "formatTime": [Function],
+      "formats": Object {
+        "date": Object {
+          "full": Object {
+            "day": "numeric",
+            "month": "long",
+            "weekday": "long",
+            "year": "numeric",
+          },
+          "long": Object {
+            "day": "numeric",
+            "month": "long",
+            "year": "numeric",
+          },
+          "medium": Object {
+            "day": "numeric",
+            "month": "short",
+            "year": "numeric",
+          },
+          "short": Object {
+            "day": "numeric",
+            "month": "numeric",
+            "year": "2-digit",
+          },
+        },
+        "number": Object {
+          "currency": Object {
+            "style": "currency",
+          },
+          "percent": Object {
+            "style": "percent",
+          },
+        },
+        "relative": Object {
+          "days": Object {
+            "units": "day",
+          },
+          "hours": Object {
+            "units": "hour",
+          },
+          "minutes": Object {
+            "units": "minute",
+          },
+          "months": Object {
+            "units": "month",
+          },
+          "seconds": Object {
+            "units": "second",
+          },
+          "years": Object {
+            "units": "year",
+          },
+        },
+        "time": Object {
+          "full": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "long": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "medium": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+          },
+          "short": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+          },
+        },
+      },
+      "formatters": Object {
+        "getDateTimeFormat": [Function],
+        "getMessageFormat": [Function],
+        "getNumberFormat": [Function],
+        "getPluralFormat": [Function],
+        "getRelativeFormat": [Function],
+      },
+      "locale": "en",
+      "messages": Object {},
+      "now": [Function],
+      "onError": [Function],
+      "textComponent": Symbol(react.fragment),
+      "timeZone": null,
+    }
+  }
+  jobs={
+    Array [
+      Object {
+        "analysis_config": Object {
+          "bucket_span": "15m",
+          "detectors": Array [
             Object {
-              "render": [Function],
+              "detector_description": "count",
+              "detector_index": 0,
+              "function": "count",
             },
-            Object {
-              "render": [Function],
+          ],
+          "influencers": Array [],
+          "summary_count_field_name": "doc_count",
+        },
+        "analysis_limits": Object {
+          "categorization_examples_limit": 4,
+          "model_memory_limit": "10mb",
+        },
+        "create_time": 1546418356716,
+        "custom_settings": Object {
+          "created_by": "single-metric-wizard",
+        },
+        "data_counts": Object {
+          "bucket_count": 478,
+          "earliest_record_timestamp": 1454804096000,
+          "empty_bucket_count": 0,
+          "input_bytes": 21554,
+          "input_field_count": 479,
+          "input_record_count": 479,
+          "invalid_date_count": 0,
+          "job_id": "farequote",
+          "last_data_time": 1546418357578,
+          "latest_record_timestamp": 1455234298000,
+          "missing_field_count": 0,
+          "out_of_order_timestamp_count": 0,
+          "processed_field_count": 479,
+          "processed_record_count": 479,
+          "sparse_bucket_count": 0,
+        },
+        "data_description": Object {
+          "time_field": "@timestamp",
+          "time_format": "epoch_ms",
+        },
+        "datafeed_config": Object {
+          "aggregations": Object {
+            "buckets": Object {
+              "aggregations": Object {
+                "@timestamp": Object {
+                  "max": Object {
+                    "field": "@timestamp",
+                  },
+                },
+              },
+              "date_histogram": Object {
+                "field": "@timestamp",
+                "fixed_interval": "15m",
+                "keyed": false,
+                "min_doc_count": 0,
+                "offset": 0,
+                "order": Object {
+                  "_key": "asc",
+                },
+              },
             },
+          },
+          "chunking_config": Object {
+            "mode": "manual",
+            "time_span": "900000000ms",
+          },
+          "datafeed_id": "datafeed-farequote",
+          "delayed_data_check_config": Object {
+            "enabled": true,
+          },
+          "indices": Array [
+            "farequote",
           ],
-          "align": "right",
-          "name": "Actions",
-          "width": "60px",
-        },
-        Object {
-          "dataType": "boolean",
-          "field": "current_series",
-          "name": "current_series",
-          "render": [Function],
-          "width": "0px",
-        },
-      ]
-    }
-    compressed={true}
-    items={
-      Array [
-        Object {
-          "_id": "KCCkDWgB_ZdQ1MFDSYPi",
-          "annotation": "Major spike.",
-          "create_time": 1546417097181,
-          "create_username": "<user unknown>",
-          "end_timestamp": 1455041968976,
           "job_id": "farequote",
-          "modified_time": 1546417097181,
-          "modified_username": "<user unknown>",
-          "timestamp": 1455026177994,
-          "type": "annotation",
+          "query": Object {
+            "bool": Object {
+              "adjust_pure_negative": true,
+              "boost": 1,
+              "must": Array [
+                Object {
+                  "query_string": Object {
+                    "analyze_wildcard": true,
+                    "auto_generate_synonyms_phrase_query": true,
+                    "boost": 1,
+                    "default_operator": "or",
+                    "enable_position_increments": true,
+                    "escape": false,
+                    "fields": Array [],
+                    "fuzziness": "AUTO",
+                    "fuzzy_max_expansions": 50,
+                    "fuzzy_prefix_length": 0,
+                    "fuzzy_transpositions": true,
+                    "max_determinized_states": 10000,
+                    "phrase_slop": 0,
+                    "query": "*",
+                    "type": "best_fields",
+                  },
+                },
+              ],
+            },
+          },
+          "query_delay": "115823ms",
+          "scroll_size": 1000,
+          "state": "stopped",
         },
-      ]
-    }
-    pagination={
-      Object {
-        "pageSizeOptions": Array [
-          5,
-          10,
-          25,
-        ],
-      }
-    }
-    responsive={true}
-    rowProps={[Function]}
-    search={
-      Object {
-        "box": Object {
-          "incremental": true,
-          "schema": true,
-        },
-        "defaultQuery": "event:(user or delayed_data)",
-        "filters": Array [
-          Object {
-            "field": "event",
-            "multiSelect": "or",
-            "name": "Event",
-            "options": Array [],
-            "type": "field_value_selection",
-          },
-        ],
-      }
-    }
-    sorting={
-      Object {
-        "sort": Object {
-          "direction": "asc",
-          "field": "timestamp",
+        "description": "",
+        "established_model_memory": 42102,
+        "finished_time": 1546418359427,
+        "job_id": "farequote",
+        "job_type": "anomaly_detector",
+        "job_version": "7.0.0",
+        "model_plot_config": Object {
+          "enabled": true,
         },
-      }
+        "model_size_stats": Object {
+          "bucket_allocation_failures_count": 0,
+          "job_id": "farequote",
+          "log_time": 1546418359000,
+          "memory_status": "ok",
+          "model_bytes": 42102,
+          "result_type": "model_size_stats",
+          "timestamp": 1455232500000,
+          "total_by_field_count": 3,
+          "total_over_field_count": 0,
+          "total_partition_field_count": 2,
+        },
+        "model_snapshot_id": "1546418359",
+        "model_snapshot_min_version": "6.4.0",
+        "model_snapshot_retention_days": 1,
+        "results_index_name": "shared",
+        "state": "closed",
+      },
+    ]
+  }
+  kibana={
+    Object {
+      "notifications": Object {
+        "toasts": Object {
+          "danger": [Function],
+          "show": [Function],
+          "success": [Function],
+          "warning": [Function],
+        },
+      },
+      "overlays": Object {
+        "openFlyout": [Function],
+        "openModal": [Function],
+      },
+      "services": Object {},
     }
-    tableLayout="fixed"
-  />
-</Fragment>
-`;
-
-exports[`AnnotationsTable Initialization with job config prop. 1`] = `
-<EuiFlexGroup
-  justifyContent="spaceAround"
->
-  <EuiFlexItem
-    grow={false}
-  >
-    <EuiLoadingSpinner
-      size="l"
-    />
-  </EuiFlexItem>
-</EuiFlexGroup>
+  }
+/>
 `;
 
 exports[`AnnotationsTable Minimal initialization without props. 1`] = `
-<EuiCallOut
-  iconType="iInCircle"
-  role="alert"
-  title={
-    <FormattedMessage
-      defaultMessage="No annotations created for this job"
-      id="xpack.ml.annotationsTable.annotationsNotCreatedTitle"
-      values={Object {}}
-    />
+<AnnotationsTableUI
+  intl={
+    Object {
+      "defaultFormats": Object {},
+      "defaultLocale": "en",
+      "formatDate": [Function],
+      "formatHTMLMessage": [Function],
+      "formatMessage": [Function],
+      "formatNumber": [Function],
+      "formatPlural": [Function],
+      "formatRelative": [Function],
+      "formatTime": [Function],
+      "formats": Object {
+        "date": Object {
+          "full": Object {
+            "day": "numeric",
+            "month": "long",
+            "weekday": "long",
+            "year": "numeric",
+          },
+          "long": Object {
+            "day": "numeric",
+            "month": "long",
+            "year": "numeric",
+          },
+          "medium": Object {
+            "day": "numeric",
+            "month": "short",
+            "year": "numeric",
+          },
+          "short": Object {
+            "day": "numeric",
+            "month": "numeric",
+            "year": "2-digit",
+          },
+        },
+        "number": Object {
+          "currency": Object {
+            "style": "currency",
+          },
+          "percent": Object {
+            "style": "percent",
+          },
+        },
+        "relative": Object {
+          "days": Object {
+            "units": "day",
+          },
+          "hours": Object {
+            "units": "hour",
+          },
+          "minutes": Object {
+            "units": "minute",
+          },
+          "months": Object {
+            "units": "month",
+          },
+          "seconds": Object {
+            "units": "second",
+          },
+          "years": Object {
+            "units": "year",
+          },
+        },
+        "time": Object {
+          "full": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "long": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "medium": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+          },
+          "short": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+          },
+        },
+      },
+      "formatters": Object {
+        "getDateTimeFormat": [Function],
+        "getMessageFormat": [Function],
+        "getNumberFormat": [Function],
+        "getPluralFormat": [Function],
+        "getRelativeFormat": [Function],
+      },
+      "locale": "en",
+      "messages": Object {},
+      "now": [Function],
+      "onError": [Function],
+      "textComponent": Symbol(react.fragment),
+      "timeZone": null,
+    }
+  }
+  kibana={
+    Object {
+      "notifications": Object {
+        "toasts": Object {
+          "danger": [Function],
+          "show": [Function],
+          "success": [Function],
+          "warning": [Function],
+        },
+      },
+      "overlays": Object {
+        "openFlyout": [Function],
+        "openModal": [Function],
+      },
+      "services": Object {},
+    }
   }
 />
 `;
diff --git a/x-pack/plugins/ml/public/application/components/annotations/annotations_table/annotations_table.js b/x-pack/plugins/ml/public/application/components/annotations/annotations_table/annotations_table.js
index 9dabfce163dbb..d5025fd3c3649 100644
--- a/x-pack/plugins/ml/public/application/components/annotations/annotations_table/annotations_table.js
+++ b/x-pack/plugins/ml/public/application/components/annotations/annotations_table/annotations_table.js
@@ -13,7 +13,6 @@
 import uniq from 'lodash/uniq';
 
 import PropTypes from 'prop-types';
-import rison from 'rison-node';
 import React, { Component, Fragment } from 'react';
 import memoizeOne from 'memoize-one';
 import {
@@ -54,12 +53,15 @@ import {
   ANNOTATION_EVENT_USER,
   ANNOTATION_EVENT_DELAYED_DATA,
 } from '../../../../../common/constants/annotations';
+import { withKibana } from '../../../../../../../../src/plugins/kibana_react/public';
+import { ML_APP_URL_GENERATOR, ML_PAGES } from '../../../../../common/constants/ml_url_generator';
+import { PLUGIN_ID } from '../../../../../common/constants/app';
 
 const CURRENT_SERIES = 'current_series';
 /**
  * Table component for rendering the lists of annotations for an ML job.
  */
-export class AnnotationsTable extends Component {
+class AnnotationsTableUI extends Component {
   static propTypes = {
     annotations: PropTypes.array,
     jobs: PropTypes.array,
@@ -199,7 +201,17 @@ export class AnnotationsTable extends Component {
     }
   }
 
-  openSingleMetricView = (annotation = {}) => {
+  openSingleMetricView = async (annotation = {}) => {
+    const {
+      services: {
+        application: { navigateToApp },
+
+        share: {
+          urlGenerators: { getUrlGenerator },
+        },
+      },
+    } = this.props.kibana;
+
     // Creates the link to the Single Metric Viewer.
     // Set the total time range from the start to the end of the annotation.
     const job = this.getJob(annotation.job_id);
@@ -210,30 +222,10 @@ export class AnnotationsTable extends Component {
     );
     const from = new Date(dataCounts.earliest_record_timestamp).toISOString();
     const to = new Date(resultLatest).toISOString();
-
-    const globalSettings = {
-      ml: {
-        jobIds: [job.job_id],
-      },
-      refreshInterval: {
-        display: 'Off',
-        pause: false,
-        value: 0,
-      },
-      time: {
-        from,
-        to,
-        mode: 'absolute',
-      },
-    };
-
-    const appState = {
-      query: {
-        query_string: {
-          analyze_wildcard: true,
-          query: '*',
-        },
-      },
+    const timeRange = {
+      from,
+      to,
+      mode: 'absolute',
     };
     let mlTimeSeriesExplorer = {};
     const entityCondition = {};
@@ -247,11 +239,11 @@ export class AnnotationsTable extends Component {
       };
 
       if (annotation.timestamp < dataCounts.earliest_record_timestamp) {
-        globalSettings.time.from = new Date(annotation.timestamp).toISOString();
+        timeRange.from = new Date(annotation.timestamp).toISOString();
       }
 
       if (annotation.end_timestamp > dataCounts.latest_record_timestamp) {
-        globalSettings.time.to = new Date(annotation.end_timestamp).toISOString();
+        timeRange.to = new Date(annotation.end_timestamp).toISOString();
       }
     }
 
@@ -274,14 +266,34 @@ export class AnnotationsTable extends Component {
       entityCondition[annotation.by_field_name] = annotation.by_field_value;
     }
     mlTimeSeriesExplorer.entities = entityCondition;
-    appState.mlTimeSeriesExplorer = mlTimeSeriesExplorer;
-
-    const _g = rison.encode(globalSettings);
-    const _a = rison.encode(appState);
+    // appState.mlTimeSeriesExplorer = mlTimeSeriesExplorer;
+
+    const mlUrlGenerator = getUrlGenerator(ML_APP_URL_GENERATOR);
+    const singleMetricViewerLink = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.SINGLE_METRIC_VIEWER,
+      pageState: {
+        timeRange,
+        refreshInterval: {
+          display: 'Off',
+          pause: false,
+          value: 0,
+        },
+        jobIds: [job.job_id],
+        query: {
+          query_string: {
+            analyze_wildcard: true,
+            query: '*',
+          },
+        },
+        ...mlTimeSeriesExplorer,
+      },
+      excludeBasePath: true,
+    });
 
-    const url = `?_g=${_g}&_a=${_a}`;
-    addItemToRecentlyAccessed('timeseriesexplorer', job.job_id, url);
-    window.open(`#/timeseriesexplorer${url}`, '_self');
+    addItemToRecentlyAccessed('timeseriesexplorer', job.job_id, singleMetricViewerLink);
+    await navigateToApp(PLUGIN_ID, {
+      path: singleMetricViewerLink,
+    });
   };
 
   onMouseOverRow = (record) => {
@@ -686,3 +698,5 @@ export class AnnotationsTable extends Component {
     );
   }
 }
+
+export const AnnotationsTable = withKibana(AnnotationsTableUI);
diff --git a/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.js b/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.js
index fdeab0c49e32b..6025dd1c7433e 100644
--- a/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.js
+++ b/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.js
@@ -29,6 +29,8 @@ import { getUrlForRecord, openCustomUrlWindow } from '../../util/custom_url_util
 import { formatHumanReadableDateTimeSeconds } from '../../util/date_utils';
 import { getIndexPatternIdFromName } from '../../util/index_utils';
 import { replaceStringTokens } from '../../util/string_utils';
+import { ML_APP_URL_GENERATOR, ML_PAGES } from '../../../../common/constants/ml_url_generator';
+import { PLUGIN_ID } from '../../../../common/constants/app';
 /*
  * Component for rendering the links menu inside a cell in the anomalies table.
  */
@@ -142,7 +144,18 @@ class LinksMenuUI extends Component {
     }
   };
 
-  viewSeries = () => {
+  viewSeries = async () => {
+    const {
+      services: {
+        application: { navigateToApp },
+
+        share: {
+          urlGenerators: { getUrlGenerator },
+        },
+      },
+    } = this.props.kibana;
+    const mlUrlGenerator = getUrlGenerator(ML_APP_URL_GENERATOR);
+
     const record = this.props.anomaly.source;
     const bounds = this.props.bounds;
     const from = bounds.min.toISOString(); // e.g. 2016-02-08T16:00:00.000Z
@@ -171,44 +184,36 @@ class LinksMenuUI extends Component {
       entityCondition[record.by_field_name] = record.by_field_value;
     }
 
-    // Use rison to build the URL .
-    const _g = rison.encode({
-      ml: {
+    const singleMetricViewerLink = await mlUrlGenerator.createUrl({
+      excludeBasePath: true,
+      page: ML_PAGES.SINGLE_METRIC_VIEWER,
+      pageState: {
         jobIds: [record.job_id],
-      },
-      refreshInterval: {
-        display: 'Off',
-        pause: false,
-        value: 0,
-      },
-      time: {
-        from: from,
-        to: to,
-        mode: 'absolute',
-      },
-    });
-
-    const _a = rison.encode({
-      mlTimeSeriesExplorer: {
+        refreshInterval: {
+          display: 'Off',
+          pause: false,
+          value: 0,
+        },
+        timeRange: {
+          from: from,
+          to: to,
+          mode: 'absolute',
+        },
         zoom: {
           from: zoomFrom,
           to: zoomTo,
         },
         detectorIndex: record.detector_index,
         entities: entityCondition,
-      },
-      query: {
         query_string: {
           analyze_wildcard: true,
           query: '*',
         },
       },
     });
-
-    // Need to encode the _a parameter in case any entities contain unsafe characters such as '+'.
-    let path = '#/timeseriesexplorer';
-    path += `?_g=${_g}&_a=${encodeURIComponent(_a)}`;
-    window.open(path, '_blank');
+    await navigateToApp(PLUGIN_ID, {
+      path: singleMetricViewerLink,
+    });
   };
 
   viewExamples = () => {
diff --git a/x-pack/plugins/ml/public/application/components/anomaly_results_view_selector/anomaly_results_view_selector.test.tsx b/x-pack/plugins/ml/public/application/components/anomaly_results_view_selector/anomaly_results_view_selector.test.tsx
index 4a63a8cd7e716..d54a7fe81e858 100644
--- a/x-pack/plugins/ml/public/application/components/anomaly_results_view_selector/anomaly_results_view_selector.test.tsx
+++ b/x-pack/plugins/ml/public/application/components/anomaly_results_view_selector/anomaly_results_view_selector.test.tsx
@@ -6,13 +6,22 @@
 
 import React from 'react';
 import { Router } from 'react-router-dom';
-import { render, fireEvent } from '@testing-library/react';
+import { render } from '@testing-library/react';
 import { createBrowserHistory } from 'history';
 
 import { I18nProvider } from '@kbn/i18n/react';
 
 import { AnomalyResultsViewSelector } from './index';
 
+jest.mock('../../contexts/kibana', () => {
+  return {
+    useMlUrlGenerator: () => ({
+      createUrl: jest.fn(),
+    }),
+    useNavigateToPath: () => jest.fn(),
+  };
+});
+
 describe('AnomalyResultsViewSelector', () => {
   test('should create selector with correctly selected value', () => {
     const history = createBrowserHistory();
@@ -31,27 +40,4 @@ describe('AnomalyResultsViewSelector', () => {
       getByTestId('mlAnomalyResultsViewSelectorSingleMetricViewer').hasAttribute('checked')
     ).toBe(true);
   });
-
-  test('should open window to other results view when clicking on non-checked input', () => {
-    // Create mock for window.open
-    const mockedOpen = jest.fn();
-    const originalOpen = window.open;
-    window.open = mockedOpen;
-
-    const history = createBrowserHistory();
-
-    const { getByTestId } = render(
-      <I18nProvider>
-        <Router history={history}>
-          <AnomalyResultsViewSelector viewId="timeseriesexplorer" />
-        </Router>
-      </I18nProvider>
-    );
-
-    fireEvent.click(getByTestId('mlAnomalyResultsViewSelectorExplorer'));
-    expect(mockedOpen).toHaveBeenCalledWith('#/explorer', '_self');
-
-    // Clean-up window.open.
-    window.open = originalOpen;
-  });
 });
diff --git a/x-pack/plugins/ml/public/application/components/anomaly_results_view_selector/anomaly_results_view_selector.tsx b/x-pack/plugins/ml/public/application/components/anomaly_results_view_selector/anomaly_results_view_selector.tsx
index 78acb422851e3..c4c8f06bbbc3a 100644
--- a/x-pack/plugins/ml/public/application/components/anomaly_results_view_selector/anomaly_results_view_selector.tsx
+++ b/x-pack/plugins/ml/public/application/components/anomaly_results_view_selector/anomaly_results_view_selector.tsx
@@ -5,21 +5,25 @@
  */
 
 import React, { FC, useMemo } from 'react';
-import { encode } from 'rison-node';
 
 import { EuiButtonGroup } from '@elastic/eui';
 
 import { i18n } from '@kbn/i18n';
 
 import { useUrlState } from '../../util/url_state';
+import { useMlUrlGenerator, useNavigateToPath } from '../../contexts/kibana';
+import { ML_PAGES } from '../../../../common/constants/ml_url_generator';
 
 interface Props {
-  viewId: 'timeseriesexplorer' | 'explorer';
+  viewId: typeof ML_PAGES.SINGLE_METRIC_VIEWER | typeof ML_PAGES.ANOMALY_EXPLORER;
 }
 
 // Component for rendering a set of buttons for switching between the Anomaly Detection results views.
 
 export const AnomalyResultsViewSelector: FC<Props> = ({ viewId }) => {
+  const urlGenerator = useMlUrlGenerator();
+  const navigateToPath = useNavigateToPath();
+
   const toggleButtonsIcons = useMemo(
     () => [
       {
@@ -28,7 +32,7 @@ export const AnomalyResultsViewSelector: FC<Props> = ({ viewId }) => {
           defaultMessage: 'View results in the Single Metric Viewer',
         }),
         iconType: 'visLine',
-        value: 'timeseriesexplorer',
+        value: ML_PAGES.SINGLE_METRIC_VIEWER,
         'data-test-subj': 'mlAnomalyResultsViewSelectorSingleMetricViewer',
       },
       {
@@ -37,7 +41,7 @@ export const AnomalyResultsViewSelector: FC<Props> = ({ viewId }) => {
           defaultMessage: 'View results in the Anomaly Explorer',
         }),
         iconType: 'visTable',
-        value: 'explorer',
+        value: ML_PAGES.ANOMALY_EXPLORER,
         'data-test-subj': 'mlAnomalyResultsViewSelectorExplorer',
       },
     ],
@@ -46,9 +50,14 @@ export const AnomalyResultsViewSelector: FC<Props> = ({ viewId }) => {
 
   const [globalState] = useUrlState('_g');
 
-  const onChangeView = (newViewId: string) => {
-    const fullGlobalStateString = globalState !== undefined ? `?_g=${encode(globalState)}` : '';
-    window.open(`#/${newViewId}${fullGlobalStateString}`, '_self');
+  const onChangeView = async (newViewId: Props['viewId']) => {
+    const url = await urlGenerator.createUrl({
+      page: newViewId,
+      pageState: {
+        globalState,
+      },
+    });
+    await navigateToPath(url);
   };
 
   return (
@@ -60,7 +69,7 @@ export const AnomalyResultsViewSelector: FC<Props> = ({ viewId }) => {
       data-test-subj="mlAnomalyResultsViewSelector"
       options={toggleButtonsIcons}
       idSelected={viewId}
-      onChange={onChangeView}
+      onChange={(newViewId: string) => onChangeView(newViewId as Props['viewId'])}
       isIconOnly
     />
   );
diff --git a/x-pack/plugins/ml/public/application/components/custom_hooks/use_create_ad_links.ts b/x-pack/plugins/ml/public/application/components/custom_hooks/use_create_ad_links.ts
index 368e758a027c4..b4668810b9421 100644
--- a/x-pack/plugins/ml/public/application/components/custom_hooks/use_create_ad_links.ts
+++ b/x-pack/plugins/ml/public/application/components/custom_hooks/use_create_ad_links.ts
@@ -22,16 +22,19 @@ export const useCreateADLinks = () => {
   const userTimeSettings = useUiSettings().get(ANOMALY_DETECTION_DEFAULT_TIME_RANGE);
   const createLinkWithUserDefaults = useCallback(
     (location, jobList) => {
-      const resultsPageUrl = mlJobService.createResultsUrlForJobs(
+      return mlJobService.createResultsUrlForJobs(
         jobList,
         location,
         useUserTimeSettings === true && userTimeSettings !== undefined
           ? userTimeSettings
           : undefined
       );
-      return `${basePath.get()}/app/ml${resultsPageUrl}`;
     },
     [basePath]
   );
   return { createLinkWithUserDefaults };
 };
+
+export type CreateLinkWithUserDefaults = ReturnType<
+  typeof useCreateADLinks
+>['createLinkWithUserDefaults'];
diff --git a/x-pack/plugins/ml/public/application/components/data_grid/data_grid.tsx b/x-pack/plugins/ml/public/application/components/data_grid/data_grid.tsx
index 22815fe593d57..6aad5d53c3a3c 100644
--- a/x-pack/plugins/ml/public/application/components/data_grid/data_grid.tsx
+++ b/x-pack/plugins/ml/public/application/components/data_grid/data_grid.tsx
@@ -32,6 +32,7 @@ import { UseIndexDataReturnType } from './types';
 import { DecisionPathPopover } from './feature_importance/decision_path_popover';
 import { TopClasses } from '../../../../common/types/feature_importance';
 import { DEFAULT_RESULTS_FIELD } from '../../../../common/constants/data_frame_analytics';
+import { DataFrameAnalysisConfigType } from '../../../../common/types/data_frame_analytics';
 
 // TODO Fix row hovering + bar highlighting
 // import { hoveredRow$ } from './column_chart';
@@ -44,7 +45,7 @@ export const DataGridTitle: FC<{ title: string }> = ({ title }) => (
 
 interface PropsWithoutHeader extends UseIndexDataReturnType {
   baseline?: number;
-  analysisType?: ANALYSIS_CONFIG_TYPE;
+  analysisType?: DataFrameAnalysisConfigType;
   resultsField?: string;
   dataTestSubj: string;
   toastNotifications: CoreSetup['notifications']['toasts'];
diff --git a/x-pack/plugins/ml/public/application/components/data_grid/feature_importance/decision_path_popover.tsx b/x-pack/plugins/ml/public/application/components/data_grid/feature_importance/decision_path_popover.tsx
index 263337f93e9a8..7c4428db71b3b 100644
--- a/x-pack/plugins/ml/public/application/components/data_grid/feature_importance/decision_path_popover.tsx
+++ b/x-pack/plugins/ml/public/application/components/data_grid/feature_importance/decision_path_popover.tsx
@@ -13,10 +13,11 @@ import { FeatureImportance, TopClasses } from '../../../../../common/types/featu
 import { ANALYSIS_CONFIG_TYPE } from '../../../data_frame_analytics/common';
 import { ClassificationDecisionPath } from './decision_path_classification';
 import { useMlKibana } from '../../../contexts/kibana';
+import { DataFrameAnalysisConfigType } from '../../../../../common/types/data_frame_analytics';
 
 interface DecisionPathPopoverProps {
   featureImportance: FeatureImportance[];
-  analysisType: ANALYSIS_CONFIG_TYPE;
+  analysisType: DataFrameAnalysisConfigType;
   predictionFieldName?: string;
   baseline?: number;
   predictedValue?: number | string | undefined;
diff --git a/x-pack/plugins/ml/public/application/components/data_recognizer/recognized_result.js b/x-pack/plugins/ml/public/application/components/data_recognizer/recognized_result.js
index 1f03dbe134756..279afc8c50339 100644
--- a/x-pack/plugins/ml/public/application/components/data_recognizer/recognized_result.js
+++ b/x-pack/plugins/ml/public/application/components/data_recognizer/recognized_result.js
@@ -9,11 +9,16 @@ import PropTypes from 'prop-types';
 
 import { EuiIcon, EuiFlexItem } from '@elastic/eui';
 import { CreateJobLinkCard } from '../create_job_link_card';
+import { useMlKibana } from '../../contexts/kibana';
 
 export const RecognizedResult = ({ config, indexPattern, savedSearch }) => {
+  const {
+    services: {
+      http: { basePath },
+    },
+  } = useMlKibana();
   const id = savedSearch === null ? `index=${indexPattern.id}` : `savedSearchId=${savedSearch.id}`;
-
-  const href = `#/jobs/new_job/recognize?id=${config.id}&${id}`;
+  const href = `${basePath.get()}/app/ml/jobs/new_job/recognize?id=${config.id}&${id}`;
 
   let logo = null;
   // if a logo is available, use that, otherwise display the id
diff --git a/x-pack/plugins/ml/public/application/components/navigation_menu/main_tabs.tsx b/x-pack/plugins/ml/public/application/components/navigation_menu/main_tabs.tsx
index 3a4875fa243fd..671f0b196ce35 100644
--- a/x-pack/plugins/ml/public/application/components/navigation_menu/main_tabs.tsx
+++ b/x-pack/plugins/ml/public/application/components/navigation_menu/main_tabs.tsx
@@ -4,15 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { FC, useState } from 'react';
-import { encode } from 'rison-node';
+import React, { FC, useState, useEffect } from 'react';
 
-import { EuiTabs, EuiTab, EuiLink } from '@elastic/eui';
+import { EuiTabs, EuiTab } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-
-import { useUrlState } from '../../util/url_state';
-
 import { TabId } from './navigation_menu';
+import { useMlKibana, useMlUrlGenerator, useNavigateToPath } from '../../contexts/kibana';
+import { MlUrlGeneratorState } from '../../../../common/types/ml_url_generator';
+import { useUrlState } from '../../util/url_state';
+import { ML_APP_NAME } from '../../../../common/constants/app';
 
 export interface Tab {
   id: TabId;
@@ -66,20 +66,57 @@ function getTabs(disableLinks: boolean): Tab[] {
 }
 interface TabData {
   testSubject: string;
-  pathId?: string;
+  pathId?: MlUrlGeneratorState['page'];
+  name: string;
 }
 
 const TAB_DATA: Record<TabId, TabData> = {
-  overview: { testSubject: 'mlMainTab overview' },
+  overview: {
+    testSubject: 'mlMainTab overview',
+    name: i18n.translate('xpack.ml.overviewTabLabel', {
+      defaultMessage: 'Overview',
+    }),
+  },
   // Note that anomaly detection jobs list is mapped to ml#/jobs.
-  anomaly_detection: { testSubject: 'mlMainTab anomalyDetection', pathId: 'jobs' },
-  data_frame_analytics: { testSubject: 'mlMainTab dataFrameAnalytics' },
-  datavisualizer: { testSubject: 'mlMainTab dataVisualizer' },
-  settings: { testSubject: 'mlMainTab settings' },
-  'access-denied': { testSubject: 'mlMainTab overview' },
+  anomaly_detection: {
+    testSubject: 'mlMainTab anomalyDetection',
+    name: i18n.translate('xpack.ml.anomalyDetectionTabLabel', {
+      defaultMessage: 'Anomaly Detection',
+    }),
+    pathId: 'jobs',
+  },
+  data_frame_analytics: {
+    testSubject: 'mlMainTab dataFrameAnalytics',
+    name: i18n.translate('xpack.ml.dataFrameAnalyticsTabLabel', {
+      defaultMessage: 'Data Frame Analytics',
+    }),
+  },
+  datavisualizer: {
+    testSubject: 'mlMainTab dataVisualizer',
+    name: i18n.translate('xpack.ml.dataVisualizerTabLabel', {
+      defaultMessage: 'Data Visualizer',
+    }),
+  },
+  settings: {
+    testSubject: 'mlMainTab settings',
+    name: i18n.translate('xpack.ml.settingsTabLabel', {
+      defaultMessage: 'Settings',
+    }),
+  },
+  'access-denied': {
+    testSubject: 'mlMainTab overview',
+    name: i18n.translate('xpack.ml.accessDeniedTabLabel', {
+      defaultMessage: 'Access Denied',
+    }),
+  },
 };
 
 export const MainTabs: FC<Props> = ({ tabId, disableLinks }) => {
+  const {
+    services: {
+      chrome: { docTitle },
+    },
+  } = useMlKibana();
   const [globalState] = useUrlState('_g');
   const [selectedTabId, setSelectedTabId] = useState(tabId);
   function onSelectedTabChanged(id: TabId) {
@@ -87,16 +124,40 @@ export const MainTabs: FC<Props> = ({ tabId, disableLinks }) => {
   }
 
   const tabs = getTabs(disableLinks);
+  const mlUrlGenerator = useMlUrlGenerator();
+  const navigateToPath = useNavigateToPath();
+
+  const redirectToTab = async (defaultPathId: MlUrlGeneratorState['page']) => {
+    const pageState =
+      globalState?.refreshInterval !== undefined
+        ? {
+            globalState: {
+              refreshInterval: globalState.refreshInterval,
+            },
+          }
+        : undefined;
+    // TODO - Fix ts so passing pageState won't default to MlGenericUrlState when pageState is passed in
+    // @ts-ignore
+    const path = await mlUrlGenerator.createUrl({
+      page: defaultPathId,
+      // only retain the refreshInterval part of globalState
+      // appState will not be considered.
+      pageState,
+    });
+
+    await navigateToPath(path, false);
+  };
+
+  useEffect(() => {
+    docTitle.change([TAB_DATA[selectedTabId].name, ML_APP_NAME]);
+  }, [selectedTabId]);
 
   return (
     <EuiTabs display="condensed">
       {tabs.map((tab: Tab) => {
         const { id, disabled } = tab;
         const testSubject = TAB_DATA[id].testSubject;
-        const defaultPathId = TAB_DATA[id].pathId || id;
-        // globalState (e.g. selected jobs and time range) should be retained when changing pages.
-        // appState will not be considered.
-        const fullGlobalStateString = globalState !== undefined ? `?_g=${encode(globalState)}` : '';
+        const defaultPathId = (TAB_DATA[id].pathId || id) as MlUrlGeneratorState['page'];
 
         return disabled ? (
           <EuiTab key={`${id}-key`} className={'mlNavigationMenu__mainTab'} disabled={true}>
@@ -104,21 +165,18 @@ export const MainTabs: FC<Props> = ({ tabId, disableLinks }) => {
           </EuiTab>
         ) : (
           <div className="euiTab" key={`div-${id}-key`}>
-            <EuiLink
+            <EuiTab
               data-test-subj={testSubject + (id === selectedTabId ? ' selected' : '')}
-              href={`#/${defaultPathId}${fullGlobalStateString}`}
-              key={`${id}-key`}
-              color="text"
+              className={'mlNavigationMenu__mainTab'}
+              onClick={() => {
+                onSelectedTabChanged(id);
+                redirectToTab(defaultPathId);
+              }}
+              isSelected={id === selectedTabId}
+              key={`tab-${id}-key`}
             >
-              <EuiTab
-                className={'mlNavigationMenu__mainTab'}
-                onClick={() => onSelectedTabChanged(id)}
-                isSelected={id === selectedTabId}
-                key={`tab-${id}-key`}
-              >
-                {tab.name}
-              </EuiTab>
-            </EuiLink>
+              {tab.name}
+            </EuiTab>
           </div>
         );
       })}
diff --git a/x-pack/plugins/ml/public/application/components/rule_editor/scope_section.js b/x-pack/plugins/ml/public/application/components/rule_editor/scope_section.js
index 48e0da72f067c..eb12cb7679674 100644
--- a/x-pack/plugins/ml/public/application/components/rule_editor/scope_section.js
+++ b/x-pack/plugins/ml/public/application/components/rule_editor/scope_section.js
@@ -17,8 +17,19 @@ import { ScopeExpression } from './scope_expression';
 import { checkPermission } from '../../capabilities/check_capabilities';
 import { getScopeFieldDefaults } from './utils';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { ML_PAGES } from '../../../../common/constants/ml_url_generator';
+import { useMlUrlGenerator, useNavigateToPath } from '../../contexts/kibana';
 
 function NoFilterListsCallOut() {
+  const mlUrlGenerator = useMlUrlGenerator();
+  const navigateToPath = useNavigateToPath();
+  const redirectToFilterManagementPage = async () => {
+    const path = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.FILTER_LISTS_MANAGE,
+    });
+    await navigateToPath(path, true);
+  };
+
   return (
     <EuiCallOut
       title={
@@ -36,7 +47,7 @@ function NoFilterListsCallOut() {
             to create the list of values you want to include or exclude in the rule."
           values={{
             filterListsLink: (
-              <EuiLink href="#/settings/filter_lists">
+              <EuiLink onClick={redirectToFilterManagementPage}>
                 <FormattedMessage
                   id="xpack.ml.ruleEditor.scopeSection.createFilterListsDescription.filterListsLinkText"
                   defaultMessage="Filter Lists"
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/index.ts b/x-pack/plugins/ml/public/application/contexts/kibana/index.ts
index 44979a1b9c60a..f08ca3c153961 100644
--- a/x-pack/plugins/ml/public/application/contexts/kibana/index.ts
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/index.ts
@@ -9,4 +9,4 @@ export { useNavigateToPath, NavigateToPath } from './use_navigate_to_path';
 export { useUiSettings } from './use_ui_settings_context';
 export { useTimefilter } from './use_timefilter';
 export { useNotifications } from './use_notifications_context';
-export { useMlUrlGenerator } from './use_create_url';
+export { useMlUrlGenerator, useMlLink } from './use_create_url';
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/kibana_context.ts b/x-pack/plugins/ml/public/application/contexts/kibana/kibana_context.ts
index e3da9b509e620..f631361d06584 100644
--- a/x-pack/plugins/ml/public/application/contexts/kibana/kibana_context.ts
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/kibana_context.ts
@@ -22,6 +22,6 @@ interface StartPlugins {
   share: SharePluginStart;
 }
 export type StartServices = CoreStart &
-  StartPlugins & { kibanaVersion: string } & MlServicesContext;
+  StartPlugins & { appName: string; kibanaVersion: string } & MlServicesContext;
 export const useMlKibana = () => useKibana<StartServices>();
 export type MlKibanaReactContextValue = KibanaReactContextValue<StartServices>;
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts b/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts
index 48385ad3ae6a8..d448185c914b8 100644
--- a/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts
@@ -4,8 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { useCallback, useEffect, useState } from 'react';
 import { useMlKibana } from './kibana_context';
 import { ML_APP_URL_GENERATOR } from '../../../../common/constants/ml_url_generator';
+import { MlUrlGeneratorState } from '../../../../common/types/ml_url_generator';
+import { useUrlState } from '../../util/url_state';
 
 export const useMlUrlGenerator = () => {
   const {
@@ -18,3 +21,59 @@ export const useMlUrlGenerator = () => {
 
   return getUrlGenerator(ML_APP_URL_GENERATOR);
 };
+
+export const useMlLink = (params: MlUrlGeneratorState): string => {
+  const [href, setHref] = useState<string>(params.page);
+  const mlUrlGenerator = useMlUrlGenerator();
+
+  useEffect(() => {
+    let isCancelled = false;
+    const generateUrl = async (_params: MlUrlGeneratorState) => {
+      const url = await mlUrlGenerator.createUrl(_params);
+      if (!isCancelled) {
+        setHref(url);
+      }
+    };
+    generateUrl(params);
+    return () => {
+      isCancelled = true;
+    };
+  }, [params]);
+
+  return href;
+};
+
+export const useCreateAndNavigateToMlLink = (
+  page: MlUrlGeneratorState['page']
+): (() => Promise<void>) => {
+  const mlUrlGenerator = useMlUrlGenerator();
+  const [globalState] = useUrlState('_g');
+
+  const {
+    services: {
+      application: { navigateToUrl },
+    },
+  } = useMlKibana();
+
+  const redirectToMlPage = useCallback(
+    async (_page: MlUrlGeneratorState['page']) => {
+      const pageState =
+        globalState?.refreshInterval !== undefined
+          ? {
+              globalState: {
+                refreshInterval: globalState.refreshInterval,
+              },
+            }
+          : undefined;
+
+      // TODO: fix ts only interpreting it as MlUrlGenericState if pageState is passed
+      // @ts-ignore
+      const url = await mlUrlGenerator.createUrl({ page: _page, pageState });
+      await navigateToUrl(url);
+    },
+    [mlUrlGenerator, navigateToUrl]
+  );
+
+  // returns the onClick callback
+  return useCallback(() => redirectToMlPage(page), [redirectToMlPage, page]);
+};
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/common/analytics.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/common/analytics.ts
index 60681fb6e7bbe..d22bba7738db4 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/common/analytics.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/common/analytics.ts
@@ -15,8 +15,8 @@ import { SavedSearchQuery } from '../../contexts/ml';
 import {
   AnalysisConfig,
   ClassificationAnalysis,
+  DataFrameAnalysisConfigType,
   RegressionAnalysis,
-  ANALYSIS_CONFIG_TYPE,
 } from '../../../../common/types/data_frame_analytics';
 import {
   isOutlierAnalysis,
@@ -26,6 +26,7 @@ import {
   getDependentVar,
   getPredictedFieldName,
 } from '../../../../common/util/analytics_utils';
+import { ANALYSIS_CONFIG_TYPE } from '../../../../common/constants/data_frame_analytics';
 export type IndexPattern = string;
 
 export enum ANALYSIS_ADVANCED_FIELDS {
@@ -429,7 +430,7 @@ interface LoadEvalDataConfig {
   predictionFieldName?: string;
   searchQuery?: ResultsSearchQuery;
   ignoreDefaultQuery?: boolean;
-  jobType: ANALYSIS_CONFIG_TYPE;
+  jobType: DataFrameAnalysisConfigType;
   requiresKeyword?: boolean;
 }
 
@@ -550,7 +551,7 @@ export {
   isRegressionAnalysis,
   isClassificationAnalysis,
   getPredictionFieldName,
-  ANALYSIS_CONFIG_TYPE,
   getDependentVar,
   getPredictedFieldName,
+  ANALYSIS_CONFIG_TYPE,
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/common/index.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/common/index.ts
index 00d735d9a866e..83eebccd310e3 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/common/index.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/common/index.ts
@@ -14,7 +14,6 @@ export {
   UpdateDataFrameAnalyticsConfig,
   IndexPattern,
   REFRESH_ANALYTICS_LIST_STATE,
-  ANALYSIS_CONFIG_TYPE,
   OUTLIER_ANALYSIS_METHOD,
   RegressionEvaluateResponse,
   getValuesFromResponse,
@@ -26,6 +25,7 @@ export {
   SEARCH_SIZE,
   defaultSearchQuery,
   SearchQuery,
+  ANALYSIS_CONFIG_TYPE,
 } from './analytics';
 
 export {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx
index 1e5dbee3499bd..1e6a616fedd64 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx
@@ -8,7 +8,7 @@ import React, { Fragment, FC } from 'react';
 import { i18n } from '@kbn/i18n';
 
 import { EuiFormRow, EuiSelect } from '@elastic/eui';
-import { ANALYSIS_CONFIG_TYPE } from '../../../../common';
+import { ANALYSIS_CONFIG_TYPE } from '../../../../../../../common/constants/data_frame_analytics';
 
 import { AnalyticsJobType } from '../../../analytics_management/hooks/use_create_analytics_form/state';
 
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/supported_fields_message.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/supported_fields_message.tsx
index 88c89df86b29a..310cd4e3b3a79 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/supported_fields_message.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/supported_fields_message.tsx
@@ -16,6 +16,7 @@ import { BASIC_NUMERICAL_TYPES, EXTENDED_NUMERICAL_TYPES } from '../../../../com
 import { CATEGORICAL_TYPES } from './form_options_validation';
 import { ES_FIELD_TYPES } from '../../../../../../../../../../src/plugins/data/public';
 import { newJobCapsService } from '../../../../../services/new_job_capabilities_service';
+import { DataFrameAnalysisConfigType } from '../../../../../../../common/types/data_frame_analytics';
 
 const containsClassificationFieldsCb = ({ name, type }: Field) =>
   !OMIT_FIELDS.includes(name) &&
@@ -32,13 +33,13 @@ const containsRegressionFieldsCb = ({ name, type }: Field) =>
 const containsOutlierFieldsCb = ({ name, type }: Field) =>
   !OMIT_FIELDS.includes(name) && name !== EVENT_RATE_FIELD_ID && BASIC_NUMERICAL_TYPES.has(type);
 
-const callbacks: Record<ANALYSIS_CONFIG_TYPE, (f: Field) => boolean> = {
+const callbacks: Record<DataFrameAnalysisConfigType, (f: Field) => boolean> = {
   [ANALYSIS_CONFIG_TYPE.CLASSIFICATION]: containsClassificationFieldsCb,
   [ANALYSIS_CONFIG_TYPE.REGRESSION]: containsRegressionFieldsCb,
   [ANALYSIS_CONFIG_TYPE.OUTLIER_DETECTION]: containsOutlierFieldsCb,
 };
 
-const messages: Record<ANALYSIS_CONFIG_TYPE, JSX.Element> = {
+const messages: Record<DataFrameAnalysisConfigType, JSX.Element> = {
   [ANALYSIS_CONFIG_TYPE.CLASSIFICATION]: (
     <FormattedMessage
       id="xpack.ml.dataframe.analytics.create.sourceObjectClassificationHelpText"
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/create_step_footer/create_step_footer.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/create_step_footer/create_step_footer.tsx
index 93d88ebc0b5ac..9fe5963593229 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/create_step_footer/create_step_footer.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/create_step_footer/create_step_footer.tsx
@@ -18,13 +18,13 @@ import { ml } from '../../../../../services/ml_api_service';
 import { BackToListPanel } from '../back_to_list_panel';
 import { ViewResultsPanel } from '../view_results_panel';
 import { ProgressStats } from './progress_stats';
-import { ANALYSIS_CONFIG_TYPE } from '../../../../common/analytics';
+import { DataFrameAnalysisConfigType } from '../../../../../../../common/types/data_frame_analytics';
 
 export const PROGRESS_REFRESH_INTERVAL_MS = 1000;
 
 interface Props {
   jobId: string;
-  jobType: ANALYSIS_CONFIG_TYPE;
+  jobType: DataFrameAnalysisConfigType;
   showProgress: boolean;
 }
 
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/view_results_panel/view_results_panel.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/view_results_panel/view_results_panel.tsx
index b832bfb2549c6..f3631a24559ab 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/view_results_panel/view_results_panel.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/view_results_panel/view_results_panel.tsx
@@ -8,12 +8,12 @@ import React, { FC, Fragment } from 'react';
 import { EuiCard, EuiIcon } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { useMlUrlGenerator } from '../../../../../contexts/kibana';
-import { ANALYSIS_CONFIG_TYPE } from '../../../../common/analytics';
 import { ML_PAGES } from '../../../../../../../common/constants/ml_url_generator';
 import { useNavigateToPath } from '../../../../../contexts/kibana';
+import { DataFrameAnalysisConfigType } from '../../../../../../../common/types/data_frame_analytics';
 interface Props {
   jobId: string;
-  analysisType: ANALYSIS_CONFIG_TYPE;
+  analysisType: DataFrameAnalysisConfigType;
 }
 
 export const ViewResultsPanel: FC<Props> = ({ jobId, analysisType }) => {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx
index eea579ef1d064..84b1c4241aaf2 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/exploration_results_table.tsx
@@ -29,7 +29,6 @@ import {
   SEARCH_SIZE,
   defaultSearchQuery,
   getAnalysisType,
-  ANALYSIS_CONFIG_TYPE,
 } from '../../../../common';
 import { getTaskStateBadge } from '../../../analytics_management/components/analytics_list/use_columns';
 import { DATA_FRAME_TASK_STATE } from '../../../analytics_management/components/analytics_list/common';
@@ -39,6 +38,7 @@ import { IndexPatternPrompt } from '../index_pattern_prompt';
 
 import { useExplorationResults } from './use_exploration_results';
 import { useMlKibana } from '../../../../../contexts/kibana';
+import { DataFrameAnalysisConfigType } from '../../../../../../../common/types/data_frame_analytics';
 
 const showingDocs = i18n.translate(
   'xpack.ml.dataframe.analytics.explorationResults.documentsShownHelpText',
@@ -195,7 +195,7 @@ export const ExplorationResultsTable: FC<Props> = React.memo(
                 {...classificationData}
                 dataTestSubj="mlExplorationDataGrid"
                 toastNotifications={getToastNotifications()}
-                analysisType={(analysisType as unknown) as ANALYSIS_CONFIG_TYPE}
+                analysisType={(analysisType as unknown) as DataFrameAnalysisConfigType}
               />
             </EuiFlexItem>
           </EuiFlexGroup>
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/page.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/page.tsx
index c8349084dbda8..f4f01330271fc 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/page.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/page.tsx
@@ -26,11 +26,12 @@ import { OutlierExploration } from './components/outlier_exploration';
 import { RegressionExploration } from './components/regression_exploration';
 import { ClassificationExploration } from './components/classification_exploration';
 
-import { ANALYSIS_CONFIG_TYPE } from '../../common/analytics';
+import { ANALYSIS_CONFIG_TYPE } from '../../../../../common/constants/data_frame_analytics';
+import { DataFrameAnalysisConfigType } from '../../../../../common/types/data_frame_analytics';
 
 export const Page: FC<{
   jobId: string;
-  analysisType: ANALYSIS_CONFIG_TYPE;
+  analysisType: DataFrameAnalysisConfigType;
 }> = ({ jobId, analysisType }) => (
   <Fragment>
     <NavigationMenu tabId="data_frame_analytics" />
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/use_view_action.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/use_view_action.tsx
index a3595b51d0a59..2363e6fbecc9d 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/use_view_action.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/use_view_action.tsx
@@ -7,24 +7,32 @@
 import React, { useCallback, useMemo } from 'react';
 
 import { getAnalysisType } from '../../../../common/analytics';
-import { useNavigateToPath } from '../../../../../contexts/kibana';
+import { useMlUrlGenerator, useNavigateToPath } from '../../../../../contexts/kibana';
 
-import {
-  getResultsUrl,
-  DataFrameAnalyticsListAction,
-  DataFrameAnalyticsListRow,
-} from '../analytics_list/common';
+import { DataFrameAnalyticsListAction, DataFrameAnalyticsListRow } from '../analytics_list/common';
 
 import { getViewLinkStatus } from './get_view_link_status';
 import { viewActionButtonText, ViewButton } from './view_button';
+import { DataFrameAnalysisConfigType } from '../../../../../../../common/types/data_frame_analytics';
+import { ML_PAGES } from '../../../../../../../common/constants/ml_url_generator';
 
 export type ViewAction = ReturnType<typeof useViewAction>;
 export const useViewAction = () => {
+  const mlUrlGenerator = useMlUrlGenerator();
   const navigateToPath = useNavigateToPath();
 
+  const redirectToTab = async (jobId: string, analysisType: DataFrameAnalysisConfigType) => {
+    const path = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION,
+      pageState: { jobId, analysisType },
+    });
+
+    await navigateToPath(path, false);
+  };
+
   const clickHandler = useCallback((item: DataFrameAnalyticsListRow) => {
-    const analysisType = getAnalysisType(item.config.analysis);
-    navigateToPath(getResultsUrl(item.id, analysisType));
+    const analysisType = getAnalysisType(item.config.analysis) as DataFrameAnalysisConfigType;
+    redirectToTab(item.id, analysisType);
   }, []);
 
   const action: DataFrameAnalyticsListAction = useMemo(
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
index 0c3bff58c25cd..2f8e087a6a3f0 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
@@ -15,12 +15,8 @@ import {
   EuiSearchBarProps,
   EuiSpacer,
 } from '@elastic/eui';
-
-import {
-  DataFrameAnalyticsId,
-  useRefreshAnalyticsList,
-  ANALYSIS_CONFIG_TYPE,
-} from '../../../../common';
+import { ANALYSIS_CONFIG_TYPE } from '../../../../../../../common/constants/data_frame_analytics';
+import { DataFrameAnalyticsId, useRefreshAnalyticsList } from '../../../../common';
 import { checkPermission } from '../../../../../capabilities/check_capabilities';
 
 import {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
index 994357412510d..37076d400f021 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
@@ -9,11 +9,8 @@ import { EuiTableActionsColumnType, Query, Ast } from '@elastic/eui';
 import { DATA_FRAME_TASK_STATE } from './data_frame_task_state';
 export { DATA_FRAME_TASK_STATE };
 
-import {
-  DataFrameAnalyticsId,
-  DataFrameAnalyticsConfig,
-  ANALYSIS_CONFIG_TYPE,
-} from '../../../../common';
+import { DataFrameAnalyticsId, DataFrameAnalyticsConfig } from '../../../../common';
+import { DataFrameAnalysisConfigType } from '../../../../../../../common/types/data_frame_analytics';
 
 export enum DATA_FRAME_MODE {
   BATCH = 'batch',
@@ -111,10 +108,7 @@ export interface DataFrameAnalyticsListRow {
   checkpointing: object;
   config: DataFrameAnalyticsConfig;
   id: DataFrameAnalyticsId;
-  job_type:
-    | ANALYSIS_CONFIG_TYPE.CLASSIFICATION
-    | ANALYSIS_CONFIG_TYPE.OUTLIER_DETECTION
-    | ANALYSIS_CONFIG_TYPE.REGRESSION;
+  job_type: DataFrameAnalysisConfigType;
   mode: string;
   state: DataFrameAnalyticsStats['state'];
   stats: DataFrameAnalyticsStats;
@@ -137,10 +131,6 @@ export function isCompletedAnalyticsJob(stats: DataFrameAnalyticsStats) {
   return stats.state === DATA_FRAME_TASK_STATE.STOPPED && progress === 100;
 }
 
-export function getResultsUrl(jobId: string, analysisType: ANALYSIS_CONFIG_TYPE | string) {
-  return `#/data_frame_analytics/exploration?_g=(ml:(jobId:${jobId},analysisType:${analysisType}))`;
-}
-
 // The single Action type is not exported as is
 // from EUI so we use that code to get the single
 // Action type from the array of actions.
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
index ef1d373a55a12..1af99d2a1ed00 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
@@ -19,8 +19,6 @@ import {
   EuiLink,
   RIGHT_ALIGNMENT,
 } from '@elastic/eui';
-import { getJobIdUrl, TAB_IDS } from '../../../../../util/get_selected_ids_url';
-
 import { getAnalysisType, DataFrameAnalyticsId } from '../../../../common';
 import {
   getDataFrameAnalyticsProgressPhase,
@@ -32,6 +30,8 @@ import {
   DataFrameAnalyticsStats,
 } from './common';
 import { useActions } from './use_actions';
+import { useMlLink } from '../../../../../contexts/kibana';
+import { ML_PAGES } from '../../../../../../../common/constants/ml_url_generator';
 
 enum TASK_STATE_COLOR {
   analyzing = 'primary',
@@ -134,9 +134,14 @@ export const progressColumn = {
   'data-test-subj': 'mlAnalyticsTableColumnProgress',
 };
 
-export const getDFAnalyticsJobIdLink = (item: DataFrameAnalyticsListRow) => (
-  <EuiLink href={getJobIdUrl(TAB_IDS.DATA_FRAME_ANALYTICS, item.id)}>{item.id}</EuiLink>
-);
+export const DFAnalyticsJobIdLink = ({ item }: { item: DataFrameAnalyticsListRow }) => {
+  const href = useMlLink({
+    page: ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE,
+    pageState: { jobId: item.id },
+  });
+
+  return <EuiLink href={href}>{item.id}</EuiLink>;
+};
 
 export const useColumns = (
   expandedRowItemIds: DataFrameAnalyticsId[],
@@ -145,7 +150,6 @@ export const useColumns = (
   isMlEnabledInSpace: boolean = true
 ) => {
   const { actions, modals } = useActions(isManagementTable);
-
   function toggleDetails(item: DataFrameAnalyticsListRow) {
     const index = expandedRowItemIds.indexOf(item.config.id);
     if (index !== -1) {
@@ -200,7 +204,7 @@ export const useColumns = (
       'data-test-subj': 'mlAnalyticsTableColumnId',
       scope: 'row',
       render: (item: DataFrameAnalyticsListRow) =>
-        isManagementTable ? getDFAnalyticsJobIdLink(item) : item.id,
+        isManagementTable ? <DFAnalyticsJobIdLink item={item} /> : item.id,
     },
     {
       field: DataFrameAnalyticsListColumn.description,
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/models_management/models_list.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/models_management/models_list.tsx
index 338b6444671a6..dbc7a23f2258b 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/models_management/models_list.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/models_management/models_list.tsx
@@ -29,21 +29,23 @@ import { useInferenceApiService } from '../../../../../services/ml_api_service/i
 import { ModelsTableToConfigMapping } from './index';
 import { TIME_FORMAT } from '../../../../../../../common/constants/time_format';
 import { DeleteModelsModal } from './delete_models_modal';
-import { useMlKibana, useNotifications } from '../../../../../contexts/kibana';
+import { useMlKibana, useMlUrlGenerator, useNotifications } from '../../../../../contexts/kibana';
 import { ExpandedRow } from './expanded_row';
-import { getResultsUrl } from '../analytics_list/common';
 import {
   ModelConfigResponse,
   ModelPipelines,
   TrainedModelStat,
 } from '../../../../../../../common/types/inference';
 import {
+  getAnalysisType,
   REFRESH_ANALYTICS_LIST_STATE,
   refreshAnalyticsList$,
   useRefreshAnalyticsList,
 } from '../../../../common';
 import { useTableSettings } from '../analytics_list/use_table_settings';
 import { filterAnalyticsModels, AnalyticsSearchBar } from '../analytics_search_bar';
+import { ML_PAGES } from '../../../../../../../common/constants/ml_url_generator';
+import { DataFrameAnalysisConfigType } from '../../../../../../../common/types/data_frame_analytics';
 
 type Stats = Omit<TrainedModelStat, 'model_id'>;
 
@@ -61,6 +63,7 @@ export const ModelsList: FC = () => {
       application: { navigateToUrl, capabilities },
     },
   } = useMlKibana();
+  const urlGenerator = useMlUrlGenerator();
 
   const canDeleteDataFrameAnalytics = capabilities.ml.canDeleteDataFrameAnalytics as boolean;
 
@@ -278,12 +281,19 @@ export const ModelsList: FC = () => {
       type: 'icon',
       available: (item) => item.metadata?.analytics_config?.id,
       onClick: async (item) => {
-        await navigateToUrl(
-          getResultsUrl(
-            item.metadata?.analytics_config.id,
-            Object.keys(item.metadata?.analytics_config.analysis)[0]
-          )
-        );
+        if (item.metadata?.analytics_config === undefined) return;
+
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION,
+          pageState: {
+            jobId: item.metadata?.analytics_config.id as string,
+            analysisType: getAnalysisType(
+              item.metadata?.analytics_config.analysis
+            ) as DataFrameAnalysisConfigType,
+          },
+        });
+
+        await navigateToUrl(url);
       },
       isPrimary: true,
     },
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/reducer.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/reducer.ts
index 7cd9fcc052f1a..178638322bacd 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/reducer.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/reducer.ts
@@ -33,13 +33,13 @@ import {
   JOB_ID_MAX_LENGTH,
   ALLOWED_DATA_UNITS,
 } from '../../../../../../../common/constants/validation';
+import { ANALYSIS_CONFIG_TYPE } from '../../../../../../../common/constants/data_frame_analytics';
 import {
   getDependentVar,
   getNumTopFeatureImportanceValues,
   getTrainingPercent,
   isRegressionAnalysis,
   isClassificationAnalysis,
-  ANALYSIS_CONFIG_TYPE,
   NUM_TOP_FEATURE_IMPORTANCE_VALUES_MIN,
   TRAINING_PERCENT_MIN,
   TRAINING_PERCENT_MAX,
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/state.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/state.ts
index 4926decaa7f9c..2a89c5a5fd686 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/state.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/state.ts
@@ -8,13 +8,14 @@ import { DeepPartial, DeepReadonly } from '../../../../../../../common/types/com
 import { checkPermission } from '../../../../../capabilities/check_capabilities';
 import { mlNodesAvailable } from '../../../../../ml_nodes_check';
 
-import { ANALYSIS_CONFIG_TYPE, defaultSearchQuery } from '../../../../common/analytics';
+import { defaultSearchQuery, getAnalysisType } from '../../../../common/analytics';
 import { CloneDataFrameAnalyticsConfig } from '../../components/action_clone';
 import {
   DataFrameAnalyticsConfig,
   DataFrameAnalyticsId,
+  DataFrameAnalysisConfigType,
 } from '../../../../../../../common/types/data_frame_analytics';
-
+import { ANALYSIS_CONFIG_TYPE } from '../../../../../../../common/constants/data_frame_analytics';
 export enum DEFAULT_MODEL_MEMORY_LIMIT {
   regression = '100mb',
   outlier_detection = '50mb',
@@ -28,7 +29,7 @@ export const UNSET_CONFIG_ITEM = '--';
 export type EsIndexName = string;
 export type DependentVariable = string;
 export type IndexPatternTitle = string;
-export type AnalyticsJobType = ANALYSIS_CONFIG_TYPE | undefined;
+export type AnalyticsJobType = DataFrameAnalysisConfigType | undefined;
 type IndexPatternId = string;
 export type SourceIndexMap = Record<
   IndexPatternTitle,
@@ -290,7 +291,7 @@ export function getFormStateFromJobConfig(
   analyticsJobConfig: Readonly<CloneDataFrameAnalyticsConfig>,
   isClone: boolean = true
 ): Partial<State['form']> {
-  const jobType = Object.keys(analyticsJobConfig.analysis)[0] as ANALYSIS_CONFIG_TYPE;
+  const jobType = getAnalysisType(analyticsJobConfig.analysis) as DataFrameAnalysisConfigType;
 
   const resultState: Partial<State['form']> = {
     jobType,
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts
index 41f3bab8113f0..14427dd5c6ef2 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts
@@ -11,7 +11,7 @@ import {
   GetDataFrameAnalyticsStatsResponseOk,
 } from '../../../../../services/ml_api_service/data_frame_analytics';
 import {
-  ANALYSIS_CONFIG_TYPE,
+  getAnalysisType,
   REFRESH_ANALYTICS_LIST_STATE,
   refreshAnalyticsList$,
 } from '../../../../common';
@@ -25,6 +25,7 @@ import {
   isDataFrameAnalyticsStopped,
 } from '../../components/analytics_list/common';
 import { AnalyticStatsBarStats } from '../../../../../components/stats_bar';
+import { DataFrameAnalysisConfigType } from '../../../../../../../common/types/data_frame_analytics';
 
 export const isGetDataFrameAnalyticsStatsResponseOk = (
   arg: any
@@ -143,7 +144,7 @@ export const getAnalyticsFactory = (
               checkpointing: {},
               config,
               id: config.id,
-              job_type: Object.keys(config.analysis)[0] as ANALYSIS_CONFIG_TYPE,
+              job_type: getAnalysisType(config.analysis) as DataFrameAnalysisConfigType,
               mode: DATA_FRAME_MODE.BATCH,
               state: stats.state,
               stats,
diff --git a/x-pack/plugins/ml/public/application/datavisualizer/datavisualizer_selector.tsx b/x-pack/plugins/ml/public/application/datavisualizer/datavisualizer_selector.tsx
index 769b83c03110b..7c30dc0cac690 100644
--- a/x-pack/plugins/ml/public/application/datavisualizer/datavisualizer_selector.tsx
+++ b/x-pack/plugins/ml/public/application/datavisualizer/datavisualizer_selector.tsx
@@ -52,7 +52,10 @@ function startTrialDescription() {
 export const DatavisualizerSelector: FC = () => {
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: false });
   const {
-    services: { licenseManagement },
+    services: {
+      licenseManagement,
+      http: { basePath },
+    },
   } = useMlKibana();
   const navigateToPath = useNavigateToPath();
 
@@ -183,7 +186,10 @@ export const DatavisualizerSelector: FC = () => {
                     }
                     description={startTrialDescription()}
                     footer={
-                      <EuiButton target="_blank" href="management/stack/license_management/home">
+                      <EuiButton
+                        target="_blank"
+                        href={`${basePath.get()}/app/management/stack/license_management/home`}
+                      >
                         <FormattedMessage
                           id="xpack.ml.datavisualizer.selector.startTrialButtonLabel"
                           defaultMessage="Start trial"
diff --git a/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/results_links/results_links.tsx b/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/results_links/results_links.tsx
index efade08720cc2..5cba714afe47b 100644
--- a/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/results_links/results_links.tsx
+++ b/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/results_links/results_links.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { FC, useState, useEffect } from 'react';
+import React, { FC, useState, useEffect, useCallback } from 'react';
 import moment from 'moment';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiFlexGroup, EuiFlexItem, EuiCard, EuiIcon } from '@elastic/eui';
@@ -12,7 +12,13 @@ import { ml } from '../../../../services/ml_api_service';
 import { isFullLicense } from '../../../../license';
 import { checkPermission } from '../../../../capabilities/check_capabilities';
 import { mlNodesAvailable } from '../../../../ml_nodes_check/check_ml_nodes';
-import { useMlKibana } from '../../../../contexts/kibana';
+import { useMlKibana, useMlUrlGenerator, useNavigateToPath } from '../../../../contexts/kibana';
+import { ML_PAGES } from '../../../../../../common/constants/ml_url_generator';
+import { MlCommonGlobalState } from '../../../../../../common/types/ml_url_generator';
+import {
+  DISCOVER_APP_URL_GENERATOR,
+  DiscoverUrlGeneratorState,
+} from '../../../../../../../../../src/plugins/discover/public';
 
 const RECHECK_DELAY_MS = 3000;
 
@@ -36,12 +42,70 @@ export const ResultsLinks: FC<Props> = ({
     to: 'now',
   });
   const [showCreateJobLink, setShowCreateJobLink] = useState(false);
-  const [globalStateString, setGlobalStateString] = useState('');
+  const [globalState, setGlobalState] = useState<MlCommonGlobalState | undefined>();
+
+  const [discoverLink, setDiscoverLink] = useState('');
   const {
     services: {
       http: { basePath },
     },
   } = useMlKibana();
+  const mlUrlGenerator = useMlUrlGenerator();
+  const navigateToPath = useNavigateToPath();
+
+  const {
+    services: {
+      share: {
+        urlGenerators: { getUrlGenerator },
+      },
+    },
+  } = useMlKibana();
+
+  useEffect(() => {
+    let unmounted = false;
+
+    const getDiscoverUrl = async (): Promise<void> => {
+      const state: DiscoverUrlGeneratorState = {
+        indexPatternId,
+      };
+
+      if (globalState?.time) {
+        state.timeRange = globalState.time;
+      }
+      if (!unmounted) {
+        const discoverUrlGenerator = getUrlGenerator(DISCOVER_APP_URL_GENERATOR);
+        const discoverUrl = await discoverUrlGenerator.createUrl(state);
+        setDiscoverLink(discoverUrl);
+      }
+    };
+    getDiscoverUrl();
+
+    return () => {
+      unmounted = true;
+    };
+  }, [indexPatternId, getUrlGenerator]);
+
+  const openInDataVisualizer = useCallback(async () => {
+    const path = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.DATA_VISUALIZER_INDEX_VIEWER,
+      pageState: {
+        index: indexPatternId,
+        globalState,
+      },
+    });
+    await navigateToPath(path);
+  }, [indexPatternId, globalState]);
+
+  const redirectToADCreateJobsSelectTypePage = useCallback(async () => {
+    const path = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE,
+      pageState: {
+        index: indexPatternId,
+        globalState,
+      },
+    });
+    await navigateToPath(path);
+  }, [indexPatternId, globalState]);
 
   useEffect(() => {
     setShowCreateJobLink(checkPermission('canCreateJob') && mlNodesAvailable());
@@ -49,11 +113,13 @@ export const ResultsLinks: FC<Props> = ({
   }, []);
 
   useEffect(() => {
-    const _g =
-      timeFieldName !== undefined
-        ? `&_g=(time:(from:'${duration.from}',mode:quick,to:'${duration.to}'))`
-        : '';
-    setGlobalStateString(_g);
+    const _globalState: MlCommonGlobalState = {
+      time: {
+        from: duration.from,
+        to: duration.to,
+      },
+    };
+    setGlobalState(_globalState);
   }, [duration]);
 
   async function updateTimeValues(recheck = true) {
@@ -89,7 +155,7 @@ export const ResultsLinks: FC<Props> = ({
               />
             }
             description=""
-            href={`${basePath.get()}/app/discover#/?&_a=(index:'${indexPatternId}')${globalStateString}`}
+            href={discoverLink}
           />
         </EuiFlexItem>
       )}
@@ -108,7 +174,7 @@ export const ResultsLinks: FC<Props> = ({
                 />
               }
               description=""
-              href={`#/jobs/new_job/step/job_type?index=${indexPatternId}${globalStateString}`}
+              onClick={redirectToADCreateJobsSelectTypePage}
             />
           </EuiFlexItem>
         )}
@@ -124,7 +190,7 @@ export const ResultsLinks: FC<Props> = ({
               />
             }
             description=""
-            href={`#/jobs/new_job/datavisualizer?index=${indexPatternId}${globalStateString}`}
+            onClick={openInDataVisualizer}
           />
         </EuiFlexItem>
       )}
diff --git a/x-pack/plugins/ml/public/application/datavisualizer/index_based/components/actions_panel/actions_panel.tsx b/x-pack/plugins/ml/public/application/datavisualizer/index_based/components/actions_panel/actions_panel.tsx
index 1f2c97b128e3f..ab738ca0f1545 100644
--- a/x-pack/plugins/ml/public/application/datavisualizer/index_based/components/actions_panel/actions_panel.tsx
+++ b/x-pack/plugins/ml/public/application/datavisualizer/index_based/components/actions_panel/actions_panel.tsx
@@ -9,11 +9,11 @@ import React, { FC, useState } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import { EuiSpacer, EuiText, EuiTitle, EuiFlexGroup } from '@elastic/eui';
-
+import { Link } from 'react-router-dom';
 import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
 import { CreateJobLinkCard } from '../../../../components/create_job_link_card';
 import { DataRecognizer } from '../../../../components/data_recognizer';
-import { getBasePath } from '../../../../util/dependency_cache';
+import { ML_PAGES } from '../../../../../../common/constants/ml_url_generator';
 
 interface Props {
   indexPattern: IndexPattern;
@@ -21,7 +21,6 @@ interface Props {
 
 export const ActionsPanel: FC<Props> = ({ indexPattern }) => {
   const [recognizerResultsCount, setRecognizerResultsCount] = useState(0);
-  const basePath = getBasePath();
 
   const recognizerResults = {
     count: 0,
@@ -29,12 +28,7 @@ export const ActionsPanel: FC<Props> = ({ indexPattern }) => {
       setRecognizerResultsCount(recognizerResults.count);
     },
   };
-
-  function openAdvancedJobWizard() {
-    // TODO - pass the search string to the advanced job page as well as the index pattern
-    //       (add in with new advanced job wizard?)
-    window.open(`${basePath.get()}/app/ml/jobs/new_job/advanced?index=${indexPattern.id}`, '_self');
-  }
+  const createJobLink = `/${ML_PAGES.ANOMALY_DETECTION_CREATE_JOB}/advanced?index=${indexPattern.id}`;
 
   // Note we use display:none for the DataRecognizer section as it needs to be
   // passed the recognizerResults object, and then run the recognizer check which
@@ -78,19 +72,19 @@ export const ActionsPanel: FC<Props> = ({ indexPattern }) => {
         </p>
       </EuiText>
       <EuiSpacer size="m" />
-      <CreateJobLinkCard
-        icon="createAdvancedJob"
-        title={i18n.translate('xpack.ml.datavisualizer.actionsPanel.advancedTitle', {
-          defaultMessage: 'Advanced',
-        })}
-        description={i18n.translate('xpack.ml.datavisualizer.actionsPanel.advancedDescription', {
-          defaultMessage:
-            'Use the full range of options to create a job for more advanced use cases',
-        })}
-        onClick={openAdvancedJobWizard}
-        href={`${basePath.get()}/app/ml/jobs/new_job/advanced?index=${indexPattern.id}`}
-        data-test-subj="mlDataVisualizerCreateAdvancedJobCard"
-      />
+      <Link to={createJobLink}>
+        <CreateJobLinkCard
+          icon="createAdvancedJob"
+          title={i18n.translate('xpack.ml.datavisualizer.actionsPanel.advancedTitle', {
+            defaultMessage: 'Advanced',
+          })}
+          description={i18n.translate('xpack.ml.datavisualizer.actionsPanel.advancedDescription', {
+            defaultMessage:
+              'Use the full range of options to create a job for more advanced use cases',
+          })}
+          data-test-subj="mlDataVisualizerCreateAdvancedJobCard"
+        />
+      </Link>
     </div>
   );
 };
diff --git a/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/__snapshots__/explorer_no_jobs_found.test.js.snap b/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/__snapshots__/explorer_no_jobs_found.test.js.snap
index c6503a639997d..826f7b707cfdf 100644
--- a/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/__snapshots__/explorer_no_jobs_found.test.js.snap
+++ b/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/__snapshots__/explorer_no_jobs_found.test.js.snap
@@ -3,17 +3,20 @@
 exports[`ExplorerNoInfluencersFound snapshot 1`] = `
 <EuiEmptyPrompt
   actions={
-    <EuiButton
-      color="primary"
-      fill={true}
-      href="ml#/jobs"
+    <Link
+      to="/jobs"
     >
-      <FormattedMessage
-        defaultMessage="Create job"
-        id="xpack.ml.explorer.createNewJobLinkText"
-        values={Object {}}
-      />
-    </EuiButton>
+      <EuiButton
+        color="primary"
+        fill={true}
+      >
+        <FormattedMessage
+          defaultMessage="Create job"
+          id="xpack.ml.explorer.createNewJobLinkText"
+          values={Object {}}
+        />
+      </EuiButton>
+    </Link>
   }
   data-test-subj="mlNoJobsFound"
   iconType="alert"
diff --git a/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/explorer_no_jobs_found.js b/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/explorer_no_jobs_found.js
index 6f391f9746f23..029ca0475015f 100644
--- a/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/explorer_no_jobs_found.js
+++ b/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/explorer_no_jobs_found.js
@@ -7,25 +7,40 @@
 /*
  * React component for rendering EuiEmptyPrompt when no jobs were found.
  */
-
+import { Link } from 'react-router-dom';
 import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
-
 import { EuiEmptyPrompt, EuiButton } from '@elastic/eui';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
+import { useMlLink } from '../../../contexts/kibana/use_create_url';
 
-export const ExplorerNoJobsFound = () => (
-  <EuiEmptyPrompt
-    iconType="alert"
-    title={
-      <h2>
-        <FormattedMessage id="xpack.ml.explorer.noJobsFoundLabel" defaultMessage="No jobs found" />
-      </h2>
-    }
-    actions={
-      <EuiButton color="primary" fill href="ml#/jobs">
-        <FormattedMessage id="xpack.ml.explorer.createNewJobLinkText" defaultMessage="Create job" />
-      </EuiButton>
-    }
-    data-test-subj="mlNoJobsFound"
-  />
-);
+export const ExplorerNoJobsFound = () => {
+  const ADJobsManagementUrl = useMlLink({
+    page: ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE,
+    excludeBasePath: true,
+  });
+  return (
+    <EuiEmptyPrompt
+      iconType="alert"
+      title={
+        <h2>
+          <FormattedMessage
+            id="xpack.ml.explorer.noJobsFoundLabel"
+            defaultMessage="No jobs found"
+          />
+        </h2>
+      }
+      actions={
+        <Link to={ADJobsManagementUrl}>
+          <EuiButton color="primary" fill>
+            <FormattedMessage
+              id="xpack.ml.explorer.createNewJobLinkText"
+              defaultMessage="Create job"
+            />
+          </EuiButton>
+        </Link>
+      }
+      data-test-subj="mlNoJobsFound"
+    />
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/explorer_no_jobs_found.test.js b/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/explorer_no_jobs_found.test.js
index bcb11cad9674c..c9645b787a8e0 100644
--- a/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/explorer_no_jobs_found.test.js
+++ b/x-pack/plugins/ml/public/application/explorer/components/explorer_no_jobs_found/explorer_no_jobs_found.test.js
@@ -8,6 +8,9 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { ExplorerNoJobsFound } from './explorer_no_jobs_found';
 
+jest.mock('../../../contexts/kibana/use_create_url', () => ({
+  useMlLink: jest.fn().mockReturnValue('/jobs'),
+}));
 describe('ExplorerNoInfluencersFound', () => {
   test('snapshot', () => {
     const wrapper = shallow(<ExplorerNoJobsFound />);
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_charts_container.js b/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_charts_container.js
index 4fb783bfb6006..8f03b1903800a 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_charts_container.js
+++ b/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_charts_container.js
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
+import React, { useCallback } from 'react';
 
 import {
   EuiButtonEmpty,
@@ -28,6 +28,10 @@ import { CHART_TYPE } from '../explorer_constants';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { MlTooltipComponent } from '../../components/chart_tooltip';
+import { withKibana } from '../../../../../../../src/plugins/kibana_react/public';
+import { ML_APP_URL_GENERATOR } from '../../../../common/constants/ml_url_generator';
+import { PLUGIN_ID } from '../../../../common/constants/app';
+import { addItemToRecentlyAccessed } from '../../util/recently_accessed';
 
 const textTooManyBuckets = i18n.translate('xpack.ml.explorer.charts.tooManyBucketsDescription', {
   defaultMessage:
@@ -51,7 +55,23 @@ function getChartId(series) {
 }
 
 // Wrapper for a single explorer chart
-function ExplorerChartContainer({ series, severity, tooManyBuckets, wrapLabel }) {
+function ExplorerChartContainer({
+  series,
+  severity,
+  tooManyBuckets,
+  wrapLabel,
+  navigateToApp,
+  mlUrlGenerator,
+}) {
+  const redirectToSingleMetricViewer = useCallback(async () => {
+    const singleMetricViewerLink = await getExploreSeriesLink(mlUrlGenerator, series);
+    addItemToRecentlyAccessed('timeseriesexplorer', series.jobId, singleMetricViewerLink);
+
+    await navigateToApp(PLUGIN_ID, {
+      path: singleMetricViewerLink,
+    });
+  }, [mlUrlGenerator]);
+
   const { detectorLabel, entityFields } = series;
 
   const chartType = getChartType(series);
@@ -106,7 +126,7 @@ function ExplorerChartContainer({ series, severity, tooManyBuckets, wrapLabel })
                 iconSide="right"
                 iconType="visLine"
                 size="xs"
-                onClick={() => window.open(getExploreSeriesLink(series), '_blank')}
+                onClick={redirectToSingleMetricViewer}
               >
                 <FormattedMessage id="xpack.ml.explorer.charts.viewLabel" defaultMessage="View" />
               </EuiButtonEmpty>
@@ -150,12 +170,24 @@ function ExplorerChartContainer({ series, severity, tooManyBuckets, wrapLabel })
 }
 
 // Flex layout wrapper for all explorer charts
-export const ExplorerChartsContainer = ({
+export const ExplorerChartsContainerUI = ({
   chartsPerRow,
   seriesToPlot,
   severity,
   tooManyBuckets,
+  kibana,
 }) => {
+  const {
+    services: {
+      application: { navigateToApp },
+
+      share: {
+        urlGenerators: { getUrlGenerator },
+      },
+    },
+  } = kibana;
+  const mlUrlGenerator = getUrlGenerator(ML_APP_URL_GENERATOR);
+
   // <EuiFlexGrid> doesn't allow a setting of `columns={1}` when chartsPerRow would be 1.
   // If that's the case we trick it doing that with the following settings:
   const chartsWidth = chartsPerRow === 1 ? 'calc(100% - 20px)' : 'auto';
@@ -177,9 +209,13 @@ export const ExplorerChartsContainer = ({
               severity={severity}
               tooManyBuckets={tooManyBuckets}
               wrapLabel={wrapLabel}
+              navigateToApp={navigateToApp}
+              mlUrlGenerator={mlUrlGenerator}
             />
           </EuiFlexItem>
         ))}
     </EuiFlexGrid>
   );
 };
+
+export const ExplorerChartsContainer = withKibana(ExplorerChartsContainerUI);
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_charts_container.test.js b/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_charts_container.test.js
index 8257ac2b3a703..2da212c8f2f29 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_charts_container.test.js
+++ b/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_charts_container.test.js
@@ -40,6 +40,12 @@ jest.mock('../../services/job_service', () => ({
   },
 }));
 
+jest.mock('../../../../../../../src/plugins/kibana_react/public', () => ({
+  withKibana: (comp) => {
+    return comp;
+  },
+}));
+
 describe('ExplorerChartsContainer', () => {
   const mockedGetBBox = { x: 0, y: -11.5, width: 12.1875, height: 14.5 };
   const originalGetBBox = SVGElement.prototype.getBBox;
@@ -47,10 +53,22 @@ describe('ExplorerChartsContainer', () => {
   beforeEach(() => (SVGElement.prototype.getBBox = () => mockedGetBBox));
   afterEach(() => (SVGElement.prototype.getBBox = originalGetBBox));
 
+  const kibanaContextMock = {
+    services: {
+      application: { navigateToApp: jest.fn() },
+      share: {
+        urlGenerators: { getUrlGenerator: jest.fn() },
+      },
+    },
+  };
   test('Minimal Initialization', () => {
     const wrapper = shallow(
       <I18nProvider>
-        <ExplorerChartsContainer {...getDefaultChartsData()} />
+        <ExplorerChartsContainer
+          {...getDefaultChartsData()}
+          kibana={kibanaContextMock}
+          severity={10}
+        />
       </I18nProvider>
     );
 
@@ -71,10 +89,11 @@ describe('ExplorerChartsContainer', () => {
       ],
       chartsPerRow: 1,
       tooManyBuckets: false,
+      severity: 10,
     };
     const wrapper = mount(
       <I18nProvider>
-        <ExplorerChartsContainer {...props} />
+        <ExplorerChartsContainer {...props} kibana={kibanaContextMock} />
       </I18nProvider>
     );
 
@@ -98,10 +117,11 @@ describe('ExplorerChartsContainer', () => {
       ],
       chartsPerRow: 1,
       tooManyBuckets: false,
+      severity: 10,
     };
     const wrapper = mount(
       <I18nProvider>
-        <ExplorerChartsContainer {...props} />
+        <ExplorerChartsContainer {...props} kibana={kibanaContextMock} />
       </I18nProvider>
     );
 
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_actions/results.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_actions/results.js
index d0d0442dd4aee..85a342838a506 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_actions/results.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_actions/results.js
@@ -5,13 +5,20 @@
  */
 
 import PropTypes from 'prop-types';
-import React from 'react';
+import React, { useMemo } from 'react';
 
 import { EuiButtonIcon, EuiToolTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { useCreateADLinks } from '../../../../components/custom_hooks/use_create_ad_links';
+import { Link } from 'react-router-dom';
+import { useMlKibana } from '../../../../contexts/kibana';
 
-export function ResultLinks({ jobs }) {
+export function ResultLinks({ jobs, isManagementTable }) {
+  const {
+    services: {
+      http: { basePath },
+    },
+  } = useMlKibana();
   const openJobsInSingleMetricViewerText = i18n.translate(
     'xpack.ml.jobsList.resultActions.openJobsInSingleMetricViewerText',
     {
@@ -37,29 +44,59 @@ export function ResultLinks({ jobs }) {
   const singleMetricEnabled = jobs.length === 1 && jobs[0].isSingleMetricViewerJob;
   const jobActionsDisabled = jobs.length === 1 && jobs[0].deleting === true;
   const { createLinkWithUserDefaults } = useCreateADLinks();
+  const timeSeriesExplorerLink = useMemo(
+    () => createLinkWithUserDefaults('timeseriesexplorer', jobs),
+    [jobs]
+  );
+  const anomalyExplorerLink = useMemo(() => createLinkWithUserDefaults('explorer', jobs), [jobs]);
+
   return (
     <React.Fragment>
       {singleMetricVisible && (
         <EuiToolTip position="bottom" content={openJobsInSingleMetricViewerText}>
+          {isManagementTable ? (
+            <EuiButtonIcon
+              href={`${basePath.get()}/app/ml/${timeSeriesExplorerLink}`}
+              iconType="visLine"
+              aria-label={openJobsInSingleMetricViewerText}
+              className="results-button"
+              isDisabled={singleMetricEnabled === false || jobActionsDisabled === true}
+              data-test-subj="mlOpenJobsInSingleMetricViewerFromManagementButton"
+            />
+          ) : (
+            <Link to={timeSeriesExplorerLink}>
+              <EuiButtonIcon
+                iconType="visLine"
+                aria-label={openJobsInSingleMetricViewerText}
+                className="results-button"
+                isDisabled={singleMetricEnabled === false || jobActionsDisabled === true}
+                data-test-subj="mlOpenJobsInSingleMetricViewerButton"
+              />
+            </Link>
+          )}
+        </EuiToolTip>
+      )}
+      <EuiToolTip position="bottom" content={openJobsInAnomalyExplorerText}>
+        {isManagementTable ? (
           <EuiButtonIcon
-            href={createLinkWithUserDefaults('timeseriesexplorer', jobs)}
-            iconType="visLine"
+            href={`${basePath.get()}/app/ml/${anomalyExplorerLink}`}
+            iconType="visTable"
             aria-label={openJobsInSingleMetricViewerText}
             className="results-button"
             isDisabled={singleMetricEnabled === false || jobActionsDisabled === true}
-            data-test-subj="mlOpenJobsInSingleMetricViewerButton"
+            data-test-subj="mlOpenJobsInSingleMetricViewerFromManagementButton"
           />
-        </EuiToolTip>
-      )}
-      <EuiToolTip position="bottom" content={openJobsInAnomalyExplorerText}>
-        <EuiButtonIcon
-          href={createLinkWithUserDefaults('explorer', jobs)}
-          iconType="visTable"
-          aria-label={openJobsInAnomalyExplorerText}
-          className="results-button"
-          isDisabled={jobActionsDisabled === true}
-          data-test-subj="mlOpenJobsInAnomalyExplorerButton"
-        />
+        ) : (
+          <Link to={anomalyExplorerLink}>
+            <EuiButtonIcon
+              iconType="visTable"
+              aria-label={openJobsInAnomalyExplorerText}
+              className="results-button"
+              isDisabled={jobActionsDisabled === true}
+              data-test-subj="mlOpenJobsInAnomalyExplorerButton"
+            />
+          </Link>
+        )}
       </EuiToolTip>
       <div className="actions-border" />
     </React.Fragment>
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_details/extract_job_details.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_details/extract_job_details.js
index 8f89c4a049189..73b212b97b4cc 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_details/extract_job_details.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_details/extract_job_details.js
@@ -5,10 +5,10 @@
  */
 
 import React from 'react';
-import { EuiLink } from '@elastic/eui';
 import { detectorToString } from '../../../../util/string_utils';
 import { formatValues, filterObjects } from './format_values';
 import { i18n } from '@kbn/i18n';
+import { Link } from 'react-router-dom';
 
 export function extractJobDetails(job) {
   if (Object.keys(job).length === 0) {
@@ -61,7 +61,7 @@ export function extractJobDetails(job) {
   if (job.calendars) {
     calendars.items = job.calendars.map((c) => [
       '',
-      <EuiLink href={`#/settings/calendars_list/edit_calendar/${c}?_g=()`}>{c}</EuiLink>,
+      <Link to={`/settings/calendars_list/edit_calendar/${c}?_g=()`}>{c}</Link>,
     ]);
     // remove the calendars list from the general section
     // so not to show it twice.
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_details/forecasts_table/forecasts_table.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_details/forecasts_table/forecasts_table.js
index b6157c8694a18..b32070fff73aa 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_details/forecasts_table/forecasts_table.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_details/forecasts_table/forecasts_table.js
@@ -5,8 +5,6 @@
  */
 
 import PropTypes from 'prop-types';
-import rison from 'rison-node';
-
 import React, { Component } from 'react';
 
 import {
@@ -30,13 +28,19 @@ import {
   getLatestDataOrBucketTimestamp,
   isTimeSeriesViewJob,
 } from '../../../../../../../common/util/job_utils';
+import { withKibana } from '../../../../../../../../../../src/plugins/kibana_react/public';
+import {
+  ML_APP_URL_GENERATOR,
+  ML_PAGES,
+} from '../../../../../../../common/constants/ml_url_generator';
+import { PLUGIN_ID } from '../../../../../../../common/constants/app';
 
 const MAX_FORECASTS = 500;
 
 /**
  * Table component for rendering the lists of forecasts run on an ML job.
  */
-export class ForecastsTable extends Component {
+export class ForecastsTableUI extends Component {
   constructor(props) {
     super(props);
     this.state = {
@@ -78,7 +82,17 @@ export class ForecastsTable extends Component {
     }
   }
 
-  openSingleMetricView(forecast) {
+  async openSingleMetricView(forecast) {
+    const {
+      services: {
+        application: { navigateToApp },
+
+        share: {
+          urlGenerators: { getUrlGenerator },
+        },
+      },
+    } = this.props.kibana;
+
     // Creates the link to the Single Metric Viewer.
     // Set the total time range from the start of the job data to the end of the forecast,
     const dataCounts = this.props.job.data_counts;
@@ -93,31 +107,7 @@ export class ForecastsTable extends Component {
         ? new Date(forecast.forecast_end_timestamp).toISOString()
         : new Date(resultLatest).toISOString();
 
-    const _g = rison.encode({
-      ml: {
-        jobIds: [this.props.job.job_id],
-      },
-      refreshInterval: {
-        display: 'Off',
-        pause: false,
-        value: 0,
-      },
-      time: {
-        from,
-        to,
-        mode: 'absolute',
-      },
-    });
-
-    const appState = {
-      query: {
-        query_string: {
-          analyze_wildcard: true,
-          query: '*',
-        },
-      },
-    };
-
+    let mlTimeSeriesExplorer = {};
     if (forecast !== undefined) {
       // Set the zoom to show duration before the forecast equal to the length of the forecast.
       const forecastDurationMs =
@@ -126,8 +116,7 @@ export class ForecastsTable extends Component {
         forecast.forecast_start_timestamp - forecastDurationMs,
         jobEarliest
       );
-
-      appState.mlTimeSeriesExplorer = {
+      mlTimeSeriesExplorer = {
         forecastId: forecast.forecast_id,
         zoom: {
           from: new Date(zoomFrom).toISOString(),
@@ -136,11 +125,39 @@ export class ForecastsTable extends Component {
       };
     }
 
-    const _a = rison.encode(appState);
-
-    const url = `?_g=${_g}&_a=${_a}`;
-    addItemToRecentlyAccessed('timeseriesexplorer', this.props.job.job_id, url);
-    window.open(`#/timeseriesexplorer${url}`, '_self');
+    const mlUrlGenerator = getUrlGenerator(ML_APP_URL_GENERATOR);
+    const singleMetricViewerForecastLink = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.SINGLE_METRIC_VIEWER,
+      pageState: {
+        timeRange: {
+          from,
+          to,
+          mode: 'absolute',
+        },
+        refreshInterval: {
+          display: 'Off',
+          pause: false,
+          value: 0,
+        },
+        jobIds: [this.props.job.job_id],
+        query: {
+          query_string: {
+            analyze_wildcard: true,
+            query: '*',
+          },
+        },
+        ...mlTimeSeriesExplorer,
+      },
+      excludeBasePath: true,
+    });
+    addItemToRecentlyAccessed(
+      'timeseriesexplorer',
+      this.props.job.job_id,
+      singleMetricViewerForecastLink
+    );
+    await navigateToApp(PLUGIN_ID, {
+      path: singleMetricViewerForecastLink,
+    });
   }
 
   render() {
@@ -322,6 +339,8 @@ export class ForecastsTable extends Component {
     );
   }
 }
-ForecastsTable.propTypes = {
+ForecastsTableUI.propTypes = {
   job: PropTypes.object.isRequired,
 };
+
+export const ForecastsTable = withKibana(ForecastsTableUI);
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/job_description.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/job_description.js
index a5469357ba1a1..8b5d6009cc61e 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/job_description.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/job_description.js
@@ -8,7 +8,7 @@ import PropTypes from 'prop-types';
 import React from 'react';
 
 import { JobGroup } from '../job_group';
-import { getGroupIdsUrl, TAB_IDS } from '../../../../util/get_selected_ids_url';
+import { AnomalyDetectionJobIdLink } from './job_id_link';
 
 export function JobDescription({ job, isManagementTable }) {
   return (
@@ -17,11 +17,7 @@ export function JobDescription({ job, isManagementTable }) {
         {job.description} &nbsp;
         {job.groups.map((group) => {
           if (isManagementTable === true) {
-            return (
-              <a key={group} href={getGroupIdsUrl(TAB_IDS.ANOMALY_DETECTION, [group])}>
-                <JobGroup name={group} />
-              </a>
-            );
+            return <AnomalyDetectionJobIdLink key={group} groupId={group} />;
           }
           return <JobGroup key={group} name={group} />;
         })}
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/job_id_link.tsx b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/job_id_link.tsx
new file mode 100644
index 0000000000000..0e84619899d71
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/job_id_link.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { EuiLink } from '@elastic/eui';
+import { useMlKibana, useMlUrlGenerator } from '../../../../contexts/kibana';
+import { ML_PAGES } from '../../../../../../common/constants/ml_url_generator';
+import { AnomalyDetectionQueryState } from '../../../../../../common/types/ml_url_generator';
+// @ts-ignore
+import { JobGroup } from '../job_group';
+
+interface JobIdLink {
+  id: string;
+}
+
+interface GroupIdLink {
+  groupId: string;
+  children: string;
+}
+
+type AnomalyDetectionJobIdLinkProps = JobIdLink | GroupIdLink;
+
+function isGroupIdLink(props: JobIdLink | GroupIdLink): props is GroupIdLink {
+  return (props as GroupIdLink).groupId !== undefined;
+}
+export const AnomalyDetectionJobIdLink = (props: AnomalyDetectionJobIdLinkProps) => {
+  const mlUrlGenerator = useMlUrlGenerator();
+  const {
+    services: {
+      application: { navigateToUrl },
+    },
+  } = useMlKibana();
+
+  const redirectToJobsManagementPage = async () => {
+    const pageState: AnomalyDetectionQueryState = {};
+    if (isGroupIdLink(props)) {
+      pageState.groupIds = [props.groupId];
+    } else {
+      pageState.jobId = props.id;
+    }
+    const url = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE,
+      pageState,
+    });
+    await navigateToUrl(url);
+  };
+  if (isGroupIdLink(props)) {
+    return (
+      <EuiLink key={props.groupId} onClick={() => redirectToJobsManagementPage()}>
+        <JobGroup name={props.groupId} />
+      </EuiLink>
+    );
+  } else {
+    return (
+      <EuiLink key={props.id} onClick={() => redirectToJobsManagementPage()}>
+        {props.id}
+      </EuiLink>
+    );
+  }
+};
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/jobs_list.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/jobs_list.js
index fa4ea09b89ff9..8bc0057b27d6d 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/jobs_list.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/jobs_list.js
@@ -14,12 +14,12 @@ import { toLocaleString } from '../../../../util/string_utils';
 import { ResultLinks, actionsMenuContent } from '../job_actions';
 import { JobDescription } from './job_description';
 import { JobIcon } from '../../../../components/job_message_icon';
-import { getJobIdUrl, TAB_IDS } from '../../../../util/get_selected_ids_url';
 import { TIME_FORMAT } from '../../../../../../common/constants/time_format';
 
-import { EuiBadge, EuiBasicTable, EuiButtonIcon, EuiLink, EuiScreenReaderOnly } from '@elastic/eui';
+import { EuiBadge, EuiBasicTable, EuiButtonIcon, EuiScreenReaderOnly } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { AnomalyDetectionJobIdLink } from './job_id_link';
 
 const PAGE_SIZE = 10;
 const PAGE_SIZE_OPTIONS = [10, 25, 50];
@@ -71,7 +71,7 @@ export class JobsList extends Component {
       return id;
     }
 
-    return <EuiLink href={getJobIdUrl(TAB_IDS.ANOMALY_DETECTION, id)}>{id}</EuiLink>;
+    return <AnomalyDetectionJobIdLink key={id} id={id} />;
   }
 
   getPageOfJobs(index, size, sortField, sortDirection) {
@@ -241,7 +241,7 @@ export class JobsList extends Component {
         name: i18n.translate('xpack.ml.jobsList.actionsLabel', {
           defaultMessage: 'Actions',
         }),
-        render: (item) => <ResultLinks jobs={[item]} />,
+        render: (item) => <ResultLinks jobs={[item]} isManagementTable={isManagementTable} />,
       },
     ];
 
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/new_job_button/new_job_button.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/new_job_button/new_job_button.js
index fdffa8b38ae04..81effe8d3ebeb 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/new_job_button/new_job_button.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/new_job_button/new_job_button.js
@@ -11,13 +11,13 @@ import React from 'react';
 
 import { EuiButton } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-
-function newJob() {
-  window.location.href = `#/jobs/new_job`;
-}
+import { useCreateAndNavigateToMlLink } from '../../../../contexts/kibana/use_create_url';
+import { ML_PAGES } from '../../../../../../common/constants/ml_url_generator';
 
 export function NewJobButton() {
   const buttonEnabled = checkPermission('canCreateJob') && mlNodesAvailable();
+  const newJob = useCreateAndNavigateToMlLink(ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX);
+
   return (
     <EuiButton
       data-test-subj="mlCreateNewJobButton"
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/utils.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/utils.js
index 21824aac18cdd..fd0789c9bc103 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/utils.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/utils.js
@@ -394,7 +394,7 @@ export function clearSelectedJobIdFromUrl(url) {
     url = decodeURIComponent(url);
     if (url.includes('mlManagement') && (url.includes('jobId') || url.includes('groupIds'))) {
       const urlParams = getUrlVars(url);
-      const clearedParams = `ml#/jobs?_g=${urlParams._g}`;
+      const clearedParams = `jobs?_g=${urlParams._g}`;
       window.history.replaceState({}, document.title, clearedParams);
     }
   }
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
index 8ab45dc24aa17..440585dcf2a19 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
@@ -268,8 +268,13 @@ export function resetJob(jobCreator: JobCreatorType, navigateToPath: NavigateToP
   navigateToPath('/jobs/new_job');
 }
 
-export function advancedStartDatafeed(jobCreator: JobCreatorType, navigateToPath: NavigateToPath) {
-  stashCombinedJob(jobCreator, false, false);
+export function advancedStartDatafeed(
+  jobCreator: JobCreatorType | null,
+  navigateToPath: NavigateToPath
+) {
+  if (jobCreator !== null) {
+    stashCombinedJob(jobCreator, false, false);
+  }
   navigateToPath('/jobs');
 }
 
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/job_details_step/components/additional_section/components/calendars/calendars_selection.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/job_details_step/components/additional_section/components/calendars/calendars_selection.tsx
index 7999ce46bc9ed..d7fe55a9a72e1 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/job_details_step/components/additional_section/components/calendars/calendars_selection.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/job_details_step/components/additional_section/components/calendars/calendars_selection.tsx
@@ -26,6 +26,7 @@ import { PLUGIN_ID } from '../../../../../../../../../../../common/constants/app
 import { Calendar } from '../../../../../../../../../../../common/types/calendars';
 import { useMlKibana } from '../../../../../../../../../contexts/kibana';
 import { GLOBAL_CALENDAR } from '../../../../../../../../../../../common/constants/calendars';
+import { ML_PAGES } from '../../../../../../../../../../../common/constants/ml_url_generator';
 
 export const CalendarsSelection: FC = () => {
   const {
@@ -73,7 +74,7 @@ export const CalendarsSelection: FC = () => {
   };
 
   const manageCalendarsHref = getUrlForApp(PLUGIN_ID, {
-    path: '/settings/calendars_list',
+    path: ML_PAGES.CALENDARS_MANAGE,
   });
 
   return (
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/components/start_datafeed_switch/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/components/start_datafeed_switch/index.ts
new file mode 100644
index 0000000000000..a62e378222ff9
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/components/start_datafeed_switch/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { StartDatafeedSwitch } from './start_datafeed_switch';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/components/start_datafeed_switch/start_datafeed_switch.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/components/start_datafeed_switch/start_datafeed_switch.tsx
new file mode 100644
index 0000000000000..4aa78cfc41009
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/components/start_datafeed_switch/start_datafeed_switch.tsx
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FC } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiSwitch, EuiFormRow, EuiSpacer } from '@elastic/eui';
+interface Props {
+  startDatafeed: boolean;
+  setStartDatafeed(start: boolean): void;
+  disabled?: boolean;
+}
+
+export const StartDatafeedSwitch: FC<Props> = ({
+  startDatafeed,
+  setStartDatafeed,
+  disabled = false,
+}) => {
+  return (
+    <>
+      <EuiSpacer />
+      <EuiFormRow
+        helpText={i18n.translate(
+          'xpack.ml.newJob.wizard.summaryStep.startDatafeedCheckboxHelpText',
+          {
+            defaultMessage: 'If unselected, job can be started later from the jobs list.',
+          }
+        )}
+      >
+        <EuiSwitch
+          data-test-subj="mlJobWizardStartDatafeedCheckbox"
+          label={i18n.translate('xpack.ml.newJob.wizard.summaryStep.startDatafeedCheckbox', {
+            defaultMessage: 'Start immediately',
+          })}
+          checked={startDatafeed}
+          onChange={(e) => setStartDatafeed(e.target.checked)}
+          disabled={disabled}
+        />
+      </EuiFormRow>
+    </>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/summary.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/summary.tsx
index 3000ce8449138..021039c06e320 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/summary.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/summary.tsx
@@ -28,6 +28,7 @@ import { DatafeedDetails } from './components/datafeed_details';
 import { DetectorChart } from './components/detector_chart';
 import { JobProgress } from './components/job_progress';
 import { PostSaveOptions } from './components/post_save_options';
+import { StartDatafeedSwitch } from './components/start_datafeed_switch';
 import { toastNotificationServiceProvider } from '../../../../../services/toast_notification_service';
 import {
   convertToAdvancedJob,
@@ -38,7 +39,10 @@ import { JobSectionTitle, DatafeedSectionTitle } from './components/common';
 
 export const SummaryStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep }) => {
   const {
-    services: { notifications },
+    services: {
+      notifications,
+      http: { basePath },
+    },
   } = useMlKibana();
 
   const navigateToPath = useNavigateToPath();
@@ -50,6 +54,7 @@ export const SummaryStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep }) =>
   const [creatingJob, setCreatingJob] = useState(false);
   const [isValid, setIsValid] = useState(jobValidator.validationSummary.basic);
   const [jobRunner, setJobRunner] = useState<JobRunner | null>(null);
+  const [startDatafeed, setStartDatafeed] = useState(true);
 
   const isAdvanced = isAdvancedJobCreator(jobCreator);
   const jsonEditorMode = isAdvanced ? EDITOR_MODE.EDITABLE : EDITOR_MODE.READONLY;
@@ -59,15 +64,17 @@ export const SummaryStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep }) =>
   }, []);
 
   async function start() {
+    setCreatingJob(true);
     if (isAdvanced) {
-      await startAdvanced();
+      await createAdvancedJob();
+    } else if (startDatafeed === true) {
+      await createAndStartJob();
     } else {
-      await startInline();
+      await createAdvancedJob(false);
     }
   }
 
-  async function startInline() {
-    setCreatingJob(true);
+  async function createAndStartJob() {
     try {
       const jr = await jobCreator.createAndStartJob();
       setJobRunner(jr);
@@ -76,12 +83,11 @@ export const SummaryStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep }) =>
     }
   }
 
-  async function startAdvanced() {
-    setCreatingJob(true);
+  async function createAdvancedJob(showStartModal: boolean = true) {
     try {
       await jobCreator.createJob();
       await jobCreator.createDatafeed();
-      advancedStartDatafeed(jobCreator, navigateToPath);
+      advancedStartDatafeed(showStartModal ? jobCreator : null, navigateToPath);
     } catch (error) {
       handleJobCreationError(error);
     }
@@ -105,7 +111,7 @@ export const SummaryStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep }) =>
       jobCreator.end,
       isSingleMetricJobCreator(jobCreator) === true ? 'timeseriesexplorer' : 'explorer'
     );
-    window.open(url, '_blank');
+    navigateToPath(`${basePath.get()}/app/ml/${url}`);
   }
 
   function clickResetJob() {
@@ -131,6 +137,14 @@ export const SummaryStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep }) =>
           <EuiSpacer size="m" />
           <JobDetails />
 
+          {isAdvanced === false && (
+            <StartDatafeedSwitch
+              startDatafeed={startDatafeed}
+              setStartDatafeed={setStartDatafeed}
+              disabled={creatingJob}
+            />
+          )}
+
           {isAdvanced && (
             <Fragment>
               <EuiHorizontalRule />
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts b/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts
index 69df2773f9f8d..cedaaa3b5dfaa 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts
@@ -4,19 +4,24 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { ApplicationStart } from 'kibana/public';
 import { IndexPatternsContract } from '../../../../../../../../../src/plugins/data/public';
 import { mlJobService } from '../../../../services/job_service';
 import { loadIndexPatterns, getIndexPatternIdFromName } from '../../../../util/index_utils';
 import { CombinedJob } from '../../../../../../common/types/anomaly_detection_jobs';
 import { CREATED_BY_LABEL, JOB_TYPE } from '../../../../../../common/constants/new_job';
 
-export async function preConfiguredJobRedirect(indexPatterns: IndexPatternsContract) {
+export async function preConfiguredJobRedirect(
+  indexPatterns: IndexPatternsContract,
+  basePath: string,
+  navigateToUrl: ApplicationStart['navigateToUrl']
+) {
   const { job } = mlJobService.tempJobCloningObjects;
   if (job) {
     try {
       await loadIndexPatterns(indexPatterns);
       const redirectUrl = getWizardUrlFromCloningJob(job);
-      window.location.href = `#/${redirectUrl}`;
+      await navigateToUrl(`${basePath}/app/ml/${redirectUrl}`);
       return Promise.reject();
     } catch (error) {
       return Promise.resolve();
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx
index be0135ec3f1e0..1a91f6d51ed4d 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx
@@ -19,6 +19,7 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { useNavigateToPath } from '../../../../contexts/kibana';
+
 import { useMlContext } from '../../../../contexts/ml';
 import { isSavedSearchSavedObject } from '../../../../../../common/types/kibana';
 import { DataRecognizer } from '../../../../components/data_recognizer';
@@ -26,10 +27,15 @@ import { addItemToRecentlyAccessed } from '../../../../util/recently_accessed';
 import { timeBasedIndexCheck } from '../../../../util/index_utils';
 import { CreateJobLinkCard } from '../../../../components/create_job_link_card';
 import { CategorizationIcon } from './categorization_job_icon';
+import { ML_PAGES } from '../../../../../../common/constants/ml_url_generator';
+import { useCreateAndNavigateToMlLink } from '../../../../contexts/kibana/use_create_url';
 
 export const Page: FC = () => {
   const mlContext = useMlContext();
   const navigateToPath = useNavigateToPath();
+  const onSelectDifferentIndex = useCreateAndNavigateToMlLink(
+    ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX
+  );
 
   const [recognizerResultsCount, setRecognizerResultsCount] = useState(0);
 
@@ -193,7 +199,7 @@ export const Page: FC = () => {
                 defaultMessage="Anomaly detection can only be run over indices which are time based."
               />
               <br />
-              <EuiLink href="#jobs/new_job">
+              <EuiLink onClick={onSelectDifferentIndex}>
                 <FormattedMessage
                   id="xpack.ml.newJob.wizard.jobType.selectDifferentIndexLinkText"
                   defaultMessage="Select a different index"
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx
index da1bbbc7ae67c..8dd5d609da396 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx
@@ -21,7 +21,8 @@ import {
   EuiPanel,
 } from '@elastic/eui';
 import { merge } from 'lodash';
-import { useMlKibana } from '../../../contexts/kibana';
+import moment from 'moment';
+import { useMlKibana, useMlUrlGenerator } from '../../../contexts/kibana';
 import { ml } from '../../../services/ml_api_service';
 import { useMlContext } from '../../../contexts/ml';
 import {
@@ -32,7 +33,6 @@ import {
   KibanaObjectResponse,
   ModuleJob,
 } from '../../../../../common/types/modules';
-import { mlJobService } from '../../../services/job_service';
 import { CreateResultCallout } from './components/create_result_callout';
 import { KibanaObjects } from './components/kibana_objects';
 import { ModuleJobs } from './components/module_jobs';
@@ -40,6 +40,8 @@ import { checkForSavedObjects } from './resolvers';
 import { JobSettingsForm, JobSettingsFormValues } from './components/job_settings_form';
 import { TimeRange } from '../common/components';
 import { JobId } from '../../../../../common/types/anomaly_detection_jobs';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
+import { TIME_FORMAT } from '../../../../../common/constants/time_format';
 
 export interface ModuleJobUI extends ModuleJob {
   datafeedResult?: DatafeedResponse;
@@ -71,6 +73,8 @@ export const Page: FC<PageProps> = ({ moduleId, existingGroupIds }) => {
   const {
     services: { notifications },
   } = useMlKibana();
+  const urlGenerator = useMlUrlGenerator();
+
   // #region State
   const [jobPrefix, setJobPrefix] = useState<string>('');
   const [jobs, setJobs] = useState<ModuleJobUI[]>([]);
@@ -185,14 +189,20 @@ export const Page: FC<PageProps> = ({ moduleId, existingGroupIds }) => {
         })
       );
       setKibanaObjects(merge(kibanaObjects, kibanaResponse));
-      setResultsUrl(
-        mlJobService.createResultsUrl(
-          jobsResponse.filter(({ success }) => success).map(({ id }) => id),
-          resultTimeRange.start,
-          resultTimeRange.end,
-          'explorer'
-        )
-      );
+
+      const url = await urlGenerator.createUrl({
+        page: ML_PAGES.ANOMALY_EXPLORER,
+        pageState: {
+          jobIds: jobsResponse.filter(({ success }) => success).map(({ id }) => id),
+          timeRange: {
+            from: moment(resultTimeRange.start).format(TIME_FORMAT),
+            to: moment(resultTimeRange.end).format(TIME_FORMAT),
+            mode: 'absolute',
+          },
+        },
+      });
+
+      setResultsUrl(url);
       const failedJobsCount = jobsResponse.reduce((count, { success }) => {
         return success ? count : count + 1;
       }, 0);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/recognize/resolvers.ts b/x-pack/plugins/ml/public/application/jobs/new_job/recognize/resolvers.ts
index e3b0fd4cefe0c..97a03fa21035f 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/recognize/resolvers.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/recognize/resolvers.ts
@@ -6,33 +6,40 @@
 
 import { i18n } from '@kbn/i18n';
 import { getToastNotifications, getSavedObjectsClient } from '../../../util/dependency_cache';
-import { mlJobService } from '../../../services/job_service';
 import { ml } from '../../../services/ml_api_service';
 import { KibanaObjects } from './page';
+import { NavigateToPath } from '../../../contexts/kibana';
+import { CreateLinkWithUserDefaults } from '../../../components/custom_hooks/use_create_ad_links';
 
 /**
  * Checks whether the jobs in a data recognizer module have been created.
  * Redirects to the Anomaly Explorer to view the jobs if they have been created,
  * or the recognizer job wizard for the module if not.
  */
-export function checkViewOrCreateJobs(moduleId: string, indexPatternId: string): Promise<any> {
+export function checkViewOrCreateJobs(
+  moduleId: string,
+  indexPatternId: string,
+  createLinkWithUserDefaults: CreateLinkWithUserDefaults,
+  navigateToPath: NavigateToPath
+): Promise<any> {
   return new Promise((resolve, reject) => {
     // Load the module, and check if the job(s) in the module have been created.
     // If so, load the jobs in the Anomaly Explorer.
     // Otherwise open the data recognizer wizard for the module.
     // Always want to call reject() so as not to load original page.
     ml.dataRecognizerModuleJobsExist({ moduleId })
-      .then((resp: any) => {
+      .then(async (resp: any) => {
         if (resp.jobsExist === true) {
-          const resultsPageUrl = mlJobService.createResultsUrlForJobs(resp.jobs, 'explorer');
-          window.location.href = resultsPageUrl;
+          // also honor user's time filter setting in Advanced Settings
+          const url = createLinkWithUserDefaults('explorer', resp.jobs);
+          await navigateToPath(url);
           reject();
         } else {
-          window.location.href = `#/jobs/new_job/recognize?id=${moduleId}&index=${indexPatternId}`;
+          await navigateToPath(`/jobs/new_job/recognize?id=${moduleId}&index=${indexPatternId}`);
           reject();
         }
       })
-      .catch((err: Error) => {
+      .catch(async (err: Error) => {
         // eslint-disable-next-line no-console
         console.error(`Error checking whether jobs in module ${moduleId} exists`, err);
         const toastNotifications = getToastNotifications();
@@ -46,8 +53,7 @@ export function checkViewOrCreateJobs(moduleId: string, indexPatternId: string):
               'An error occurred trying to check whether the jobs in the module have been created.',
           }),
         });
-
-        window.location.href = '#/jobs';
+        await navigateToPath(`/jobs`);
         reject();
       });
   });
diff --git a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
index 0af6030df28b1..9c9096dfdfc21 100644
--- a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
+++ b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
@@ -31,6 +31,7 @@ import { getDocLinks } from '../../../../util/dependency_cache';
 import { JobsListView } from '../../../../jobs/jobs_list/components/jobs_list_view/index';
 import { DataFrameAnalyticsList } from '../../../../data_frame_analytics/pages/analytics_management/components/analytics_list';
 import { AccessDeniedPage } from '../access_denied_page';
+import { SharePluginStart } from '../../../../../../../../../src/plugins/share/public';
 
 interface Tab {
   'data-test-subj': string;
@@ -75,8 +76,9 @@ function getTabs(isMlEnabledInSpace: boolean): Tab[] {
 
 export const JobsListPage: FC<{
   coreStart: CoreStart;
+  share: SharePluginStart;
   history: ManagementAppMountParams['history'];
-}> = ({ coreStart, history }) => {
+}> = ({ coreStart, share, history }) => {
   const [initialized, setInitialized] = useState(false);
   const [accessDenied, setAccessDenied] = useState(false);
   const [isMlEnabledInSpace, setIsMlEnabledInSpace] = useState(false);
@@ -136,7 +138,7 @@ export const JobsListPage: FC<{
 
   return (
     <I18nContext>
-      <KibanaContextProvider services={{ ...coreStart }}>
+      <KibanaContextProvider services={{ ...coreStart, share }}>
         <Router history={history}>
           <EuiPageContent
             id="kibanaManagementMLSection"
diff --git a/x-pack/plugins/ml/public/application/management/jobs_list/index.ts b/x-pack/plugins/ml/public/application/management/jobs_list/index.ts
index afea5a573b8b5..422121e1845b2 100644
--- a/x-pack/plugins/ml/public/application/management/jobs_list/index.ts
+++ b/x-pack/plugins/ml/public/application/management/jobs_list/index.ts
@@ -13,13 +13,15 @@ import { JobsListPage } from './components';
 import { getJobsListBreadcrumbs } from '../breadcrumbs';
 import { setDependencyCache, clearCache } from '../../util/dependency_cache';
 import './_index.scss';
+import { SharePluginStart } from '../../../../../../../src/plugins/share/public';
 
 const renderApp = (
   element: HTMLElement,
   history: ManagementAppMountParams['history'],
-  coreStart: CoreStart
+  coreStart: CoreStart,
+  share: SharePluginStart
 ) => {
-  ReactDOM.render(React.createElement(JobsListPage, { coreStart, history }), element);
+  ReactDOM.render(React.createElement(JobsListPage, { coreStart, history, share }), element);
   return () => {
     unmountComponentAtNode(element);
     clearCache();
@@ -30,7 +32,7 @@ export async function mountApp(
   core: CoreSetup<MlStartDependencies>,
   params: ManagementAppMountParams
 ) {
-  const [coreStart] = await core.getStartServices();
+  const [coreStart, pluginsStart] = await core.getStartServices();
 
   setDependencyCache({
     docLinks: coreStart.docLinks!,
@@ -41,5 +43,5 @@ export async function mountApp(
 
   params.setBreadcrumbs(getJobsListBreadcrumbs());
 
-  return renderApp(params.element, params.history, coreStart);
+  return renderApp(params.element, params.history, coreStart, pluginsStart.share);
 }
diff --git a/x-pack/plugins/ml/public/application/ml_nodes_check/check_ml_nodes.ts b/x-pack/plugins/ml/public/application/ml_nodes_check/check_ml_nodes.ts
index 1792999eee4c2..d0cfd16d7562f 100644
--- a/x-pack/plugins/ml/public/application/ml_nodes_check/check_ml_nodes.ts
+++ b/x-pack/plugins/ml/public/application/ml_nodes_check/check_ml_nodes.ts
@@ -9,7 +9,7 @@ import { ml } from '../services/ml_api_service';
 let mlNodeCount: number = 0;
 let userHasPermissionToViewMlNodeCount: boolean = false;
 
-export async function checkMlNodesAvailable() {
+export async function checkMlNodesAvailable(redirectToJobsManagementPage: () => Promise<void>) {
   try {
     const nodes = await getMlNodeCount();
     if (nodes.count !== undefined && nodes.count > 0) {
@@ -20,7 +20,7 @@ export async function checkMlNodesAvailable() {
   } catch (error) {
     // eslint-disable-next-line no-console
     console.error(error);
-    window.location.href = '#/jobs';
+    await redirectToJobsManagementPage();
     Promise.reject();
   }
 }
diff --git a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/actions.tsx b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/actions.tsx
index 395a570083c0d..4f0cbc0adddf2 100644
--- a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/actions.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/actions.tsx
@@ -4,30 +4,23 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useCallback, FC } from 'react';
+import React, { FC, useMemo } from 'react';
 import { EuiToolTip, EuiButtonEmpty } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
-import { useNavigateToPath } from '../../../contexts/kibana';
+import { Link } from 'react-router-dom';
+import { useMlLink } from '../../../contexts/kibana';
 import { getAnalysisType } from '../../../data_frame_analytics/common/analytics';
-import {
-  getResultsUrl,
-  DataFrameAnalyticsListRow,
-} from '../../../data_frame_analytics/pages/analytics_management/components/analytics_list/common';
+import { DataFrameAnalyticsListRow } from '../../../data_frame_analytics/pages/analytics_management/components/analytics_list/common';
 import { getViewLinkStatus } from '../../../data_frame_analytics/pages/analytics_management/components/action_view/get_view_link_status';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
+import { DataFrameAnalysisConfigType } from '../../../../../common/types/data_frame_analytics';
 
 interface Props {
   item: DataFrameAnalyticsListRow;
 }
 
 export const ViewLink: FC<Props> = ({ item }) => {
-  const navigateToPath = useNavigateToPath();
-
-  const clickHandler = useCallback(() => {
-    const analysisType = getAnalysisType(item.config.analysis);
-    navigateToPath(getResultsUrl(item.id, analysisType));
-  }, []);
-
   const { disabled, tooltipContent } = getViewLinkStatus(item);
 
   const viewJobResultsButtonText = i18n.translate(
@@ -38,23 +31,34 @@ export const ViewLink: FC<Props> = ({ item }) => {
   );
 
   const tooltipText = disabled === false ? viewJobResultsButtonText : tooltipContent;
+  const analysisType = useMemo(() => getAnalysisType(item.config.analysis), [item]);
+
+  const viewAnalyticsResultsLink = useMlLink({
+    page: ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION,
+    pageState: {
+      jobId: item.id,
+      analysisType: analysisType as DataFrameAnalysisConfigType,
+    },
+    excludeBasePath: true,
+  });
 
   return (
     <EuiToolTip position="bottom" content={tooltipText}>
-      <EuiButtonEmpty
-        color="text"
-        size="xs"
-        onClick={clickHandler}
-        iconType="visTable"
-        aria-label={viewJobResultsButtonText}
-        className="results-button"
-        data-test-subj="mlOverviewAnalyticsJobViewButton"
-        isDisabled={disabled}
-      >
-        {i18n.translate('xpack.ml.overview.analytics.viewActionName', {
-          defaultMessage: 'View',
-        })}
-      </EuiButtonEmpty>
+      <Link to={viewAnalyticsResultsLink}>
+        <EuiButtonEmpty
+          color="text"
+          size="xs"
+          iconType="visTable"
+          aria-label={viewJobResultsButtonText}
+          className="results-button"
+          data-test-subj="mlOverviewAnalyticsJobViewButton"
+          isDisabled={disabled}
+        >
+          {i18n.translate('xpack.ml.overview.analytics.viewActionName', {
+            defaultMessage: 'View',
+          })}
+        </EuiButtonEmpty>
+      </Link>
     </EuiToolTip>
   );
 };
diff --git a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/analytics_panel.tsx b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/analytics_panel.tsx
index be8038cc5049d..4d810c47415a7 100644
--- a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/analytics_panel.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/analytics_panel.tsx
@@ -23,6 +23,8 @@ import { AnalyticsTable } from './table';
 import { getAnalyticsFactory } from '../../../data_frame_analytics/pages/analytics_management/services/analytics_service';
 import { DataFrameAnalyticsListRow } from '../../../data_frame_analytics/pages/analytics_management/components/analytics_list/common';
 import { AnalyticStatsBarStats, StatsBar } from '../../../components/stats_bar';
+import { useMlUrlGenerator, useNavigateToPath } from '../../../contexts/kibana';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
 
 interface Props {
   jobCreationDisabled: boolean;
@@ -35,6 +37,16 @@ export const AnalyticsPanel: FC<Props> = ({ jobCreationDisabled }) => {
   const [errorMessage, setErrorMessage] = useState<any>(undefined);
   const [isInitialized, setIsInitialized] = useState(false);
 
+  const mlUrlGenerator = useMlUrlGenerator();
+  const navigateToPath = useNavigateToPath();
+
+  const redirectToDataFrameAnalyticsManagementPage = async () => {
+    const path = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE,
+    });
+    await navigateToPath(path, true);
+  };
+
   const getAnalytics = getAnalyticsFactory(
     setAnalytics,
     setAnalyticsStats,
@@ -75,7 +87,6 @@ export const AnalyticsPanel: FC<Props> = ({ jobCreationDisabled }) => {
       {isInitialized === false && (
         <EuiLoadingSpinner className="mlOverviewPanel__spinner" size="xl" />
       )}
-          
       {errorMessage === undefined && isInitialized === true && analytics.length === 0 && (
         <EuiEmptyPrompt
           iconType="createAdvancedJob"
@@ -95,7 +106,7 @@ export const AnalyticsPanel: FC<Props> = ({ jobCreationDisabled }) => {
           }
           actions={
             <EuiButton
-              href="#/data_frame_analytics?"
+              onClick={redirectToDataFrameAnalyticsManagementPage}
               color="primary"
               fill
               iconType="plusInCircle"
@@ -111,6 +122,7 @@ export const AnalyticsPanel: FC<Props> = ({ jobCreationDisabled }) => {
       )}
       {isInitialized === true && analytics.length > 0 && (
         <>
+          <EuiSpacer />
           <EuiFlexGroup alignItems="center" justifyContent="spaceBetween">
             <EuiFlexItem grow={false}>
               <EuiText size="m">
@@ -136,7 +148,7 @@ export const AnalyticsPanel: FC<Props> = ({ jobCreationDisabled }) => {
                 defaultMessage: 'Refresh',
               })}
             </EuiButtonEmpty>
-            <EuiButton size="s" fill href="#/data_frame_analytics?">
+            <EuiButton size="s" fill onClick={redirectToDataFrameAnalyticsManagementPage}>
               {i18n.translate('xpack.ml.overview.analyticsList.manageJobsButtonText', {
                 defaultMessage: 'Manage jobs',
               })}
diff --git a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/actions.tsx b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/actions.tsx
index a71141d0356d0..dfba7c9651266 100644
--- a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/actions.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/actions.tsx
@@ -7,6 +7,7 @@
 import React, { FC } from 'react';
 import { EuiToolTip, EuiButtonEmpty } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
+import { Link } from 'react-router-dom';
 import { MlSummaryJobs } from '../../../../../common/types/anomaly_detection_jobs';
 import { useCreateADLinks } from '../../../components/custom_hooks/use_create_ad_links';
 
@@ -26,19 +27,20 @@ export const ExplorerLink: FC<Props> = ({ jobsList }) => {
 
   return (
     <EuiToolTip position="bottom" content={openJobsInAnomalyExplorerText}>
-      <EuiButtonEmpty
-        color="text"
-        size="xs"
-        href={createLinkWithUserDefaults('explorer', jobsList)}
-        iconType="visTable"
-        aria-label={openJobsInAnomalyExplorerText}
-        className="results-button"
-        data-test-subj={`openOverviewJobsInAnomalyExplorer`}
-      >
-        {i18n.translate('xpack.ml.overview.anomalyDetection.viewActionName', {
-          defaultMessage: 'View',
-        })}
-      </EuiButtonEmpty>
+      <Link to={createLinkWithUserDefaults('explorer', jobsList)}>
+        <EuiButtonEmpty
+          color="text"
+          size="xs"
+          iconType="visTable"
+          aria-label={openJobsInAnomalyExplorerText}
+          className="results-button"
+          data-test-subj={`openOverviewJobsInAnomalyExplorer`}
+        >
+          {i18n.translate('xpack.ml.overview.anomalyDetection.viewActionName', {
+            defaultMessage: 'View',
+          })}
+        </EuiButtonEmpty>
+      </Link>
     </EuiToolTip>
   );
 };
diff --git a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx
index 0bfd2c2e49232..1cb6bab7fd768 100644
--- a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx
@@ -16,12 +16,13 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import moment from 'moment';
-import { useMlKibana } from '../../../contexts/kibana';
+import { useMlKibana, useMlUrlGenerator, useNavigateToPath } from '../../../contexts/kibana';
 import { AnomalyDetectionTable } from './table';
 import { ml } from '../../../services/ml_api_service';
 import { getGroupsFromJobs, getStatsBarData, getJobsWithTimerange } from './utils';
 import { Dictionary } from '../../../../../common/types/common';
 import { MlSummaryJobs, MlSummaryJob } from '../../../../../common/types/anomaly_detection_jobs';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
 
 export type GroupsDictionary = Dictionary<Group>;
 
@@ -39,8 +40,6 @@ type MaxScoresByGroup = Dictionary<{
   index?: number;
 }>;
 
-const createJobLink = '#/jobs/new_job/step/index_or_search';
-
 function getDefaultAnomalyScores(groups: Group[]): MaxScoresByGroup {
   const anomalyScores: MaxScoresByGroup = {};
   groups.forEach((group) => {
@@ -58,6 +57,23 @@ export const AnomalyDetectionPanel: FC<Props> = ({ jobCreationDisabled }) => {
   const {
     services: { notifications },
   } = useMlKibana();
+  const mlUrlGenerator = useMlUrlGenerator();
+  const navigateToPath = useNavigateToPath();
+
+  const redirectToJobsManagementPage = async () => {
+    const path = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE,
+    });
+    await navigateToPath(path, true);
+  };
+
+  const redirectToCreateJobSelectIndexPage = async () => {
+    const path = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX,
+    });
+    await navigateToPath(path, true);
+  };
+
   const [isLoading, setIsLoading] = useState(false);
   const [groups, setGroups] = useState<GroupsDictionary>({});
   const [groupsCount, setGroupsCount] = useState<number>(0);
@@ -157,7 +173,7 @@ export const AnomalyDetectionPanel: FC<Props> = ({ jobCreationDisabled }) => {
   return (
     <EuiPanel className={panelClass}>
       {typeof errorMessage !== 'undefined' && errorDisplay}
-      {isLoading && <EuiLoadingSpinner className="mlOverviewPanel__spinner" size="xl" />}   
+      {isLoading && <EuiLoadingSpinner className="mlOverviewPanel__spinner" size="xl" />}
       {isLoading === false && typeof errorMessage === 'undefined' && groupsCount === 0 && (
         <EuiEmptyPrompt
           iconType="createSingleMetricJob"
@@ -180,7 +196,7 @@ export const AnomalyDetectionPanel: FC<Props> = ({ jobCreationDisabled }) => {
           actions={
             <EuiButton
               color="primary"
-              href={createJobLink}
+              onClick={redirectToCreateJobSelectIndexPage}
               fill
               iconType="plusInCircle"
               isDisabled={jobCreationDisabled}
@@ -203,7 +219,7 @@ export const AnomalyDetectionPanel: FC<Props> = ({ jobCreationDisabled }) => {
                 defaultMessage: 'Refresh',
               })}
             </EuiButtonEmpty>
-            <EuiButton size="s" fill href="#/jobs?">
+            <EuiButton size="s" fill onClick={redirectToJobsManagementPage}>
               {i18n.translate('xpack.ml.overview.anomalyDetection.manageJobsButtonText', {
                 defaultMessage: 'Manage jobs',
               })}
diff --git a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx
index 945116b0534bb..8515431d49b17 100644
--- a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx
@@ -88,7 +88,7 @@ export const AnomalyDetectionTable: FC<Props> = ({ items, jobsList, statsBarData
           <span>
             {i18n.translate('xpack.ml.overview.anomalyDetection.tableMaxScore', {
               defaultMessage: 'Max anomaly score',
-            })}{' '}
+            })}
             <EuiIcon size="s" color="subdued" type="questionInCircle" className="eui-alignTop" />
           </span>
         </EuiToolTip>
@@ -203,6 +203,7 @@ export const AnomalyDetectionTable: FC<Props> = ({ items, jobsList, statsBarData
 
   return (
     <Fragment>
+      <EuiSpacer />
       <EuiFlexGroup alignItems="center" justifyContent="spaceBetween">
         <EuiFlexItem grow={false}>
           <EuiText size="m">
diff --git a/x-pack/plugins/ml/public/application/routing/breadcrumbs.ts b/x-pack/plugins/ml/public/application/routing/breadcrumbs.ts
index d0a4f999af758..398ec5b4759d2 100644
--- a/x-pack/plugins/ml/public/application/routing/breadcrumbs.ts
+++ b/x-pack/plugins/ml/public/application/routing/breadcrumbs.ts
@@ -54,6 +54,20 @@ export const CREATE_JOB_BREADCRUMB: ChromeBreadcrumb = Object.freeze({
   href: '/jobs/new_job',
 });
 
+export const CALENDAR_MANAGEMENT_BREADCRUMB: ChromeBreadcrumb = Object.freeze({
+  text: i18n.translate('xpack.ml.settings.breadcrumbs.calendarManagementLabel', {
+    defaultMessage: 'Calendar management',
+  }),
+  href: '/settings/calendars_list',
+});
+
+export const FILTER_LISTS_BREADCRUMB: ChromeBreadcrumb = Object.freeze({
+  text: i18n.translate('xpack.ml.settings.breadcrumbs.filterListsLabel', {
+    defaultMessage: 'Filter lists',
+  }),
+  href: '/settings/filter_lists',
+});
+
 const breadcrumbs = {
   ML_BREADCRUMB,
   SETTINGS_BREADCRUMB,
@@ -61,6 +75,8 @@ const breadcrumbs = {
   DATA_FRAME_ANALYTICS_BREADCRUMB,
   DATA_VISUALIZER_BREADCRUMB,
   CREATE_JOB_BREADCRUMB,
+  CALENDAR_MANAGEMENT_BREADCRUMB,
+  FILTER_LISTS_BREADCRUMB,
 };
 type Breadcrumb = keyof typeof breadcrumbs;
 
@@ -76,10 +92,12 @@ export const breadcrumbOnClickFactory = (
 
 export const getBreadcrumbWithUrlForApp = (
   breadcrumbName: Breadcrumb,
-  navigateToPath: NavigateToPath
+  navigateToPath: NavigateToPath,
+  basePath: string
 ): EuiBreadcrumb => {
   return {
-    ...breadcrumbs[breadcrumbName],
+    text: breadcrumbs[breadcrumbName].text,
+    href: `${basePath}/app/ml${breadcrumbs[breadcrumbName].href}`,
     onClick: breadcrumbOnClickFactory(breadcrumbs[breadcrumbName].href, navigateToPath),
   };
 };
diff --git a/x-pack/plugins/ml/public/application/routing/resolvers.ts b/x-pack/plugins/ml/public/application/routing/resolvers.ts
index 958221df8a636..9cebb67166a66 100644
--- a/x-pack/plugins/ml/public/application/routing/resolvers.ts
+++ b/x-pack/plugins/ml/public/application/routing/resolvers.ts
@@ -21,13 +21,17 @@ export interface ResolverResults {
 
 interface BasicResolverDependencies {
   indexPatterns: IndexPatternsContract;
+  redirectToMlAccessDeniedPage: () => Promise<void>;
 }
 
-export const basicResolvers = ({ indexPatterns }: BasicResolverDependencies): Resolvers => ({
+export const basicResolvers = ({
+  indexPatterns,
+  redirectToMlAccessDeniedPage,
+}: BasicResolverDependencies): Resolvers => ({
   checkFullLicense,
   getMlNodeCount,
   loadMlServerInfo,
   loadIndexPatterns: () => loadIndexPatterns(indexPatterns),
-  checkGetJobsCapabilities: checkGetJobsCapabilitiesResolver,
+  checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
   loadSavedSearches,
 });
diff --git a/x-pack/plugins/ml/public/application/routing/router.tsx b/x-pack/plugins/ml/public/application/routing/router.tsx
index 22a17c4ea089a..7cb3a2f07c2ee 100644
--- a/x-pack/plugins/ml/public/application/routing/router.tsx
+++ b/x-pack/plugins/ml/public/application/routing/router.tsx
@@ -12,7 +12,7 @@ import { AppMountParameters, IUiSettingsClient, ChromeStart } from 'kibana/publi
 import { ChromeBreadcrumb } from 'kibana/public';
 import { IndexPatternsContract } from 'src/plugins/data/public';
 
-import { useNavigateToPath } from '../contexts/kibana';
+import { useMlKibana, useNavigateToPath } from '../contexts/kibana';
 import { MlContext, MlContextValue } from '../contexts/ml';
 import { UrlStateProvider } from '../util/url_state';
 
@@ -39,6 +39,7 @@ interface PageDependencies {
   history: AppMountParameters['history'];
   indexPatterns: IndexPatternsContract;
   setBreadcrumbs: ChromeStart['setBreadcrumbs'];
+  redirectToMlAccessDeniedPage: () => Promise<void>;
 }
 
 export const PageLoader: FC<{ context: MlContextValue }> = ({ context, children }) => {
@@ -75,10 +76,16 @@ const MlRoutes: FC<{
   pageDeps: PageDependencies;
 }> = ({ pageDeps }) => {
   const navigateToPath = useNavigateToPath();
+  const {
+    services: {
+      http: { basePath },
+    },
+  } = useMlKibana();
+
   return (
     <>
       {Object.entries(routes).map(([name, routeFactory]) => {
-        const route = routeFactory(navigateToPath);
+        const route = routeFactory(navigateToPath, basePath.get());
 
         return (
           <Route
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_creation.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_creation.tsx
index 4ce2abf3fef60..7e6969812da4c 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_creation.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_creation.tsx
@@ -18,11 +18,14 @@ import { Page } from '../../../data_frame_analytics/pages/analytics_creation';
 import { breadcrumbOnClickFactory, getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
 import { loadNewJobCapabilities } from '../../../services/new_job_capabilities_service';
 
-export const analyticsJobsCreationRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const analyticsJobsCreationRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/data_frame_analytics/new_job',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.dataFrameAnalyticsBreadcrumbs.dataFrameManagementLabel', {
         defaultMessage: 'Data Frame Analytics',
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx
index 47cc002ab4d83..f9f2ebe48f4aa 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx
@@ -10,21 +10,25 @@ import { decode } from 'rison-node';
 
 import { i18n } from '@kbn/i18n';
 
-import { NavigateToPath } from '../../../contexts/kibana';
+import { NavigateToPath, useMlKibana, useMlUrlGenerator } from '../../../contexts/kibana';
 
 import { MlRoute, PageLoader, PageProps } from '../../router';
 import { useResolver } from '../../use_resolver';
 import { basicResolvers } from '../../resolvers';
 import { Page } from '../../../data_frame_analytics/pages/analytics_exploration';
-import { ANALYSIS_CONFIG_TYPE } from '../../../data_frame_analytics/common/analytics';
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
+import { DataFrameAnalysisConfigType } from '../../../../../common/types/data_frame_analytics';
 
-export const analyticsJobExplorationRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const analyticsJobExplorationRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/data_frame_analytics/exploration',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('DATA_FRAME_ANALYTICS_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('DATA_FRAME_ANALYTICS_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.dataFrameAnalyticsBreadcrumbs.dataFrameExplorationLabel', {
         defaultMessage: 'Exploration',
@@ -38,16 +42,31 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
   const { context } = useResolver('', undefined, deps.config, basicResolvers(deps));
   const { _g }: Record<string, any> = parse(location.search, { sort: false });
 
+  const urlGenerator = useMlUrlGenerator();
+  const {
+    services: {
+      application: { navigateToUrl },
+    },
+  } = useMlKibana();
+
+  const redirectToAnalyticsManagementPage = async () => {
+    const url = await urlGenerator.createUrl({ page: ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE });
+    await navigateToUrl(url);
+  };
+
   let globalState: any = null;
   try {
     globalState = decode(_g);
   } catch (error) {
     // eslint-disable-next-line no-console
-    console.error('Could not parse global state');
-    window.location.href = '#data_frame_analytics';
+    console.error(
+      'Could not parse global state. Redirecting to Data Frame Analytics Management Page.'
+    );
+    redirectToAnalyticsManagementPage();
+    return <></>;
   }
   const jobId: string = globalState.ml.jobId;
-  const analysisType: ANALYSIS_CONFIG_TYPE = globalState.ml.analysisType;
+  const analysisType: DataFrameAnalysisConfigType = globalState.ml.analysisType;
 
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx
index b6ef9ea81b4ba..80706a82121d5 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx
@@ -15,12 +15,15 @@ import { basicResolvers } from '../../resolvers';
 import { Page } from '../../../data_frame_analytics/pages/analytics_management';
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
 
-export const analyticsJobsListRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const analyticsJobsListRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/data_frame_analytics',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('DATA_FRAME_ANALYTICS_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('DATA_FRAME_ANALYTICS_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.dataFrameAnalyticsBreadcrumbs.dataFrameListLabel', {
         defaultMessage: 'Job Management',
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/models_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/models_list.tsx
index 7bf7784d1b559..b1fd6e93a744c 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/models_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/models_list.tsx
@@ -15,12 +15,15 @@ import { basicResolvers } from '../../resolvers';
 import { Page } from '../../../data_frame_analytics/pages/analytics_management';
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
 
-export const modelsListRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const modelsListRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/data_frame_analytics/models',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('DATA_FRAME_ANALYTICS_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('DATA_FRAME_ANALYTICS_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.dataFrameAnalyticsBreadcrumbs.modelsListLabel', {
         defaultMessage: 'Model Management',
diff --git a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/datavisualizer.tsx b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/datavisualizer.tsx
index efe5c3cba04a5..f40b754a23ccb 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/datavisualizer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/datavisualizer.tsx
@@ -21,19 +21,25 @@ import { checkBasicLicense } from '../../../license';
 import { checkFindFileStructurePrivilegeResolver } from '../../../capabilities/check_capabilities';
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
 
-export const selectorRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const selectorRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/datavisualizer',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('DATA_VISUALIZER_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('DATA_VISUALIZER_BREADCRUMB', navigateToPath, basePath),
   ],
 });
 
 const PageWrapper: FC<PageProps> = ({ location, deps }) => {
+  const { redirectToMlAccessDeniedPage } = deps;
+
   const { context } = useResolver(undefined, undefined, deps.config, {
     checkBasicLicense,
-    checkFindFileStructurePrivilege: checkFindFileStructurePrivilegeResolver,
+    checkFindFileStructurePrivilege: () =>
+      checkFindFileStructurePrivilegeResolver(redirectToMlAccessDeniedPage),
   });
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx
index 485af52c45a55..837616a8a76d2 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx
@@ -24,12 +24,15 @@ import { loadIndexPatterns } from '../../../util/index_utils';
 
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
 
-export const fileBasedRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const fileBasedRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/filedatavisualizer',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('DATA_VISUALIZER_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('DATA_VISUALIZER_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.dataVisualizer.fileBasedLabel', {
         defaultMessage: 'File',
@@ -40,10 +43,13 @@ export const fileBasedRouteFactory = (navigateToPath: NavigateToPath): MlRoute =
 });
 
 const PageWrapper: FC<PageProps> = ({ location, deps }) => {
+  const { redirectToMlAccessDeniedPage } = deps;
+
   const { context } = useResolver('', undefined, deps.config, {
     checkBasicLicense,
     loadIndexPatterns: () => loadIndexPatterns(deps.indexPatterns),
-    checkFindFileStructurePrivilege: checkFindFileStructurePrivilegeResolver,
+    checkFindFileStructurePrivilege: () =>
+      checkFindFileStructurePrivilegeResolver(redirectToMlAccessDeniedPage),
   });
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/index_based.tsx b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/index_based.tsx
index 358b8773e3460..e3d0e5050fca5 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/index_based.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/index_based.tsx
@@ -20,13 +20,18 @@ import { checkGetJobsCapabilitiesResolver } from '../../../capabilities/check_ca
 import { loadIndexPatterns } from '../../../util/index_utils';
 import { checkMlNodesAvailable } from '../../../ml_nodes_check';
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
+import { useCreateAndNavigateToMlLink } from '../../../contexts/kibana/use_create_url';
 
-export const indexBasedRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const indexBasedRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/jobs/new_job/datavisualizer',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('DATA_VISUALIZER_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('DATA_VISUALIZER_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.dataFrameAnalyticsBreadcrumbs.indexLabel', {
         defaultMessage: 'Index',
@@ -37,12 +42,17 @@ export const indexBasedRouteFactory = (navigateToPath: NavigateToPath): MlRoute
 });
 
 const PageWrapper: FC<PageProps> = ({ location, deps }) => {
+  const { redirectToMlAccessDeniedPage } = deps;
+  const redirectToJobsManagementPage = useCreateAndNavigateToMlLink(
+    ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE
+  );
+
   const { index, savedSearchId }: Record<string, any> = parse(location.search, { sort: false });
   const { context } = useResolver(index, savedSearchId, deps.config, {
     checkBasicLicense,
     loadIndexPatterns: () => loadIndexPatterns(deps.indexPatterns),
-    checkGetJobsCapabilities: checkGetJobsCapabilitiesResolver,
-    checkMlNodesAvailable,
+    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+    checkMlNodesAvailable: () => checkMlNodesAvailable(redirectToJobsManagementPage),
   });
 
   return (
diff --git a/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx b/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
index 30b9bc2af219f..00d64a2f1bd1d 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
@@ -35,12 +35,15 @@ import { useTimefilter } from '../../contexts/kibana';
 import { isViewBySwimLaneData } from '../../explorer/swimlane_container';
 import { JOB_ID } from '../../../../common/constants/anomalies';
 
-export const explorerRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const explorerRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/explorer',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.anomalyDetection.anomalyExplorerLabel', {
         defaultMessage: 'Anomaly Explorer',
diff --git a/x-pack/plugins/ml/public/application/routing/routes/jobs_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/jobs_list.tsx
index 38a7900916ba8..2863e59508e35 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/jobs_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/jobs_list.tsx
@@ -20,12 +20,12 @@ import { JobsPage } from '../../jobs/jobs_list';
 import { useTimefilter } from '../../contexts/kibana';
 import { getBreadcrumbWithUrlForApp } from '../breadcrumbs';
 
-export const jobListRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const jobListRouteFactory = (navigateToPath: NavigateToPath, basePath: string): MlRoute => ({
   path: '/jobs',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.anomalyDetection.jobManagementLabel', {
         defaultMessage: 'Job Management',
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/index_or_search.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/index_or_search.tsx
index d8605c4cc9115..0ef3b384dcf5d 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/index_or_search.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/index_or_search.tsx
@@ -8,7 +8,7 @@ import React, { FC } from 'react';
 
 import { i18n } from '@kbn/i18n';
 
-import { NavigateToPath } from '../../../contexts/kibana';
+import { NavigateToPath, useMlKibana } from '../../../contexts/kibana';
 
 import { MlRoute, PageLoader, PageProps } from '../../router';
 import { useResolver } from '../../use_resolver';
@@ -19,6 +19,8 @@ import { checkBasicLicense } from '../../../license';
 import { loadIndexPatterns } from '../../../util/index_utils';
 import { checkGetJobsCapabilitiesResolver } from '../../../capabilities/check_capabilities';
 import { checkMlNodesAvailable } from '../../../ml_nodes_check';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
+import { useCreateAndNavigateToMlLink } from '../../../contexts/kibana/use_create_url';
 
 enum MODE {
   NEW_JOB,
@@ -30,9 +32,9 @@ interface IndexOrSearchPageProps extends PageProps {
   mode: MODE;
 }
 
-const getBreadcrumbs = (navigateToPath: NavigateToPath) => [
-  getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-  getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath),
+const getBreadcrumbs = (navigateToPath: NavigateToPath, basePath: string) => [
+  getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+  getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath, basePath),
   {
     text: i18n.translate('xpack.ml.jobsBreadcrumbs.selectIndexOrSearchLabel', {
       defaultMessage: 'Create job',
@@ -41,7 +43,10 @@ const getBreadcrumbs = (navigateToPath: NavigateToPath) => [
   },
 ];
 
-export const indexOrSearchRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const indexOrSearchRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/jobs/new_job/step/index_or_search',
   render: (props, deps) => (
     <PageWrapper
@@ -51,10 +56,13 @@ export const indexOrSearchRouteFactory = (navigateToPath: NavigateToPath): MlRou
       mode={MODE.NEW_JOB}
     />
   ),
-  breadcrumbs: getBreadcrumbs(navigateToPath),
+  breadcrumbs: getBreadcrumbs(navigateToPath, basePath),
 });
 
-export const dataVizIndexOrSearchRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const dataVizIndexOrSearchRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/datavisualizer_index_select',
   render: (props, deps) => (
     <PageWrapper
@@ -64,19 +72,31 @@ export const dataVizIndexOrSearchRouteFactory = (navigateToPath: NavigateToPath)
       mode={MODE.DATAVISUALIZER}
     />
   ),
-  breadcrumbs: getBreadcrumbs(navigateToPath),
+  breadcrumbs: getBreadcrumbs(navigateToPath, basePath),
 });
 
 const PageWrapper: FC<IndexOrSearchPageProps> = ({ nextStepPath, deps, mode }) => {
+  const {
+    services: {
+      http: { basePath },
+      application: { navigateToUrl },
+    },
+  } = useMlKibana();
+  const { redirectToMlAccessDeniedPage } = deps;
+  const redirectToJobsManagementPage = useCreateAndNavigateToMlLink(
+    ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE
+  );
+
   const newJobResolvers = {
     ...basicResolvers(deps),
-    preConfiguredJobRedirect: () => preConfiguredJobRedirect(deps.indexPatterns),
+    preConfiguredJobRedirect: () =>
+      preConfiguredJobRedirect(deps.indexPatterns, basePath.get(), navigateToUrl),
   };
   const dataVizResolvers = {
     checkBasicLicense,
     loadIndexPatterns: () => loadIndexPatterns(deps.indexPatterns),
-    checkGetJobsCapabilities: checkGetJobsCapabilitiesResolver,
-    checkMlNodesAvailable,
+    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+    checkMlNodesAvailable: () => checkMlNodesAvailable(redirectToJobsManagementPage),
   };
 
   const { context } = useResolver(
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/job_type.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/job_type.tsx
index b8ab29d40fa1f..543e01fbd326d 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/job_type.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/job_type.tsx
@@ -17,12 +17,12 @@ import { basicResolvers } from '../../resolvers';
 import { Page } from '../../../jobs/new_job/pages/job_type';
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
 
-export const jobTypeRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const jobTypeRouteFactory = (navigateToPath: NavigateToPath, basePath: string): MlRoute => ({
   path: '/jobs/new_job/step/job_type',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.jobsBreadcrumbs.selectJobType', {
         defaultMessage: 'Create job',
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/recognize.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/recognize.tsx
index 6be58828ee1a5..654d7184cfcf2 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/recognize.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/recognize.tsx
@@ -9,7 +9,7 @@ import React, { FC } from 'react';
 
 import { i18n } from '@kbn/i18n';
 
-import { NavigateToPath } from '../../../contexts/kibana';
+import { NavigateToPath, useNavigateToPath } from '../../../contexts/kibana';
 
 import { MlRoute, PageLoader, PageProps } from '../../router';
 import { useResolver } from '../../use_resolver';
@@ -18,14 +18,18 @@ import { Page } from '../../../jobs/new_job/recognize';
 import { checkViewOrCreateJobs } from '../../../jobs/new_job/recognize/resolvers';
 import { mlJobService } from '../../../services/job_service';
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
+import { useCreateADLinks } from '../../../components/custom_hooks/use_create_ad_links';
 
-export const recognizeRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const recognizeRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/jobs/new_job/recognize',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('CREATE_JOB_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('CREATE_JOB_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.jobsBreadcrumbs.selectIndexOrSearchLabelRecognize', {
         defaultMessage: 'Recognized index',
@@ -60,10 +64,14 @@ const CheckViewOrCreateWrapper: FC<PageProps> = ({ location, deps }) => {
   const { id: moduleId, index: indexPatternId }: Record<string, any> = parse(location.search, {
     sort: false,
   });
+  const { createLinkWithUserDefaults } = useCreateADLinks();
+
+  const navigateToPath = useNavigateToPath();
 
   // the single resolver checkViewOrCreateJobs redirects only. so will always reject
   useResolver(undefined, undefined, deps.config, {
-    checkViewOrCreateJobs: () => checkViewOrCreateJobs(moduleId, indexPatternId),
+    checkViewOrCreateJobs: () =>
+      checkViewOrCreateJobs(moduleId, indexPatternId, createLinkWithUserDefaults, navigateToPath),
   });
   return null;
 };
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/wizard.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/wizard.tsx
index 35085fd557577..8a82a9a8dbc49 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/wizard.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/wizard.tsx
@@ -19,19 +19,21 @@ import { mlJobService } from '../../../services/job_service';
 import { loadNewJobCapabilities } from '../../../services/new_job_capabilities_service';
 import { checkCreateJobsCapabilitiesResolver } from '../../../capabilities/check_capabilities';
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
+import { useCreateAndNavigateToMlLink } from '../../../contexts/kibana/use_create_url';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
 
 interface WizardPageProps extends PageProps {
   jobType: JOB_TYPE;
 }
 
-const getBaseBreadcrumbs = (navigateToPath: NavigateToPath) => [
-  getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-  getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath),
-  getBreadcrumbWithUrlForApp('CREATE_JOB_BREADCRUMB', navigateToPath),
+const getBaseBreadcrumbs = (navigateToPath: NavigateToPath, basePath: string) => [
+  getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+  getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath, basePath),
+  getBreadcrumbWithUrlForApp('CREATE_JOB_BREADCRUMB', navigateToPath, basePath),
 ];
 
-const getSingleMetricBreadcrumbs = (navigateToPath: NavigateToPath) => [
-  ...getBaseBreadcrumbs(navigateToPath),
+const getSingleMetricBreadcrumbs = (navigateToPath: NavigateToPath, basePath: string) => [
+  ...getBaseBreadcrumbs(navigateToPath, basePath),
   {
     text: i18n.translate('xpack.ml.jobsBreadcrumbs.singleMetricLabel', {
       defaultMessage: 'Single metric',
@@ -40,8 +42,8 @@ const getSingleMetricBreadcrumbs = (navigateToPath: NavigateToPath) => [
   },
 ];
 
-const getMultiMetricBreadcrumbs = (navigateToPath: NavigateToPath) => [
-  ...getBaseBreadcrumbs(navigateToPath),
+const getMultiMetricBreadcrumbs = (navigateToPath: NavigateToPath, basePath: string) => [
+  ...getBaseBreadcrumbs(navigateToPath, basePath),
   {
     text: i18n.translate('xpack.ml.jobsBreadcrumbs.multiMetricLabel', {
       defaultMessage: 'Multi-metric',
@@ -50,8 +52,8 @@ const getMultiMetricBreadcrumbs = (navigateToPath: NavigateToPath) => [
   },
 ];
 
-const getPopulationBreadcrumbs = (navigateToPath: NavigateToPath) => [
-  ...getBaseBreadcrumbs(navigateToPath),
+const getPopulationBreadcrumbs = (navigateToPath: NavigateToPath, basePath: string) => [
+  ...getBaseBreadcrumbs(navigateToPath, basePath),
   {
     text: i18n.translate('xpack.ml.jobsBreadcrumbs.populationLabel', {
       defaultMessage: 'Population',
@@ -60,8 +62,8 @@ const getPopulationBreadcrumbs = (navigateToPath: NavigateToPath) => [
   },
 ];
 
-const getAdvancedBreadcrumbs = (navigateToPath: NavigateToPath) => [
-  ...getBaseBreadcrumbs(navigateToPath),
+const getAdvancedBreadcrumbs = (navigateToPath: NavigateToPath, basePath: string) => [
+  ...getBaseBreadcrumbs(navigateToPath, basePath),
   {
     text: i18n.translate('xpack.ml.jobsBreadcrumbs.advancedConfigurationLabel', {
       defaultMessage: 'Advanced configuration',
@@ -70,8 +72,8 @@ const getAdvancedBreadcrumbs = (navigateToPath: NavigateToPath) => [
   },
 ];
 
-const getCategorizationBreadcrumbs = (navigateToPath: NavigateToPath) => [
-  ...getBaseBreadcrumbs(navigateToPath),
+const getCategorizationBreadcrumbs = (navigateToPath: NavigateToPath, basePath: string) => [
+  ...getBaseBreadcrumbs(navigateToPath, basePath),
   {
     text: i18n.translate('xpack.ml.jobsBreadcrumbs.categorizationLabel', {
       defaultMessage: 'Categorization',
@@ -80,41 +82,60 @@ const getCategorizationBreadcrumbs = (navigateToPath: NavigateToPath) => [
   },
 ];
 
-export const singleMetricRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const singleMetricRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/jobs/new_job/single_metric',
   render: (props, deps) => <PageWrapper {...props} jobType={JOB_TYPE.SINGLE_METRIC} deps={deps} />,
-  breadcrumbs: getSingleMetricBreadcrumbs(navigateToPath),
+  breadcrumbs: getSingleMetricBreadcrumbs(navigateToPath, basePath),
 });
 
-export const multiMetricRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const multiMetricRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/jobs/new_job/multi_metric',
   render: (props, deps) => <PageWrapper {...props} jobType={JOB_TYPE.MULTI_METRIC} deps={deps} />,
-  breadcrumbs: getMultiMetricBreadcrumbs(navigateToPath),
+  breadcrumbs: getMultiMetricBreadcrumbs(navigateToPath, basePath),
 });
 
-export const populationRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const populationRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/jobs/new_job/population',
   render: (props, deps) => <PageWrapper {...props} jobType={JOB_TYPE.POPULATION} deps={deps} />,
-  breadcrumbs: getPopulationBreadcrumbs(navigateToPath),
+  breadcrumbs: getPopulationBreadcrumbs(navigateToPath, basePath),
 });
 
-export const advancedRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const advancedRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/jobs/new_job/advanced',
   render: (props, deps) => <PageWrapper {...props} jobType={JOB_TYPE.ADVANCED} deps={deps} />,
-  breadcrumbs: getAdvancedBreadcrumbs(navigateToPath),
+  breadcrumbs: getAdvancedBreadcrumbs(navigateToPath, basePath),
 });
 
-export const categorizationRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const categorizationRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/jobs/new_job/categorization',
   render: (props, deps) => <PageWrapper {...props} jobType={JOB_TYPE.CATEGORIZATION} deps={deps} />,
-  breadcrumbs: getCategorizationBreadcrumbs(navigateToPath),
+  breadcrumbs: getCategorizationBreadcrumbs(navigateToPath, basePath),
 });
 
 const PageWrapper: FC<WizardPageProps> = ({ location, jobType, deps }) => {
+  const redirectToJobsManagementPage = useCreateAndNavigateToMlLink(
+    ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE
+  );
+
   const { index, savedSearchId }: Record<string, any> = parse(location.search, { sort: false });
   const { context, results } = useResolver(index, savedSearchId, deps.config, {
     ...basicResolvers(deps),
-    privileges: checkCreateJobsCapabilitiesResolver,
+    privileges: () => checkCreateJobsCapabilitiesResolver(redirectToJobsManagementPage),
     jobCaps: () => loadNewJobCapabilities(index, savedSearchId, deps.indexPatterns),
     existingJobsAndGroups: mlJobService.getJobAndGroupIds,
   });
diff --git a/x-pack/plugins/ml/public/application/routing/routes/overview.tsx b/x-pack/plugins/ml/public/application/routing/routes/overview.tsx
index 174e9804b9689..0e07b0edfbe56 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/overview.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/overview.tsx
@@ -22,11 +22,14 @@ import { loadMlServerInfo } from '../../services/ml_server_info';
 import { useTimefilter } from '../../contexts/kibana';
 import { breadcrumbOnClickFactory, getBreadcrumbWithUrlForApp } from '../breadcrumbs';
 
-export const overviewRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const overviewRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/overview',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.overview.overviewLabel', {
         defaultMessage: 'Overview',
@@ -37,9 +40,11 @@ export const overviewRouteFactory = (navigateToPath: NavigateToPath): MlRoute =>
 });
 
 const PageWrapper: FC<PageProps> = ({ deps }) => {
+  const { redirectToMlAccessDeniedPage } = deps;
+
   const { context } = useResolver(undefined, undefined, deps.config, {
     checkFullLicense,
-    checkGetJobsCapabilities: checkGetJobsCapabilitiesResolver,
+    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
     getMlNodeCount,
     loadMlServerInfo,
   });
@@ -52,7 +57,7 @@ const PageWrapper: FC<PageProps> = ({ deps }) => {
   );
 };
 
-export const appRootRouteFactory = (): MlRoute => ({
+export const appRootRouteFactory = (navigateToPath: NavigateToPath, basePath: string): MlRoute => ({
   path: '/',
   render: () => <Page />,
   breadcrumbs: [],
diff --git a/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_list.tsx
index f2ae57f1ec961..2460971239618 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_list.tsx
@@ -10,7 +10,6 @@
  */
 
 import React, { FC } from 'react';
-import { i18n } from '@kbn/i18n';
 
 import { NavigateToPath } from '../../../contexts/kibana';
 
@@ -25,27 +24,27 @@ import {
 } from '../../../capabilities/check_capabilities';
 import { getMlNodeCount } from '../../../ml_nodes_check/check_ml_nodes';
 import { CalendarsList } from '../../../settings/calendars';
-import { breadcrumbOnClickFactory, getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
+import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
 
-export const calendarListRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const calendarListRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/settings/calendars_list',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath),
-    {
-      text: i18n.translate('xpack.ml.settings.breadcrumbs.calendarManagementLabel', {
-        defaultMessage: 'Calendar management',
-      }),
-      onClick: breadcrumbOnClickFactory('/settings/calendars_list', navigateToPath),
-    },
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('CALENDAR_MANAGEMENT_BREADCRUMB', navigateToPath, basePath),
   ],
 });
 
 const PageWrapper: FC<PageProps> = ({ deps }) => {
+  const { redirectToMlAccessDeniedPage } = deps;
+
   const { context } = useResolver(undefined, undefined, deps.config, {
     checkFullLicense,
-    checkGetJobsCapabilities: checkGetJobsCapabilitiesResolver,
+    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
     getMlNodeCount,
   });
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_new_edit.tsx b/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_new_edit.tsx
index a5c30e1eaaacc..4e0a8340590a4 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_new_edit.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_new_edit.tsx
@@ -26,6 +26,8 @@ import {
 import { checkMlNodesAvailable } from '../../../ml_nodes_check/check_ml_nodes';
 import { NewCalendar } from '../../../settings/calendars';
 import { breadcrumbOnClickFactory, getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
+import { useCreateAndNavigateToMlLink } from '../../../contexts/kibana/use_create_url';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
 
 enum MODE {
   NEW,
@@ -36,12 +38,16 @@ interface NewCalendarPageProps extends PageProps {
   mode: MODE;
 }
 
-export const newCalendarRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const newCalendarRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/settings/calendars_list/new_calendar',
   render: (props, deps) => <PageWrapper {...props} deps={deps} mode={MODE.NEW} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('CALENDAR_MANAGEMENT_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.settings.breadcrumbs.calendarManagement.createLabel', {
         defaultMessage: 'Create',
@@ -51,12 +57,16 @@ export const newCalendarRouteFactory = (navigateToPath: NavigateToPath): MlRoute
   ],
 });
 
-export const editCalendarRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const editCalendarRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/settings/calendars_list/edit_calendar/:calendarId',
   render: (props, deps) => <PageWrapper {...props} deps={deps} mode={MODE.EDIT} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('CALENDAR_MANAGEMENT_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.settings.breadcrumbs.calendarManagement.editLabel', {
         defaultMessage: 'Edit',
@@ -72,11 +82,15 @@ const PageWrapper: FC<NewCalendarPageProps> = ({ location, mode, deps }) => {
     const pathMatch: string[] | null = location.pathname.match(/.+\/(.+)$/);
     calendarId = pathMatch && pathMatch.length > 1 ? pathMatch[1] : undefined;
   }
+  const { redirectToMlAccessDeniedPage } = deps;
+  const redirectToJobsManagementPage = useCreateAndNavigateToMlLink(
+    ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE
+  );
 
   const { context } = useResolver(undefined, undefined, deps.config, {
     checkFullLicense,
-    checkGetJobsCapabilities: checkGetJobsCapabilitiesResolver,
-    checkMlNodesAvailable,
+    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+    checkMlNodesAvailable: () => checkMlNodesAvailable(redirectToJobsManagementPage),
   });
 
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: false });
diff --git a/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list.tsx
index d734e18d72bab..4e39cfce82e36 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list.tsx
@@ -10,7 +10,6 @@
  */
 
 import React, { FC } from 'react';
-import { i18n } from '@kbn/i18n';
 
 import { NavigateToPath } from '../../../contexts/kibana';
 
@@ -26,27 +25,27 @@ import {
 import { getMlNodeCount } from '../../../ml_nodes_check/check_ml_nodes';
 import { FilterLists } from '../../../settings/filter_lists';
 
-import { breadcrumbOnClickFactory, getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
+import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
 
-export const filterListRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const filterListRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/settings/filter_lists',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath),
-    {
-      text: i18n.translate('xpack.ml.settings.breadcrumbs.filterListsLabel', {
-        defaultMessage: 'Filter lists',
-      }),
-      onClick: breadcrumbOnClickFactory('/settings/filter_lists', navigateToPath),
-    },
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('FILTER_LISTS_BREADCRUMB', navigateToPath, basePath),
   ],
 });
 
 const PageWrapper: FC<PageProps> = ({ deps }) => {
+  const { redirectToMlAccessDeniedPage } = deps;
+
   const { context } = useResolver(undefined, undefined, deps.config, {
     checkFullLicense,
-    checkGetJobsCapabilities: checkGetJobsCapabilitiesResolver,
+    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
     getMlNodeCount,
   });
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list_new_edit.tsx b/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list_new_edit.tsx
index c6f17bc7f6f68..5fe56b024e413 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list_new_edit.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list_new_edit.tsx
@@ -27,6 +27,8 @@ import { checkMlNodesAvailable } from '../../../ml_nodes_check/check_ml_nodes';
 import { EditFilterList } from '../../../settings/filter_lists';
 
 import { breadcrumbOnClickFactory, getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
+import { useCreateAndNavigateToMlLink } from '../../../contexts/kibana/use_create_url';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
 
 enum MODE {
   NEW,
@@ -37,12 +39,17 @@ interface NewFilterPageProps extends PageProps {
   mode: MODE;
 }
 
-export const newFilterListRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const newFilterListRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/settings/filter_lists/new_filter_list',
   render: (props, deps) => <PageWrapper {...props} mode={MODE.NEW} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('FILTER_LISTS_BREADCRUMB', navigateToPath, basePath),
+
     {
       text: i18n.translate('xpack.ml.settings.breadcrumbs.filterLists.createLabel', {
         defaultMessage: 'Create',
@@ -52,12 +59,16 @@ export const newFilterListRouteFactory = (navigateToPath: NavigateToPath): MlRou
   ],
 });
 
-export const editFilterListRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const editFilterListRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/settings/filter_lists/edit_filter_list/:filterId',
   render: (props, deps) => <PageWrapper {...props} mode={MODE.EDIT} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('FILTER_LISTS_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.settings.breadcrumbs.filterLists.editLabel', {
         defaultMessage: 'Edit',
@@ -73,11 +84,15 @@ const PageWrapper: FC<NewFilterPageProps> = ({ location, mode, deps }) => {
     const pathMatch: string[] | null = location.pathname.match(/.+\/(.+)$/);
     filterId = pathMatch && pathMatch.length > 1 ? pathMatch[1] : undefined;
   }
+  const { redirectToMlAccessDeniedPage } = deps;
+  const redirectToJobsManagementPage = useCreateAndNavigateToMlLink(
+    ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE
+  );
 
   const { context } = useResolver(undefined, undefined, deps.config, {
     checkFullLicense,
-    checkGetJobsCapabilities: checkGetJobsCapabilitiesResolver,
-    checkMlNodesAvailable,
+    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+    checkMlNodesAvailable: () => checkMlNodesAvailable(redirectToJobsManagementPage),
   });
 
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: false });
diff --git a/x-pack/plugins/ml/public/application/routing/routes/settings/settings.tsx b/x-pack/plugins/ml/public/application/routing/routes/settings/settings.tsx
index 3f4b269851469..3159c2ae88166 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/settings/settings.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/settings/settings.tsx
@@ -26,19 +26,24 @@ import { getMlNodeCount } from '../../../ml_nodes_check/check_ml_nodes';
 import { AnomalyDetectionSettingsContext, Settings } from '../../../settings';
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
 
-export const settingsRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const settingsRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/settings',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('SETTINGS_BREADCRUMB', navigateToPath, basePath),
   ],
 });
 
 const PageWrapper: FC<PageProps> = ({ deps }) => {
+  const { redirectToMlAccessDeniedPage } = deps;
+
   const { context } = useResolver(undefined, undefined, deps.config, {
     checkFullLicense,
-    checkGetJobsCapabilities: checkGetJobsCapabilitiesResolver,
+    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
     getMlNodeCount,
   });
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.test.tsx b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.test.tsx
index 11ec074bac1db..b60a265560455 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.test.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.test.tsx
@@ -19,6 +19,11 @@ jest.mock('../../contexts/kibana/kibana_context', () => {
     useMlKibana: () => {
       return {
         services: {
+          chrome: { docTitle: { change: jest.fn() } },
+          application: { getUrlForApp: jest.fn(), navigateToUrl: jest.fn() },
+          share: {
+            urlGenerators: { getUrlGenerator: jest.fn() },
+          },
           uiSettings: { get: jest.fn() },
           data: {
             query: {
diff --git a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
index 817c975415997..03588872d6be0 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
@@ -39,12 +39,15 @@ import { basicResolvers } from '../resolvers';
 import { getBreadcrumbWithUrlForApp } from '../breadcrumbs';
 import { useTimefilter } from '../../contexts/kibana';
 
-export const timeSeriesExplorerRouteFactory = (navigateToPath: NavigateToPath): MlRoute => ({
+export const timeSeriesExplorerRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
   path: '/timeseriesexplorer',
   render: (props, deps) => <PageWrapper {...props} deps={deps} />,
   breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath),
-    getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath),
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    getBreadcrumbWithUrlForApp('ANOMALY_DETECTION_BREADCRUMB', navigateToPath, basePath),
     {
       text: i18n.translate('xpack.ml.anomalyDetection.singleMetricViewerLabel', {
         defaultMessage: 'Single Metric Viewer',
diff --git a/x-pack/plugins/ml/public/application/routing/use_resolver.ts b/x-pack/plugins/ml/public/application/routing/use_resolver.ts
index 4967e3a684a6b..e4cd90145bee4 100644
--- a/x-pack/plugins/ml/public/application/routing/use_resolver.ts
+++ b/x-pack/plugins/ml/public/application/routing/use_resolver.ts
@@ -16,6 +16,8 @@ import { createSearchItems } from '../jobs/new_job/utils/new_job_utils';
 import { ResolverResults, Resolvers } from './resolvers';
 import { MlContextValue } from '../contexts/ml';
 import { useNotifications } from '../contexts/kibana';
+import { useCreateAndNavigateToMlLink } from '../contexts/kibana/use_create_url';
+import { ML_PAGES } from '../../../common/constants/ml_url_generator';
 
 export const useResolver = (
   indexPatternId: string | undefined,
@@ -34,6 +36,9 @@ export const useResolver = (
 
   const [context, setContext] = useState<any | null>(null);
   const [results, setResults] = useState(tempResults);
+  const redirectToJobsManagementPage = useCreateAndNavigateToMlLink(
+    ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE
+  );
 
   useEffect(() => {
     (async () => {
@@ -73,7 +78,7 @@ export const useResolver = (
               defaultMessage: 'An error has occurred',
             }),
           });
-          window.location.href = '#/';
+          await redirectToJobsManagementPage();
         }
       } else {
         setContext({});
diff --git a/x-pack/plugins/ml/public/application/services/job_service.js b/x-pack/plugins/ml/public/application/services/job_service.js
index dfa1b5f4e68cd..ea97492ae0f5a 100644
--- a/x-pack/plugins/ml/public/application/services/job_service.js
+++ b/x-pack/plugins/ml/public/application/services/job_service.js
@@ -797,7 +797,6 @@ function createResultsUrl(jobIds, start, end, resultsPage, mode = 'absolute') {
   let path = '';
 
   if (resultsPage !== undefined) {
-    path += '#/';
     path += resultsPage;
   }
 
diff --git a/x-pack/plugins/ml/public/application/settings/anomaly_detection_settings.tsx b/x-pack/plugins/ml/public/application/settings/anomaly_detection_settings.tsx
index 16d7e1605263c..57caa56b2f10e 100644
--- a/x-pack/plugins/ml/public/application/settings/anomaly_detection_settings.tsx
+++ b/x-pack/plugins/ml/public/application/settings/anomaly_detection_settings.tsx
@@ -25,6 +25,8 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { AnomalyDetectionSettingsContext } from './anomaly_detection_settings_context';
 import { useNotifications } from '../contexts/kibana';
 import { ml } from '../services/ml_api_service';
+import { ML_PAGES } from '../../../common/constants/ml_url_generator';
+import { useCreateAndNavigateToMlLink } from '../contexts/kibana/use_create_url';
 
 export const AnomalyDetectionSettings: FC = () => {
   const [calendarsCount, setCalendarsCount] = useState(0);
@@ -35,6 +37,10 @@ export const AnomalyDetectionSettings: FC = () => {
   );
 
   const { toasts } = useNotifications();
+  const redirectToCalendarList = useCreateAndNavigateToMlLink(ML_PAGES.CALENDARS_MANAGE);
+  const redirectToNewCalendarPage = useCreateAndNavigateToMlLink(ML_PAGES.CALENDARS_NEW);
+  const redirectToFilterLists = useCreateAndNavigateToMlLink(ML_PAGES.FILTER_LISTS_MANAGE);
+  const redirectToNewFilterListPage = useCreateAndNavigateToMlLink(ML_PAGES.FILTER_LISTS_NEW);
 
   useEffect(() => {
     loadSummaryStats();
@@ -126,7 +132,7 @@ export const AnomalyDetectionSettings: FC = () => {
                   flush="left"
                   size="l"
                   color="primary"
-                  href="#/settings/calendars_list"
+                  onClick={redirectToCalendarList}
                   isDisabled={canGetCalendars === false}
                 >
                   <FormattedMessage
@@ -141,7 +147,7 @@ export const AnomalyDetectionSettings: FC = () => {
                   flush="left"
                   size="l"
                   color="primary"
-                  href="#/settings/calendars_list/new_calendar"
+                  onClick={redirectToNewCalendarPage}
                   isDisabled={canCreateCalendar === false}
                 >
                   <FormattedMessage
@@ -167,7 +173,7 @@ export const AnomalyDetectionSettings: FC = () => {
                 <p>
                   <FormattedMessage
                     id="xpack.ml.settings.anomalyDetection.filterListsText"
-                    defaultMessage=" Filter lists contain values that you can use to include or exclude events from the machine learning analysis."
+                    defaultMessage="Filter lists contain values that you can use to include or exclude events from the machine learning analysis."
                   />
                 </p>
               </EuiTextColor>
@@ -194,7 +200,7 @@ export const AnomalyDetectionSettings: FC = () => {
                   flush="left"
                   size="l"
                   color="primary"
-                  href="#/settings/filter_lists"
+                  onClick={redirectToFilterLists}
                   isDisabled={canGetFilters === false}
                 >
                   <FormattedMessage
@@ -208,7 +214,7 @@ export const AnomalyDetectionSettings: FC = () => {
                   data-test-subj="mlFilterListsCreateButton"
                   size="l"
                   color="primary"
-                  href="#/settings/filter_lists/new_filter_list"
+                  onClick={redirectToNewFilterListPage}
                   isDisabled={canCreateFilter === false}
                 >
                   <FormattedMessage
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/__snapshots__/calendar_form.test.js.snap b/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/__snapshots__/calendar_form.test.js.snap
index 96ca77e91279b..fed435d47dfc6 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/__snapshots__/calendar_form.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/__snapshots__/calendar_form.test.js.snap
@@ -88,6 +88,7 @@ exports[`CalendarForm Renders calendar form 1`] = `
     size="xl"
   />
   <EuiSwitch
+    checked={false}
     data-test-subj="mlCalendarApplyToAllJobsSwitch"
     disabled={false}
     label={
@@ -99,6 +100,68 @@ exports[`CalendarForm Renders calendar form 1`] = `
     }
     name="switch"
   />
+  <EuiSpacer
+    size="m"
+  />
+  <EuiFormRow
+    describedByIds={Array []}
+    display="row"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    label={
+      <FormattedMessage
+        defaultMessage="Jobs"
+        id="xpack.ml.calendarsEdit.calendarForm.jobsLabel"
+        values={Object {}}
+      />
+    }
+    labelType="label"
+  >
+    <EuiComboBox
+      async={false}
+      compressed={false}
+      data-test-subj="mlCalendarJobSelection"
+      fullWidth={false}
+      isClearable={true}
+      isDisabled={false}
+      onChange={[MockFunction]}
+      options={Array []}
+      selectedOptions={Array []}
+      singleSelection={false}
+      sortMatchesBy="none"
+    />
+  </EuiFormRow>
+  <EuiFormRow
+    describedByIds={Array []}
+    display="row"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    label={
+      <FormattedMessage
+        defaultMessage="Groups"
+        id="xpack.ml.calendarsEdit.calendarForm.groupsLabel"
+        values={Object {}}
+      />
+    }
+    labelType="label"
+  >
+    <EuiComboBox
+      async={false}
+      compressed={false}
+      data-test-subj="mlCalendarJobGroupSelection"
+      fullWidth={false}
+      isClearable={true}
+      isDisabled={false}
+      onChange={[MockFunction]}
+      onCreateOption={[MockFunction]}
+      options={Array []}
+      selectedOptions={Array []}
+      singleSelection={false}
+      sortMatchesBy="none"
+    />
+  </EuiFormRow>
   <EuiSpacer
     size="xl"
   />
@@ -137,7 +200,6 @@ exports[`CalendarForm Renders calendar form 1`] = `
       grow={false}
     >
       <EuiButton
-        href="#/settings/calendars_list"
         isDisabled={false}
       >
         <FormattedMessage
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.js b/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.js
index 7644346e26383..cfda1f415c2e8 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.js
@@ -25,6 +25,8 @@ import { EventsTable } from '../events_table';
 
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { ML_PAGES } from '../../../../../../common/constants/ml_url_generator';
+import { useCreateAndNavigateToMlLink } from '../../../../contexts/kibana/use_create_url';
 
 function EditHeader({ calendarId, description }) {
   return (
@@ -81,6 +83,7 @@ export const CalendarForm = ({
   const error = isNewCalendarIdValid === false && !isEdit ? [msg] : undefined;
   const saveButtonDisabled =
     canCreateCalendar === false || saving || !isNewCalendarIdValid || calendarId === '';
+  const redirectToCalendarsManagementPage = useCreateAndNavigateToMlLink(ML_PAGES.CALENDARS_MANAGE);
 
   return (
     <EuiForm>
@@ -215,7 +218,7 @@ export const CalendarForm = ({
       <EuiSpacer size="l" />
       <EuiFlexGroup justifyContent="flexEnd">
         <EuiFlexItem grow={false}>
-          <EuiButton isDisabled={saving} href={'#/settings/calendars_list'}>
+          <EuiButton isDisabled={saving} onClick={redirectToCalendarsManagementPage}>
             <FormattedMessage
               id="xpack.ml.calendarsEdit.calendarForm.cancelButtonLabel"
               defaultMessage="Cancel"
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.test.js b/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.test.js
index bc055bffe9973..54a6cdfea7b4f 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.test.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.test.js
@@ -8,6 +8,9 @@ import { shallowWithIntl, mountWithIntl } from 'test_utils/enzyme_helpers';
 import React from 'react';
 import { CalendarForm } from './calendar_form';
 
+jest.mock('../../../../contexts/kibana/use_create_url', () => ({
+  useCreateAndNavigateToMlLink: jest.fn(),
+}));
 const testProps = {
   calendarId: '',
   canCreateCalendar: true,
@@ -31,6 +34,7 @@ const testProps = {
   selectedGroupOptions: [],
   selectedJobOptions: [],
   showNewEventModal: jest.fn(),
+  isGlobalCalendar: false,
 };
 
 describe('CalendarForm', () => {
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.js b/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.js
index 1fe16e4588bd7..a5eb212ba127e 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.js
@@ -20,6 +20,7 @@ import { ImportModal } from './import_modal';
 import { ml } from '../../../services/ml_api_service';
 import { withKibana } from '../../../../../../../../src/plugins/kibana_react/public';
 import { GLOBAL_CALENDAR } from '../../../../../common/constants/calendars';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
 
 class NewCalendarUI extends Component {
   static propTypes = {
@@ -55,6 +56,16 @@ class NewCalendarUI extends Component {
     this.formSetup();
   }
 
+  returnToCalendarsManagementPage = async () => {
+    const {
+      services: {
+        http: { basePath },
+        application: { navigateToUrl },
+      },
+    } = this.props.kibana;
+    await navigateToUrl(`${basePath.get()}/app/ml/${ML_PAGES.CALENDARS_MANAGE}`, true);
+  };
+
   async formSetup() {
     try {
       const { jobIds, groupIds, calendars } = await getCalendarSettingsData();
@@ -146,7 +157,7 @@ class NewCalendarUI extends Component {
 
       try {
         await ml.addCalendar(calendar);
-        window.location = '#/settings/calendars_list';
+        await this.returnToCalendarsManagementPage();
       } catch (error) {
         console.log('Error saving calendar', error);
         this.setState({ saving: false });
@@ -167,7 +178,7 @@ class NewCalendarUI extends Component {
 
     try {
       await ml.updateCalendar(calendar);
-      window.location = '#/settings/calendars_list';
+      await this.returnToCalendarsManagementPage();
     } catch (error) {
       console.log('Error saving calendar', error);
       this.setState({ saving: false });
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.test.js b/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.test.js
index 2cff255bd1ce3..068d443300088 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.test.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.test.js
@@ -4,6 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+jest.mock('../../../contexts/kibana/use_create_url', () => ({
+  useCreateAndNavigateToMlLink: jest.fn(),
+}));
+
 jest.mock('../../../components/navigation_menu', () => ({
   NavigationMenu: () => <div id="mockNavigationMenu" />,
 }));
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/list/table/__snapshots__/table.test.js.snap b/x-pack/plugins/ml/public/application/settings/calendars/list/table/__snapshots__/table.test.js.snap
index cc1c524c19b57..50cacd7b3545a 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/list/table/__snapshots__/table.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/calendars/list/table/__snapshots__/table.test.js.snap
@@ -77,7 +77,6 @@ exports[`CalendarsListTable renders the table with all calendars 1`] = `
         "toolsRight": Array [
           <EuiButton
             data-test-subj="mlCalendarButtonCreate"
-            href="#/settings/calendars_list/new_calendar"
             isDisabled={false}
             size="s"
           >
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.js b/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.js
index 77331c4a987dc..6b4403aef7c7b 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.js
@@ -7,12 +7,14 @@
 import PropTypes from 'prop-types';
 import React from 'react';
 
-import { EuiButton, EuiLink, EuiInMemoryTable } from '@elastic/eui';
-
+import { EuiButton, EuiInMemoryTable } from '@elastic/eui';
+import { Link } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 import { GLOBAL_CALENDAR } from '../../../../../../common/constants/calendars';
+import { useCreateAndNavigateToMlLink } from '../../../../contexts/kibana/use_create_url';
+import { ML_PAGES } from '../../../../../../common/constants/ml_url_generator';
 
 export const CalendarsListTable = ({
   calendarsList,
@@ -24,6 +26,8 @@ export const CalendarsListTable = ({
   mlNodesAvailable,
   itemsSelected,
 }) => {
+  const redirectToNewCalendarPage = useCreateAndNavigateToMlLink(ML_PAGES.CALENDARS_NEW);
+
   const sorting = {
     sort: {
       field: 'calendar_id',
@@ -46,12 +50,9 @@ export const CalendarsListTable = ({
       truncateText: true,
       scope: 'row',
       render: (id) => (
-        <EuiLink
-          href={`#/settings/calendars_list/edit_calendar/${id}`}
-          data-test-subj="mlEditCalendarLink"
-        >
+        <Link to={`/${ML_PAGES.CALENDARS_EDIT}/${id}`} data-test-subj="mlEditCalendarLink">
           {id}
-        </EuiLink>
+        </Link>
       ),
       'data-test-subj': 'mlCalendarListColumnId',
     },
@@ -101,7 +102,7 @@ export const CalendarsListTable = ({
         size="s"
         data-test-subj="mlCalendarButtonCreate"
         key="new_calendar_button"
-        href="#/settings/calendars_list/new_calendar"
+        onClick={redirectToNewCalendarPage}
         isDisabled={canCreateCalendar === false || mlNodesAvailable === false}
       >
         <FormattedMessage id="xpack.ml.calendarsList.table.newButtonLabel" defaultMessage="New" />
@@ -115,6 +116,7 @@ export const CalendarsListTable = ({
           canDeleteCalendar === false || mlNodesAvailable === false || itemsSelected === false
         }
         data-test-subj="mlCalendarButtonDelete"
+        key="delete_calendar_button"
       >
         <FormattedMessage
           id="xpack.ml.calendarsList.table.deleteButtonLabel"
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.test.js b/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.test.js
index a4c5539d51d1b..f2c6a619adde5 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.test.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.test.js
@@ -8,6 +8,11 @@ import { shallowWithIntl, mountWithIntl } from 'test_utils/enzyme_helpers';
 import React from 'react';
 
 import { CalendarsListTable } from './table';
+import { MemoryRouter } from 'react-router-dom';
+
+jest.mock('../../../../contexts/kibana/use_create_url', () => ({
+  useCreateAndNavigateToMlLink: jest.fn(),
+}));
 
 const calendars = [
   {
@@ -42,7 +47,11 @@ describe('CalendarsListTable', () => {
   });
 
   test('New button enabled if permission available', () => {
-    const wrapper = mountWithIntl(<CalendarsListTable {...props} />);
+    const wrapper = mountWithIntl(
+      <MemoryRouter>
+        <CalendarsListTable {...props} />
+      </MemoryRouter>
+    );
 
     const buttons = wrapper.find('[data-test-subj="mlCalendarButtonCreate"]');
     const button = buttons.find('EuiButton');
@@ -56,7 +65,11 @@ describe('CalendarsListTable', () => {
       canCreateCalendar: false,
     };
 
-    const wrapper = mountWithIntl(<CalendarsListTable {...disableProps} />);
+    const wrapper = mountWithIntl(
+      <MemoryRouter>
+        <CalendarsListTable {...disableProps} />
+      </MemoryRouter>
+    );
 
     const buttons = wrapper.find('[data-test-subj="mlCalendarButtonCreate"]');
     const button = buttons.find('EuiButton');
@@ -70,7 +83,11 @@ describe('CalendarsListTable', () => {
       mlNodesAvailable: false,
     };
 
-    const wrapper = mountWithIntl(<CalendarsListTable {...disableProps} />);
+    const wrapper = mountWithIntl(
+      <MemoryRouter>
+        <CalendarsListTable {...disableProps} />
+      </MemoryRouter>
+    );
 
     const buttons = wrapper.find('[data-test-subj="mlCalendarButtonCreate"]');
     const button = buttons.find('EuiButton');
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js b/x-pack/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js
index 41b7aa63f55ef..681c54ca9eee0 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js
@@ -34,6 +34,7 @@ import { ItemsGrid } from '../../../components/items_grid';
 import { NavigationMenu } from '../../../components/navigation_menu';
 import { isValidFilterListId, saveFilterList } from './utils';
 import { ml } from '../../../services/ml_api_service';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
 
 const DEFAULT_ITEMS_PER_PAGE = 50;
 
@@ -67,10 +68,6 @@ function getActivePage(activePageState, itemsPerPage, numMatchingItems) {
   return activePage;
 }
 
-function returnToFiltersList() {
-  window.location.href = `#/settings/filter_lists`;
-}
-
 export class EditFilterListUI extends Component {
   static displayName = 'EditFilterList';
   static propTypes = {
@@ -105,6 +102,16 @@ export class EditFilterListUI extends Component {
     }
   }
 
+  returnToFiltersList = async () => {
+    const {
+      services: {
+        http: { basePath },
+        application: { navigateToUrl },
+      },
+    } = this.props.kibana;
+    await navigateToUrl(`${basePath.get()}/app/ml/${ML_PAGES.FILTER_LISTS_MANAGE}`, true);
+  };
+
   loadFilterList = (filterId) => {
     ml.filters
       .filters({ filterId })
@@ -279,7 +286,7 @@ export class EditFilterListUI extends Component {
     saveFilterList(filterId, description, items, loadedFilter)
       .then((savedFilter) => {
         this.setLoadedFilterState(savedFilter);
-        returnToFiltersList();
+        this.returnToFiltersList();
       })
       .catch((resp) => {
         console.log(`Error saving filter ${filterId}:`, resp);
@@ -355,7 +362,7 @@ export class EditFilterListUI extends Component {
               />
               <EuiFlexGroup justifyContent="flexEnd">
                 <EuiFlexItem grow={false}>
-                  <EuiButtonEmpty onClick={returnToFiltersList}>
+                  <EuiButtonEmpty onClick={() => this.returnToFiltersList()}>
                     <FormattedMessage
                       id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
                       defaultMessage="Cancel"
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/list/table.js b/x-pack/plugins/ml/public/application/settings/filter_lists/list/table.js
index 9b6fb2b3572a5..ed992b4e866ff 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/list/table.js
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/list/table.js
@@ -10,6 +10,7 @@
 
 import PropTypes from 'prop-types';
 import React from 'react';
+import { Link } from 'react-router-dom';
 
 import {
   EuiButton,
@@ -17,7 +18,6 @@ import {
   EuiFlexItem,
   EuiIcon,
   EuiInMemoryTable,
-  EuiLink,
   EuiSpacer,
   EuiText,
 } from '@elastic/eui';
@@ -26,6 +26,8 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 import { DeleteFilterListModal } from '../components/delete_filter_list_modal';
+import { useCreateAndNavigateToMlLink } from '../../../contexts/kibana/use_create_url';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
 
 function UsedByIcon({ usedBy }) {
   // Renders a tick or cross in the 'usedBy' column to indicate whether
@@ -61,10 +63,12 @@ UsedByIcon.propTypes = {
 };
 
 function NewFilterButton({ canCreateFilter }) {
+  const redirectToNewFilterListPage = useCreateAndNavigateToMlLink(ML_PAGES.FILTER_LISTS_NEW);
+
   return (
     <EuiButton
       key="new_filter_list"
-      href="#/settings/filter_lists/new_filter_list"
+      onClick={redirectToNewFilterListPage}
       isDisabled={canCreateFilter === false}
       data-test-subj="mlFilterListsButtonCreate"
     >
@@ -84,12 +88,9 @@ function getColumns() {
         defaultMessage: 'ID',
       }),
       render: (id) => (
-        <EuiLink
-          href={`#/settings/filter_lists/edit_filter_list/${id}`}
-          data-test-subj="mlEditFilterListLink"
-        >
+        <Link to={`/${ML_PAGES.FILTER_LISTS_EDIT}/${id}`} data-test-subj="mlEditFilterListLink">
           {id}
-        </EuiLink>
+        </Link>
       ),
       sortable: true,
       scope: 'row',
@@ -213,7 +214,7 @@ export function FilterListsTable({
             isSelectable={true}
             data-test-subj="mlFilterListsTable"
             rowProps={(item) => ({
-              'data-test-subj': `mlCalendarListRow row-${item.filter_id}`,
+              'data-test-subj': `mlFilterListsRow row-${item.filter_id}`,
             })}
           />
         </div>
diff --git a/x-pack/plugins/ml/public/application/settings/settings.test.tsx b/x-pack/plugins/ml/public/application/settings/settings.test.tsx
index f16bf62632152..a5e69f233e2df 100644
--- a/x-pack/plugins/ml/public/application/settings/settings.test.tsx
+++ b/x-pack/plugins/ml/public/application/settings/settings.test.tsx
@@ -22,6 +22,10 @@ jest.mock('../contexts/kibana', () => ({
   },
 }));
 
+jest.mock('../contexts/kibana/use_create_url', () => ({
+  useCreateAndNavigateToMlLink: jest.fn(),
+}));
+
 describe('Settings', () => {
   function runCheckButtonsDisabledTest(
     canGetFilters: boolean,
diff --git a/x-pack/plugins/ml/public/application/timeseriesexplorer/components/timeseriesexplorer_no_jobs_found/timeseriesexplorer_no_jobs_found.tsx b/x-pack/plugins/ml/public/application/timeseriesexplorer/components/timeseriesexplorer_no_jobs_found/timeseriesexplorer_no_jobs_found.tsx
index deecb9fb45b51..88bf769aa2936 100644
--- a/x-pack/plugins/ml/public/application/timeseriesexplorer/components/timeseriesexplorer_no_jobs_found/timeseriesexplorer_no_jobs_found.tsx
+++ b/x-pack/plugins/ml/public/application/timeseriesexplorer/components/timeseriesexplorer_no_jobs_found/timeseriesexplorer_no_jobs_found.tsx
@@ -12,26 +12,40 @@ import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 import { EuiEmptyPrompt, EuiButton } from '@elastic/eui';
+import { useMlUrlGenerator, useNavigateToPath } from '../../../contexts/kibana';
+import { ML_PAGES } from '../../../../../common/constants/ml_url_generator';
 
-export const TimeseriesexplorerNoJobsFound = () => (
-  <EuiEmptyPrompt
-    data-test-subj="mlNoSingleMetricJobsFound"
-    iconType="alert"
-    title={
-      <h2>
-        <FormattedMessage
-          id="xpack.ml.timeSeriesExplorer.noSingleMetricJobsFoundLabel"
-          defaultMessage="No single metric jobs found"
-        />
-      </h2>
-    }
-    actions={
-      <EuiButton color="primary" fill href="ml#/jobs">
-        <FormattedMessage
-          id="xpack.ml.timeSeriesExplorer.createNewSingleMetricJobLinkText"
-          defaultMessage="Create new single metric job"
-        />
-      </EuiButton>
-    }
-  />
-);
+export const TimeseriesexplorerNoJobsFound = () => {
+  const mlUrlGenerator = useMlUrlGenerator();
+  const navigateToPath = useNavigateToPath();
+
+  const redirectToJobsManagementPage = async () => {
+    const path = await mlUrlGenerator.createUrl({
+      page: ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE,
+    });
+    await navigateToPath(path, true);
+  };
+
+  return (
+    <EuiEmptyPrompt
+      data-test-subj="mlNoSingleMetricJobsFound"
+      iconType="alert"
+      title={
+        <h2>
+          <FormattedMessage
+            id="xpack.ml.timeSeriesExplorer.noSingleMetricJobsFoundLabel"
+            defaultMessage="No single metric jobs found"
+          />
+        </h2>
+      }
+      actions={
+        <EuiButton color="primary" fill onClick={redirectToJobsManagementPage}>
+          <FormattedMessage
+            id="xpack.ml.timeSeriesExplorer.createNewSingleMetricJobLinkText"
+            defaultMessage="Create new single metric job"
+          />
+        </EuiButton>
+      }
+    />
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/util/chart_utils.js b/x-pack/plugins/ml/public/application/util/chart_utils.js
index 4ec7c5cb6d819..ca55bb10b13d5 100644
--- a/x-pack/plugins/ml/public/application/util/chart_utils.js
+++ b/x-pack/plugins/ml/public/application/util/chart_utils.js
@@ -8,11 +8,9 @@ import d3 from 'd3';
 import { calculateTextWidth } from './string_utils';
 import { MULTI_BUCKET_IMPACT } from '../../../common/constants/multi_bucket_impact';
 import moment from 'moment';
-import rison from 'rison-node';
-
 import { getTimefilter } from './dependency_cache';
-
 import { CHART_TYPE } from '../explorer/explorer_constants';
+import { ML_PAGES } from '../../../common/constants/ml_url_generator';
 
 export const LINE_CHART_ANOMALY_RADIUS = 7;
 export const MULTI_BUCKET_SYMBOL_SIZE = 100; // In square pixels for use with d3 symbol.size
@@ -212,7 +210,7 @@ export function getChartType(config) {
   return chartType;
 }
 
-export function getExploreSeriesLink(series) {
+export async function getExploreSeriesLink(mlUrlGenerator, series) {
   // Open the Single Metric dashboard over the same overall bounds and
   // zoomed in to the same time as the current chart.
   const timefilter = getTimefilter();
@@ -227,46 +225,44 @@ export function getExploreSeriesLink(series) {
   // to identify the particular series to view.
   // Initially pass them in the mlTimeSeriesExplorer part of the AppState.
   // TODO - do we want to pass the entities via the filter?
-  const entityCondition = {};
-  series.entityFields.forEach((entity) => {
-    entityCondition[entity.fieldName] = entity.fieldValue;
-  });
+  let entityCondition;
+  if (series.entityFields.length > 0) {
+    entityCondition = {};
+    series.entityFields.forEach((entity) => {
+      entityCondition[entity.fieldName] = entity.fieldValue;
+    });
+  }
 
-  // Use rison to build the URL .
-  const _g = rison.encode({
-    ml: {
+  const url = await mlUrlGenerator.createUrl({
+    page: ML_PAGES.SINGLE_METRIC_VIEWER,
+    pageState: {
       jobIds: [series.jobId],
-    },
-    refreshInterval: {
-      display: 'Off',
-      pause: false,
-      value: 0,
-    },
-    time: {
-      from: from,
-      to: to,
-      mode: 'absolute',
-    },
-  });
-
-  const _a = rison.encode({
-    mlTimeSeriesExplorer: {
+      refreshInterval: {
+        display: 'Off',
+        pause: false,
+        value: 0,
+      },
+      timeRange: {
+        from: from,
+        to: to,
+        mode: 'absolute',
+      },
       zoom: {
         from: zoomFrom,
         to: zoomTo,
       },
       detectorIndex: series.detectorIndex,
       entities: entityCondition,
-    },
-    query: {
-      query_string: {
-        analyze_wildcard: true,
-        query: '*',
+      query: {
+        query_string: {
+          analyze_wildcard: true,
+          query: '*',
+        },
       },
     },
+    excludeBasePath: true,
   });
-
-  return `#/timeseriesexplorer?_g=${_g}&_a=${encodeURIComponent(_a)}`;
+  return url;
 }
 
 export function showMultiBucketAnomalyMarker(point) {
diff --git a/x-pack/plugins/ml/public/application/util/chart_utils.test.js b/x-pack/plugins/ml/public/application/util/chart_utils.test.js
index b7cf11c088a1e..955dd7cbea0a1 100644
--- a/x-pack/plugins/ml/public/application/util/chart_utils.test.js
+++ b/x-pack/plugins/ml/public/application/util/chart_utils.test.js
@@ -35,7 +35,6 @@ import { render } from '@testing-library/react';
 import {
   chartLimits,
   getChartType,
-  getExploreSeriesLink,
   getTickValues,
   getXTransform,
   isLabelLengthAboveThreshold,
@@ -238,20 +237,6 @@ describe('ML - chart utils', () => {
     });
   });
 
-  describe('getExploreSeriesLink', () => {
-    test('get timeseriesexplorer link', () => {
-      const link = getExploreSeriesLink(seriesConfig);
-      const expectedLink =
-        `#/timeseriesexplorer?_g=(ml:(jobIds:!(population-03)),` +
-        `refreshInterval:(display:Off,pause:!f,value:0),time:(from:'2017-02-23T00:00:00.000Z',mode:absolute,` +
-        `to:'2017-02-23T23:59:59.999Z'))&_a=(mlTimeSeriesExplorer%3A(detectorIndex%3A0%2Centities%3A` +
-        `(nginx.access.remote_ip%3A'72.57.0.53')%2Czoom%3A(from%3A'2017-02-19T20%3A00%3A00.000Z'%2Cto%3A'2017-02-27T04%3A00%3A00.000Z'))` +
-        `%2Cquery%3A(query_string%3A(analyze_wildcard%3A!t%2Cquery%3A'*')))`;
-
-      expect(link).toBe(expectedLink);
-    });
-  });
-
   describe('numTicks', () => {
     test('returns 10 for 1000', () => {
       expect(numTicks(1000)).toBe(10);
diff --git a/x-pack/plugins/ml/public/application/util/custom_url_utils.test.ts b/x-pack/plugins/ml/public/application/util/custom_url_utils.test.ts
index 6a5583ecbb8ac..fa6329b4e8652 100644
--- a/x-pack/plugins/ml/public/application/util/custom_url_utils.test.ts
+++ b/x-pack/plugins/ml/public/application/util/custom_url_utils.test.ts
@@ -456,7 +456,7 @@ describe('ML - custom URL utils', () => {
       );
     });
 
-    test('return expected url for Security app', () => {
+    test('return expected URL for Security app', () => {
       const urlConfig = {
         url_name: 'Hosts Details by process name',
         url_value:
@@ -508,6 +508,45 @@ describe('ML - custom URL utils', () => {
       );
     });
 
+    test('return expected URL for Metrics app', () => {
+      const urlConfig = {
+        url_name: 'Hosts Details by process name',
+        url_value:
+          'metrics/detail/host/$host.name$?metricTime=(autoReload:!f,refreshInterval:5000,time:(from:%27$earliest$%27,interval:%3E%3D1m,to:%27$latest$%27))',
+      };
+
+      const testRecord = {
+        job_id: 'hosts_memory_usage',
+        result_type: 'record',
+        probability: 0.0001288876418224276,
+        multi_bucket_impact: -5,
+        record_score: 88.26287,
+        initial_record_score: 61.553927615180186,
+        bucket_span: 900,
+        detector_index: 0,
+        is_interim: false,
+        timestamp: 1599571800000,
+        function: 'max',
+        function_description: 'max',
+        typical: [0.23685835059986396],
+        actual: [0.258],
+        field_name: 'system.memory.actual.used.pct',
+        influencers: [
+          {
+            influencer_field_name: 'host.name',
+            influencer_field_values: ['gke-dev-next-oblt-dev-next-oblt-pool-404d7f0c-2bfl'],
+          },
+        ],
+        'host.name': ['gke-dev-next-oblt-dev-next-oblt-pool-404d7f0c-2bfl'],
+        earliest: '2019-09-08T12:00:00.000Z',
+        latest: '2019-09-08T14:59:59.999Z',
+      };
+
+      expect(getUrlForRecord(urlConfig, testRecord)).toBe(
+        "metrics/detail/host/gke-dev-next-oblt-dev-next-oblt-pool-404d7f0c-2bfl?metricTime=(autoReload:!f,refreshInterval:5000,time:(from:'2019-09-08T12:00:00.000Z',interval:>=1m,to:'2019-09-08T14:59:59.999Z'))"
+      );
+    });
+
     test('removes an empty path component with a trailing slash', () => {
       const urlConfig = {
         url_name: 'APM',
diff --git a/x-pack/plugins/ml/public/application/util/custom_url_utils.ts b/x-pack/plugins/ml/public/application/util/custom_url_utils.ts
index 18ba1e4ee337b..cf24fdb22a651 100644
--- a/x-pack/plugins/ml/public/application/util/custom_url_utils.ts
+++ b/x-pack/plugins/ml/public/application/util/custom_url_utils.ts
@@ -117,6 +117,7 @@ function isKibanaUrl(urlConfig: UrlConfig) {
     urlValue.startsWith('dashboards#/') ||
     urlValue.startsWith('apm#/') ||
     // BrowserRouter based plugins
+    urlValue.startsWith('metrics/') ||
     urlValue.startsWith('security/') ||
     // Legacy links
     urlValue.startsWith('siem#/')
diff --git a/x-pack/plugins/ml/public/application/util/get_selected_ids_url.ts b/x-pack/plugins/ml/public/application/util/get_selected_ids_url.ts
deleted file mode 100644
index 806626577008e..0000000000000
--- a/x-pack/plugins/ml/public/application/util/get_selected_ids_url.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import rison from 'rison-node';
-import { getBasePath } from './dependency_cache';
-
-export enum TAB_IDS {
-  DATA_FRAME_ANALYTICS = 'data_frame_analytics',
-  ANOMALY_DETECTION = 'jobs',
-}
-
-function getSelectedIdsUrl(tabId: TAB_IDS, settings: { [key: string]: string | string[] }): string {
-  // Create url for filtering by job id or group ids for kibana management table
-  const encoded = rison.encode(settings);
-  const url = `?mlManagement=${encoded}`;
-  const basePath = getBasePath();
-
-  return `${basePath.get()}/app/ml#/${tabId}${url}`;
-}
-
-// Create url for filtering by group ids for kibana management table
-export function getGroupIdsUrl(tabId: TAB_IDS, ids: string[]): string {
-  const settings = {
-    groupIds: ids,
-  };
-
-  return getSelectedIdsUrl(tabId, settings);
-}
-
-// Create url for filtering by job id for kibana management table
-export function getJobIdUrl(tabId: TAB_IDS, id: string): string {
-  const settings = {
-    jobId: id,
-  };
-
-  return getSelectedIdsUrl(tabId, settings);
-}
diff --git a/x-pack/plugins/ml/public/application/util/recently_accessed.ts b/x-pack/plugins/ml/public/application/util/recently_accessed.ts
index ab879e421cb09..04ccd84c561bb 100644
--- a/x-pack/plugins/ml/public/application/util/recently_accessed.ts
+++ b/x-pack/plugins/ml/public/application/util/recently_accessed.ts
@@ -37,7 +37,7 @@ export function addItemToRecentlyAccessed(page: string, itemId: string, url: str
       return;
   }
 
-  url = `ml#/${page}/${url}`;
+  url = url.startsWith('/') ? `/app/ml${url}` : `/app/ml/${page}/${url}`;
   const recentlyAccessed = getRecentlyAccessed();
   recentlyAccessed.add(url, `ML - ${itemId} - ${pageLabel}`, id);
 }
diff --git a/x-pack/plugins/ml/public/ml_url_generator/anomaly_detection_urls_generator.ts b/x-pack/plugins/ml/public/ml_url_generator/anomaly_detection_urls_generator.ts
index c4aebb108e7b9..6a44756412fe3 100644
--- a/x-pack/plugins/ml/public/ml_url_generator/anomaly_detection_urls_generator.ts
+++ b/x-pack/plugins/ml/public/ml_url_generator/anomaly_detection_urls_generator.ts
@@ -11,13 +11,14 @@ import {
   ExplorerAppState,
   ExplorerGlobalState,
   ExplorerUrlState,
+  MlCommonGlobalState,
   MlGenericUrlState,
   TimeSeriesExplorerAppState,
   TimeSeriesExplorerGlobalState,
   TimeSeriesExplorerUrlState,
 } from '../../common/types/ml_url_generator';
 import { ML_PAGES } from '../../common/constants/ml_url_generator';
-import { createIndexBasedMlUrl } from './common';
+import { createGenericMlUrl } from './common';
 import { setStateToKbnUrl } from '../../../../../src/plugins/kibana_utils/public';
 /**
  * Creates URL to the Anomaly Detection Job management page
@@ -30,18 +31,29 @@ export function createAnomalyDetectionJobManagementUrl(
   if (!params || isEmpty(params)) {
     return url;
   }
-  const { jobId, groupIds } = params;
-  const queryState: AnomalyDetectionQueryState = {
-    jobId,
-    groupIds,
-  };
+  const { jobId, groupIds, globalState } = params;
+  if (jobId || groupIds) {
+    const queryState: AnomalyDetectionQueryState = {
+      jobId,
+      groupIds,
+    };
 
-  url = setStateToKbnUrl<AnomalyDetectionQueryState>(
-    'mlManagement',
-    queryState,
-    { useHash: false, storeInHashQuery: false },
-    url
-  );
+    url = setStateToKbnUrl<AnomalyDetectionQueryState>(
+      'mlManagement',
+      queryState,
+      { useHash: false, storeInHashQuery: false },
+      url
+    );
+  }
+
+  if (globalState) {
+    url = setStateToKbnUrl<Partial<MlCommonGlobalState>>(
+      '_g',
+      globalState,
+      { useHash: false, storeInHashQuery: false },
+      url
+    );
+  }
   return url;
 }
 
@@ -49,13 +61,24 @@ export function createAnomalyDetectionCreateJobSelectType(
   appBasePath: string,
   pageState: MlGenericUrlState['pageState']
 ): string {
-  return createIndexBasedMlUrl(
+  return createGenericMlUrl(
     appBasePath,
     ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE,
     pageState
   );
 }
 
+export function createAnomalyDetectionCreateJobSelectIndex(
+  appBasePath: string,
+  pageState: MlGenericUrlState['pageState']
+): string {
+  return createGenericMlUrl(
+    appBasePath,
+    ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX,
+    pageState
+  );
+}
+
 /**
  * Creates URL to the Anomaly Explorer page
  */
@@ -75,36 +98,35 @@ export function createExplorerUrl(
     query,
     mlExplorerSwimlane = {},
     mlExplorerFilter = {},
+    globalState,
   } = params;
   const appState: Partial<ExplorerAppState> = {
     mlExplorerSwimlane,
     mlExplorerFilter,
   };
+  let queryState: Partial<ExplorerGlobalState> = {};
+  if (globalState) queryState = globalState;
   if (query) appState.query = query;
-
   if (jobIds) {
-    const queryState: Partial<ExplorerGlobalState> = {
-      ml: {
-        jobIds,
-      },
+    queryState.ml = {
+      jobIds,
     };
-
-    if (timeRange) queryState.time = timeRange;
-    if (refreshInterval) queryState.refreshInterval = refreshInterval;
-
-    url = setStateToKbnUrl<Partial<ExplorerGlobalState>>(
-      '_g',
-      queryState,
-      { useHash: false, storeInHashQuery: false },
-      url
-    );
-    url = setStateToKbnUrl<Partial<ExplorerAppState>>(
-      '_a',
-      appState,
-      { useHash: false, storeInHashQuery: false },
-      url
-    );
   }
+  if (refreshInterval) queryState.refreshInterval = refreshInterval;
+  if (timeRange) queryState.time = timeRange;
+
+  url = setStateToKbnUrl<Partial<ExplorerGlobalState>>(
+    '_g',
+    queryState,
+    { useHash: false, storeInHashQuery: false },
+    url
+  );
+  url = setStateToKbnUrl<Partial<ExplorerAppState>>(
+    '_a',
+    appState,
+    { useHash: false, storeInHashQuery: false },
+    url
+  );
 
   return url;
 }
@@ -120,19 +142,36 @@ export function createSingleMetricViewerUrl(
   if (!params) {
     return url;
   }
-  const { timeRange, jobIds, refreshInterval, zoom, query, detectorIndex, entities } = params;
+  const {
+    timeRange,
+    jobIds,
+    refreshInterval,
+    zoom,
+    query,
+    detectorIndex,
+    forecastId,
+    entities,
+    globalState,
+  } = params;
+
+  let queryState: Partial<TimeSeriesExplorerGlobalState> = {};
+  if (globalState) queryState = globalState;
 
-  const queryState: TimeSeriesExplorerGlobalState = {
-    ml: {
+  if (jobIds) {
+    queryState.ml = {
       jobIds,
-    },
-    refreshInterval,
-    time: timeRange,
-  };
+    };
+  }
+  if (refreshInterval) queryState.refreshInterval = refreshInterval;
+  if (timeRange) queryState.time = timeRange;
 
   const appState: Partial<TimeSeriesExplorerAppState> = {};
   const mlTimeSeriesExplorer: Partial<TimeSeriesExplorerAppState['mlTimeSeriesExplorer']> = {};
 
+  if (forecastId !== undefined) {
+    mlTimeSeriesExplorer.forecastId = forecastId;
+  }
+
   if (detectorIndex !== undefined) {
     mlTimeSeriesExplorer.detectorIndex = detectorIndex;
   }
@@ -146,7 +185,7 @@ export function createSingleMetricViewerUrl(
     appState.query = {
       query_string: query,
     };
-  url = setStateToKbnUrl<TimeSeriesExplorerGlobalState>(
+  url = setStateToKbnUrl<Partial<TimeSeriesExplorerGlobalState>>(
     '_g',
     queryState,
     { useHash: false, storeInHashQuery: false },
diff --git a/x-pack/plugins/ml/public/ml_url_generator/common.ts b/x-pack/plugins/ml/public/ml_url_generator/common.ts
index 57cfc52045282..f929e513e618a 100644
--- a/x-pack/plugins/ml/public/ml_url_generator/common.ts
+++ b/x-pack/plugins/ml/public/ml_url_generator/common.ts
@@ -19,37 +19,40 @@ export function extractParams<UrlState>(urlState: UrlState) {
  * Creates generic index based search ML url
  * e.g. `jobs/new_job/datavisualizer?index=3da93760-e0af-11ea-9ad3-3bcfc330e42a`
  */
-export function createIndexBasedMlUrl(
+export function createGenericMlUrl(
   appBasePath: string,
   page: MlGenericUrlState['page'],
   pageState: MlGenericUrlState['pageState']
 ): string {
-  const { globalState, appState, index, savedSearchId, ...restParams } = pageState;
   let url = `${appBasePath}/${page}`;
 
-  if (index !== undefined && savedSearchId === undefined) {
-    url = `${url}?index=${index}`;
-  }
-  if (index === undefined && savedSearchId !== undefined) {
-    url = `${url}?savedSearchId=${savedSearchId}`;
-  }
+  if (pageState) {
+    const { globalState, appState, index, savedSearchId, ...restParams } = pageState;
+    if (index !== undefined && savedSearchId === undefined) {
+      url = `${url}?index=${index}`;
+    }
+    if (index === undefined && savedSearchId !== undefined) {
+      url = `${url}?savedSearchId=${savedSearchId}`;
+    }
 
-  if (!isEmpty(restParams)) {
-    Object.keys(restParams).forEach((key) => {
-      url = setStateToKbnUrl(
-        key,
-        restParams[key],
-        { useHash: false, storeInHashQuery: false },
-        url
-      );
-    });
-  }
+    if (!isEmpty(restParams)) {
+      Object.keys(restParams).forEach((key) => {
+        url = setStateToKbnUrl(
+          key,
+          restParams[key],
+          { useHash: false, storeInHashQuery: false },
+          url
+        );
+      });
+    }
 
-  if (globalState) {
-    url = setStateToKbnUrl('_g', globalState, { useHash: false, storeInHashQuery: false }, url);
-  }
-  if (appState) {
-    url = setStateToKbnUrl('_a', appState, { useHash: false, storeInHashQuery: false }, url);
+    if (globalState) {
+      url = setStateToKbnUrl('_g', globalState, { useHash: false, storeInHashQuery: false }, url);
+    }
+    if (appState) {
+      url = setStateToKbnUrl('_a', appState, { useHash: false, storeInHashQuery: false }, url);
+    }
   }
+
   return url;
 }
diff --git a/x-pack/plugins/ml/public/ml_url_generator/data_frame_analytics_urls_generator.ts b/x-pack/plugins/ml/public/ml_url_generator/data_frame_analytics_urls_generator.ts
index 8cf10a2acb64f..88761edf241a9 100644
--- a/x-pack/plugins/ml/public/ml_url_generator/data_frame_analytics_urls_generator.ts
+++ b/x-pack/plugins/ml/public/ml_url_generator/data_frame_analytics_urls_generator.ts
@@ -12,6 +12,7 @@ import {
   DataFrameAnalyticsExplorationUrlState,
   DataFrameAnalyticsQueryState,
   DataFrameAnalyticsUrlState,
+  MlCommonGlobalState,
 } from '../../common/types/ml_url_generator';
 import { ML_PAGES } from '../../common/constants/ml_url_generator';
 import { setStateToKbnUrl } from '../../../../../src/plugins/kibana_utils/public';
@@ -23,18 +24,28 @@ export function createDataFrameAnalyticsJobManagementUrl(
   let url = `${appBasePath}/${ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE}`;
 
   if (mlUrlGeneratorState) {
-    const { jobId, groupIds } = mlUrlGeneratorState;
-    const queryState: Partial<DataFrameAnalyticsQueryState> = {
-      jobId,
-      groupIds,
-    };
+    const { jobId, groupIds, globalState } = mlUrlGeneratorState;
+    if (jobId || groupIds) {
+      const queryState: Partial<DataFrameAnalyticsQueryState> = {
+        jobId,
+        groupIds,
+      };
 
-    url = setStateToKbnUrl<Partial<DataFrameAnalyticsQueryState>>(
-      'mlManagement',
-      queryState,
-      { useHash: false, storeInHashQuery: false },
-      url
-    );
+      url = setStateToKbnUrl<Partial<DataFrameAnalyticsQueryState>>(
+        'mlManagement',
+        queryState,
+        { useHash: false, storeInHashQuery: false },
+        url
+      );
+    }
+    if (globalState) {
+      url = setStateToKbnUrl<Partial<MlCommonGlobalState>>(
+        '_g',
+        globalState,
+        { useHash: false, storeInHashQuery: false },
+        url
+      );
+    }
   }
 
   return url;
@@ -50,12 +61,14 @@ export function createDataFrameAnalyticsExplorationUrl(
   let url = `${appBasePath}/${ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION}`;
 
   if (mlUrlGeneratorState) {
-    const { jobId, analysisType } = mlUrlGeneratorState;
+    const { jobId, analysisType, globalState } = mlUrlGeneratorState;
+
     const queryState: DataFrameAnalyticsExplorationQueryState = {
       ml: {
         jobId,
         analysisType,
       },
+      ...globalState,
     };
 
     url = setStateToKbnUrl<DataFrameAnalyticsExplorationQueryState>(
diff --git a/x-pack/plugins/ml/public/ml_url_generator/data_visualizer_urls_generator.ts b/x-pack/plugins/ml/public/ml_url_generator/data_visualizer_urls_generator.ts
deleted file mode 100644
index 24693df5025d9..0000000000000
--- a/x-pack/plugins/ml/public/ml_url_generator/data_visualizer_urls_generator.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-/**
- * Creates URL to the Data Visualizer page
- */
-import { DataVisualizerUrlState, MlGenericUrlState } from '../../common/types/ml_url_generator';
-import { createIndexBasedMlUrl } from './common';
-import { ML_PAGES } from '../../common/constants/ml_url_generator';
-
-export function createDataVisualizerUrl(
-  appBasePath: string,
-  { page }: DataVisualizerUrlState
-): string {
-  return `${appBasePath}/${page}`;
-}
-
-/**
- * Creates URL to the Index Data Visualizer
- */
-export function createIndexDataVisualizerUrl(
-  appBasePath: string,
-  pageState: MlGenericUrlState['pageState']
-): string {
-  return createIndexBasedMlUrl(appBasePath, ML_PAGES.DATA_VISUALIZER_INDEX_VIEWER, pageState);
-}
diff --git a/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.test.ts b/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.test.ts
index 55bc6d3668de7..754f5bec57a07 100644
--- a/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.test.ts
+++ b/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.test.ts
@@ -6,7 +6,7 @@
 
 import { MlUrlGenerator } from './ml_url_generator';
 import { ML_PAGES } from '../../common/constants/ml_url_generator';
-import { ANALYSIS_CONFIG_TYPE } from '../../common/types/ml_url_generator';
+import { ANALYSIS_CONFIG_TYPE } from '../../common/constants/data_frame_analytics';
 
 describe('MlUrlGenerator', () => {
   const urlGenerator = new MlUrlGenerator({
diff --git a/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.ts b/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.ts
index b69260d8d4157..abec5cc2b7d1e 100644
--- a/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.ts
+++ b/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.ts
@@ -16,6 +16,7 @@ import { MlUrlGeneratorState } from '../../common/types/ml_url_generator';
 import {
   createAnomalyDetectionJobManagementUrl,
   createAnomalyDetectionCreateJobSelectType,
+  createAnomalyDetectionCreateJobSelectIndex,
   createExplorerUrl,
   createSingleMetricViewerUrl,
 } from './anomaly_detection_urls_generator';
@@ -23,10 +24,8 @@ import {
   createDataFrameAnalyticsJobManagementUrl,
   createDataFrameAnalyticsExplorationUrl,
 } from './data_frame_analytics_urls_generator';
-import {
-  createIndexDataVisualizerUrl,
-  createDataVisualizerUrl,
-} from './data_visualizer_urls_generator';
+import { createGenericMlUrl } from './common';
+import { createEditCalendarUrl, createEditFilterUrl } from './settings_urls_generator';
 
 declare module '../../../../../src/plugins/share/public' {
   export interface UrlGeneratorStateMapping {
@@ -44,8 +43,12 @@ export class MlUrlGenerator implements UrlGeneratorsDefinition<typeof ML_APP_URL
 
   public readonly id = ML_APP_URL_GENERATOR;
 
-  public readonly createUrl = async (mlUrlGeneratorState: MlUrlGeneratorState): Promise<string> => {
-    const appBasePath = this.params.appBasePath;
+  public readonly createUrl = async (
+    mlUrlGeneratorParams: MlUrlGeneratorState
+  ): Promise<string> => {
+    const { excludeBasePath, ...mlUrlGeneratorState } = mlUrlGeneratorParams;
+    const appBasePath = excludeBasePath === true ? '' : this.params.appBasePath;
+
     switch (mlUrlGeneratorState.page) {
       case ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE:
         return createAnomalyDetectionJobManagementUrl(appBasePath, mlUrlGeneratorState.pageState);
@@ -56,18 +59,39 @@ export class MlUrlGenerator implements UrlGeneratorsDefinition<typeof ML_APP_URL
           appBasePath,
           mlUrlGeneratorState.pageState
         );
+      case ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX:
+        return createAnomalyDetectionCreateJobSelectIndex(
+          appBasePath,
+          mlUrlGeneratorState.pageState
+        );
       case ML_PAGES.SINGLE_METRIC_VIEWER:
         return createSingleMetricViewerUrl(appBasePath, mlUrlGeneratorState.pageState);
       case ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE:
         return createDataFrameAnalyticsJobManagementUrl(appBasePath, mlUrlGeneratorState.pageState);
       case ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION:
         return createDataFrameAnalyticsExplorationUrl(appBasePath, mlUrlGeneratorState.pageState);
+      case ML_PAGES.ANOMALY_DETECTION_CREATE_JOB:
       case ML_PAGES.DATA_VISUALIZER:
       case ML_PAGES.DATA_VISUALIZER_FILE:
-      case ML_PAGES.DATA_VISUALIZER_INDEX_SELECT:
-        return createDataVisualizerUrl(appBasePath, mlUrlGeneratorState);
       case ML_PAGES.DATA_VISUALIZER_INDEX_VIEWER:
-        return createIndexDataVisualizerUrl(appBasePath, mlUrlGeneratorState.pageState);
+      case ML_PAGES.DATA_VISUALIZER_INDEX_SELECT:
+      case ML_PAGES.OVERVIEW:
+      case ML_PAGES.SETTINGS:
+      case ML_PAGES.FILTER_LISTS_MANAGE:
+      case ML_PAGES.FILTER_LISTS_NEW:
+      case ML_PAGES.CALENDARS_MANAGE:
+      case ML_PAGES.CALENDARS_NEW:
+      case ML_PAGES.ACCESS_DENIED:
+        return createGenericMlUrl(
+          appBasePath,
+          mlUrlGeneratorState.page,
+          mlUrlGeneratorState.pageState
+        );
+      case ML_PAGES.FILTER_LISTS_EDIT:
+        return createEditFilterUrl(appBasePath, mlUrlGeneratorState.pageState);
+      case ML_PAGES.CALENDARS_EDIT:
+        return createEditCalendarUrl(appBasePath, mlUrlGeneratorState.pageState);
+
       default:
         throw new Error('Page type is not provided or unknown');
     }
diff --git a/x-pack/plugins/ml/public/ml_url_generator/settings_urls_generator.tsx b/x-pack/plugins/ml/public/ml_url_generator/settings_urls_generator.tsx
new file mode 100644
index 0000000000000..24ee85c1159ae
--- /dev/null
+++ b/x-pack/plugins/ml/public/ml_url_generator/settings_urls_generator.tsx
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CalendarEditUrlState, FilterEditUrlState } from '../../common/types/ml_url_generator';
+import { ML_PAGES } from '../../common/constants/ml_url_generator';
+import { setStateToKbnUrl } from '../../../../../src/plugins/kibana_utils/public';
+
+export function createEditCalendarUrl(
+  appBasePath: string,
+  pageState: CalendarEditUrlState['pageState']
+): string {
+  let url = `${appBasePath}/${ML_PAGES.CALENDARS_EDIT}`;
+  if (pageState) {
+    const { globalState, calendarId } = pageState;
+    if (calendarId !== undefined) {
+      url = `${url}/${calendarId}`;
+    }
+    if (globalState) {
+      url = setStateToKbnUrl('_g', globalState, { useHash: false, storeInHashQuery: false }, url);
+    }
+  }
+
+  return url;
+}
+
+export function createEditFilterUrl(
+  appBasePath: string,
+  pageState: FilterEditUrlState['pageState']
+): string {
+  let url = `${appBasePath}/${ML_PAGES.FILTER_LISTS_EDIT}`;
+  if (pageState) {
+    const { globalState, filterId } = pageState;
+    if (filterId !== undefined) {
+      url = `${url}/${filterId}`;
+    }
+    if (globalState) {
+      url = setStateToKbnUrl('_g', globalState, { useHash: false, storeInHashQuery: false }, url);
+    }
+  }
+
+  return url;
+}
diff --git a/x-pack/plugins/ml/public/register_feature.ts b/x-pack/plugins/ml/public/register_feature.ts
index 942e9b7f33a40..2332752964f37 100644
--- a/x-pack/plugins/ml/public/register_feature.ts
+++ b/x-pack/plugins/ml/public/register_feature.ts
@@ -41,7 +41,7 @@ export const registerFeature = (home: HomePublicPluginSetup) => {
       defaultMessage: 'Import your own CSV, NDJSON, or log file.',
     }),
     icon: 'document',
-    path: '/app/ml#/filedatavisualizer',
+    path: '/app/ml/filedatavisualizer',
     showOnHomePage: true,
     category: FeatureCatalogueCategory.DATA,
     order: 520,
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/logo.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/logo.json
new file mode 100644
index 0000000000000..2e57038bbc639
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/logo.json
@@ -0,0 +1,3 @@
+{
+    "icon": "metricsApp"
+}
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/manifest.json
new file mode 100644
index 0000000000000..29ac288c0649f
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/manifest.json
@@ -0,0 +1,38 @@
+{
+    "id": "metrics_ui_hosts",
+    "title": "Metrics Hosts",
+    "description": "Detect anomalous memory and network behavior on hosts.",
+    "type": "Metricbeat Data",
+    "logoFile": "logo.json",
+    "jobs": [
+        {
+            "id": "hosts_memory_usage",
+            "file": "hosts_memory_usage.json"
+        },
+        {
+            "id": "hosts_network_in",
+            "file": "hosts_network_in.json"
+        },
+        {
+            "id": "hosts_network_out",
+            "file": "hosts_network_out.json"
+        }
+    ],
+    "datafeeds": [
+        {
+            "id": "datafeed-hosts_memory_usage",
+            "file": "datafeed_hosts_memory_usage.json",
+            "job_id": "hosts_memory_usage"
+        },
+        {
+            "id": "datafeed-hosts_network_in",
+            "file": "datafeed_hosts_network_in.json",
+            "job_id": "hosts_network_in"
+        },
+        {
+            "id": "datafeed-hosts_network_out",
+            "file": "datafeed_hosts_network_out.json",
+            "job_id": "hosts_network_out"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/datafeed_hosts_memory_usage.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/datafeed_hosts_memory_usage.json
new file mode 100644
index 0000000000000..db883a6ce36f9
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/datafeed_hosts_memory_usage.json
@@ -0,0 +1,16 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+        "INDEX_PATTERN_NAME"
+    ],
+    "indices_options": {
+        "allow_no_indices": true
+    },
+    "query": {
+        "bool": {
+            "must": [
+                {"exists": {"field": "system.memory"}}
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/datafeed_hosts_network_in.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/datafeed_hosts_network_in.json
new file mode 100644
index 0000000000000..7eb430632a81f
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/datafeed_hosts_network_in.json
@@ -0,0 +1,40 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+        "INDEX_PATTERN_NAME"
+    ],
+    "indices_options": {
+        "allow_no_indices": true
+    },
+    "query": {
+        "bool": {
+            "must": [
+                {"exists": {"field": "system.network"}}
+            ]
+        }
+    },
+    "chunking_config": {
+        "mode": "manual",
+        "time_span": "900s"
+    },
+    "aggregations": {
+        "host.name": {"terms": {"field": "host.name", "size": 100},
+            "aggregations": {
+                "buckets": {
+                    "date_histogram": {"field": "@timestamp","fixed_interval": "5m"},
+                    "aggregations": {
+                        "@timestamp": {"max": {"field": "@timestamp"}},
+                        "bytes_in_max": {"max": {"field": "system.network.in.bytes"}},
+                        "bytes_in_derivative": {"derivative": {"buckets_path": "bytes_in_max"}},
+                        "positive_only":{
+                            "bucket_script": {
+                                "buckets_path": {"in_derivative": "bytes_in_derivative.value"},
+                                "script": "params.in_derivative > 0.0 ? params.in_derivative : 0.0"
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/datafeed_hosts_network_out.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/datafeed_hosts_network_out.json
new file mode 100644
index 0000000000000..427cb678ce663
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/datafeed_hosts_network_out.json
@@ -0,0 +1,40 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+        "INDEX_PATTERN_NAME"
+    ],
+    "indices_options": {
+        "allow_no_indices": true
+    },
+    "query": {
+        "bool": {
+            "must": [
+                {"exists": {"field": "system.network"}}
+            ]
+        }
+    },
+    "chunking_config": {
+        "mode": "manual",
+        "time_span": "900s"
+    },
+    "aggregations": {
+        "host.name": {"terms": {"field": "host.name", "size": 100},
+            "aggregations": {
+                "buckets": {
+                    "date_histogram": {"field": "@timestamp","fixed_interval": "5m"},
+                    "aggregations": {
+                        "@timestamp": {"max": {"field": "@timestamp"}},
+                        "bytes_out_max": {"max": {"field": "system.network.out.bytes"}},
+                        "bytes_out_derivative": {"derivative": {"buckets_path": "bytes_out_max"}},
+                        "positive_only":{
+                            "bucket_script": {
+                                "buckets_path": {"out_derivative": "bytes_out_derivative.value"},
+                                "script": "params.out_derivative > 0.0 ? params.out_derivative : 0.0"
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_memory_usage.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_memory_usage.json
new file mode 100644
index 0000000000000..186c9dcdb27e5
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_memory_usage.json
@@ -0,0 +1,50 @@
+{
+    "job_type": "anomaly_detector",
+    "groups": [
+      "hosts",
+      "metrics"
+    ],
+    "description": "Metrics: Hosts - Identify unusual spikes in memory usage across hosts.",
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+            "detector_description": "max('system.memory.actual.used.pct')",
+            "function": "max",
+            "field_name": "system.memory.actual.used.pct",
+            "custom_rules": [
+                {
+                    "actions": [
+                    "skip_result"
+                    ],
+                    "conditions": [
+                        {
+                            "applies_to": "actual",
+                            "operator": "lt",
+                            "value": 0.1
+                        }
+                    ]
+                }
+            ]
+        }
+      ],
+      "influencers": [
+        "host.name"
+      ]
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "analysis_limits": {
+      "model_memory_limit": "64mb"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-metrics-ui-hosts",
+      "custom_urls": [
+        {
+          "url_name": "Host Metrics",
+          "url_value": "metrics/detail/host/$host.name$?metricTime=(autoReload:!f,refreshInterval:5000,time:(from:%27$earliest$%27,interval:%3E%3D1m,to:%27$latest$%27))"
+        }
+      ]
+    }
+  }
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_in.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_in.json
new file mode 100644
index 0000000000000..0054d90b1df33
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_in.json
@@ -0,0 +1,37 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Metrics: Hosts - Identify unusual spikes in inbound traffic across hosts.",
+    "groups": [
+      "hosts",
+      "metrics"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "max(bytes_in_derivative)",
+          "function": "max",
+          "field_name": "bytes_in_derivative"
+        }
+      ],
+      "influencers": [
+        "host.name"
+        ],
+      "summary_count_field_name": "doc_count"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "analysis_limits": {
+      "model_memory_limit": "32mb"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-metrics-ui-hosts",
+      "custom_urls": [
+        {
+          "url_name": "Host Metrics",
+          "url_value": "metrics/detail/host/$host.name$?metricTime=(autoReload:!f,refreshInterval:5000,time:(from:%27$earliest$%27,interval:%3E%3D1m,to:%27$latest$%27))"
+        }
+      ]
+    }
+  }
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_out.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_out.json
new file mode 100644
index 0000000000000..601cc3807c441
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_out.json
@@ -0,0 +1,37 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Metrics: Hosts - Identify unusual spikes in outbound traffic across hosts.",
+    "groups": [
+      "hosts",
+      "metrics"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "max(bytes_out_derivative)",
+          "function": "max",
+          "field_name": "bytes_out_derivative"
+        }
+      ],
+      "influencers": [
+        "host.name"
+        ],
+      "summary_count_field_name": "doc_count"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "analysis_limits": {
+      "model_memory_limit": "32mb"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-metrics-ui-hosts",
+      "custom_urls": [
+        {
+          "url_name": "Host Metrics",
+          "url_value": "metrics/detail/host/$host.name$?metricTime=(autoReload:!f,refreshInterval:5000,time:(from:%27$earliest$%27,interval:%3E%3D1m,to:%27$latest$%27))"
+        }
+      ]
+    }
+  }
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/logo.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/logo.json
new file mode 100644
index 0000000000000..63105a28c0ab1
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/logo.json
@@ -0,0 +1,3 @@
+{
+	"icon": "metricsApp"
+}
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/manifest.json
new file mode 100644
index 0000000000000..15336069e092b
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/manifest.json
@@ -0,0 +1,38 @@
+{
+    "id": "metrics_ui_k8s",
+    "title": "Metrics Kubernetes",
+    "description": "Detect anomalous memory and network behavior on Kubernetes pods.",
+    "type": "Metricbeat Data",
+    "logoFile": "logo.json",
+    "jobs": [
+      {
+        "id": "k8s_memory_usage",
+        "file": "k8s_memory_usage.json"
+      },
+      {
+        "id": "k8s_network_in",
+        "file": "k8s_network_in.json"
+      },
+      {
+        "id": "k8s_network_out",
+        "file": "k8s_network_out.json"
+      }
+    ],
+    "datafeeds": [
+      {
+        "id": "datafeed-k8s_memory_usage",
+        "file": "datafeed_k8s_memory_usage.json",
+        "job_id": "k8s_memory_usage"
+      },
+      {
+        "id": "datafeed-k8s_network_in",
+        "file": "datafeed_k8s_network_in.json",
+        "job_id": "k8s_network_in"
+      },
+      {
+        "id": "datafeed-k8s_network_out",
+        "file": "datafeed_k8s_network_out.json",
+        "job_id": "k8s_network_out"
+      }
+    ]
+  }
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/datafeed_k8s_memory_usage.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/datafeed_k8s_memory_usage.json
new file mode 100644
index 0000000000000..14590f743528e
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/datafeed_k8s_memory_usage.json
@@ -0,0 +1,17 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+        "INDEX_PATTERN_NAME"
+    ],
+    "indices_options": {
+        "allow_no_indices": true
+    },
+    "query": {
+        "bool": {
+            "must": [
+                {"exists": {"field": "kubernetes.pod.uid"}},
+                {"exists": {"field": "kubernetes.pod.memory"}}
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/datafeed_k8s_network_in.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/datafeed_k8s_network_in.json
new file mode 100644
index 0000000000000..4fa4c603ea049
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/datafeed_k8s_network_in.json
@@ -0,0 +1,44 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+        "INDEX_PATTERN_NAME"
+    ],
+    "indices_options": {
+        "allow_no_indices": true
+    },
+    "query": {
+        "bool": {
+            "must": [
+                {"exists": {"field": "kubernetes.pod.network"}}
+            ]
+        }
+    },
+    "chunking_config": {
+        "mode": "manual",
+        "time_span": "900s"
+    },
+    "aggregations": {
+        "kubernetes.namespace": {"terms": {"field": "kubernetes.namespace", "size": 25},
+            "aggregations": {
+                "kubernetes.pod.uid": {"terms": {"field": "kubernetes.pod.uid", "size": 100},
+                    "aggregations": {
+                        "buckets": {
+                            "date_histogram": {"field": "@timestamp","fixed_interval": "5m"},
+                            "aggregations": {
+                                "@timestamp": {"max": {"field": "@timestamp"}},
+                                "bytes_in_max": {"max": {"field": "kubernetes.pod.network.rx.bytes"}},
+                                "bytes_in_derivative": {"derivative": {"buckets_path": "bytes_in_max"}},
+                                "positive_only":{
+                                    "bucket_script": {
+                                        "buckets_path": {"in_derivative": "bytes_in_derivative.value"},
+                                        "script": "params.in_derivative > 0.0 ? params.in_derivative : 0.0"
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/datafeed_k8s_network_out.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/datafeed_k8s_network_out.json
new file mode 100644
index 0000000000000..633dd6bf490e7
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/datafeed_k8s_network_out.json
@@ -0,0 +1,44 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+        "INDEX_PATTERN_NAME"
+    ],
+    "indices_options": {
+        "allow_no_indices": true
+    },
+    "query": {
+        "bool": {
+            "must": [
+                {"exists": {"field": "kubernetes.pod.network"}}
+            ]
+        }
+    },
+    "chunking_config": {
+        "mode": "manual",
+        "time_span": "900s"
+    },
+    "aggregations": {
+        "kubernetes.namespace": {"terms": {"field": "kubernetes.namespace", "size": 25},
+            "aggregations": {
+                "kubernetes.pod.uid": {"terms": {"field": "kubernetes.pod.uid", "size": 100},
+                    "aggregations": {
+                        "buckets": {
+                            "date_histogram": {"field": "@timestamp","fixed_interval": "5m"},
+                            "aggregations": {
+                                "@timestamp": {"max": {"field": "@timestamp"}},
+                                "bytes_out_max": {"max": {"field": "kubernetes.pod.network.tx.bytes"}},
+                                "bytes_out_derivative": {"derivative": {"buckets_path": "bytes_out_max"}},
+                                "positive_only":{
+                                    "bucket_script": {
+                                        "buckets_path": {"pos_derivative": "bytes_out_derivative.value"},
+                                        "script": "params.pos_derivative > 0.0 ? params.pos_derivative : 0.0"
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_memory_usage.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_memory_usage.json
new file mode 100644
index 0000000000000..d3f58086e2fd5
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_memory_usage.json
@@ -0,0 +1,53 @@
+{
+    "job_type": "anomaly_detector",
+    "groups": [
+      "k8s",
+      "metrics"
+    ],
+    "description": "Metrics: Kubernetes - Identify unusual spikes in memory usage across Kubernetes pods.",
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "max('kubernetes.pod.memory.usage.node.pct')",
+          "function": "max",
+          "field_name": "kubernetes.pod.memory.usage.node.pct",
+          "partition_field_name": "kubernetes.namespace",
+          "custom_rules": [
+            {
+              "actions": [
+                "skip_result"
+              ],
+              "conditions": [
+                {
+                  "applies_to": "actual",
+                  "operator": "lt",
+                  "value": 0.1
+                }
+              ]
+            }
+          ]
+        }
+      ],
+      "influencers": [
+        "kubernetes.namespace",
+        "kubernetes.node.name",
+        "kubernetes.pod.uid"
+      ]
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "analysis_limits": {
+      "model_memory_limit": "64mb"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-metrics-ui-k8s",
+      "custom_urls": [
+        {
+          "url_name": "Pod Metrics",
+          "url_value": "metrics/detail/pod/$kubernetes.pod.uid$?metricTime=(autoReload:!f,refreshInterval:5000,time:(from:%27$earliest$%27,interval:%3E%3D1m,to:%27$latest$%27))"
+        }
+      ]
+    }
+  }
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_in.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_in.json
new file mode 100644
index 0000000000000..212b2681beb77
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_in.json
@@ -0,0 +1,39 @@
+{
+  "job_type": "anomaly_detector",
+  "description": "Metrics: Kubernetes - Identify unusual spikes in inbound traffic across Kubernetes pods.",
+  "groups": [
+    "k8s",
+    "metrics"
+  ],
+  "analysis_config": {
+    "bucket_span": "15m",
+    "detectors": [
+      {
+        "detector_description": "max(bytes_in_derivative)",
+        "function": "max",
+        "field_name": "bytes_in_derivative",
+        "partition_field_name": "kubernetes.namespace"
+      }
+    ],
+    "influencers": [
+      "kubernetes.namespace",
+      "kubernetes.pod.uid"
+      ],
+    "summary_count_field_name": "doc_count"
+  },
+  "data_description": {
+    "time_field": "@timestamp"
+  },
+  "analysis_limits": {
+    "model_memory_limit": "32mb"
+  },
+  "custom_settings": {
+    "created_by": "ml-module-metrics-ui-k8s",
+    "custom_urls": [
+      {
+        "url_name": "Pod Metrics",
+        "url_value": "metrics/detail/pod/$kubernetes.pod.uid$?metricTime=(autoReload:!f,refreshInterval:5000,time:(from:%27$earliest$%27,interval:%3E%3D1m,to:%27$latest$%27))"
+      }
+    ]
+  }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_out.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_out.json
new file mode 100644
index 0000000000000..b06b0ed5089ef
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_out.json
@@ -0,0 +1,39 @@
+{
+  "job_type": "anomaly_detector",
+  "description": "Metrics: Kubernetes - Identify unusual spikes in outbound traffic across Kubernetes pods.",
+  "groups": [
+    "k8s",
+    "metrics"
+  ],
+  "analysis_config": {
+    "bucket_span": "15m",
+    "detectors": [
+      {
+        "detector_description": "max(bytes_out_derivative)",
+        "function": "max",
+        "field_name": "bytes_out_derivative",
+        "partition_field_name": "kubernetes.namespace"
+      }
+    ],
+    "influencers": [
+      "kubernetes.namespace",
+      "kubernetes.pod.uid"
+      ],
+    "summary_count_field_name": "doc_count"
+  },
+  "data_description": {
+    "time_field": "@timestamp"
+  },
+  "analysis_limits": {
+    "model_memory_limit": "32mb"
+  },
+  "custom_settings": {
+    "created_by": "ml-module-metrics-ui-k8s",
+    "custom_urls": [
+      {
+        "url_name": "Pod Metrics",
+        "url_value": "metrics/detail/pod/$kubernetes.pod.uid$?metricTime=(autoReload:!f,refreshInterval:5000,time:(from:%27$earliest$%27,interval:%3E%3D1m,to:%27$latest$%27))"
+      }
+    ]
+  }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_user_compiler.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_user_compiler.json
index 245b7e0819c7d..bb0323ed9ae78 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_user_compiler.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_user_compiler.json
@@ -1,6 +1,6 @@
 {
     "job_type": "anomaly_detector",
-    "description": "Security: Auditbeat - Looks for compiler activity by a user context which does not normally run compilers. This can be ad-hoc software changes or unauthorized software deployment. This can also be due to local privliege elevation via locally run exploits or malware activity.",
+    "description": "Security: Auditbeat - Looks for compiler activity by a user context which does not normally run compilers. This can be ad-hoc software changes or unauthorized software deployment. This can also be due to local privilege elevation via locally run exploits or malware activity.",
     "groups": [
       "security",
       "auditbeat",
diff --git a/x-pack/plugins/monitoring/server/index.ts b/x-pack/plugins/monitoring/server/index.ts
index 60f04c535ebf1..de679a2834d7b 100644
--- a/x-pack/plugins/monitoring/server/index.ts
+++ b/x-pack/plugins/monitoring/server/index.ts
@@ -10,6 +10,7 @@ import { Plugin } from './plugin';
 import { configSchema } from './config';
 import { deprecations } from './deprecations';
 
+export { KibanaSettingsCollector } from './kibana_monitoring/collectors';
 export { MonitoringConfig } from './config';
 export const plugin = (initContext: PluginInitializerContext) => new Plugin(initContext);
 export const config: PluginConfigDescriptor<TypeOf<typeof configSchema>> = {
diff --git a/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/get_settings_collector.ts b/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/get_settings_collector.ts
index c66adfcabd671..a3ff4b952ce97 100644
--- a/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/get_settings_collector.ts
+++ b/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/get_settings_collector.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { Collector } from '../../../../../../src/plugins/usage_collection/server';
+
 import { KIBANA_SETTINGS_TYPE } from '../../../common/constants';
 import { MonitoringConfig } from '../../config';
 
@@ -38,11 +40,19 @@ export async function checkForEmailValue(
   }
 }
 
+interface EmailSettingData {
+  xpack: { default_admin_email: string | null };
+}
+
+export interface KibanaSettingsCollector extends Collector<EmailSettingData | undefined> {
+  getEmailValueStructure(email: string | null): EmailSettingData;
+}
+
 export function getSettingsCollector(usageCollection: any, config: MonitoringConfig) {
   return usageCollection.makeStatsCollector({
     type: KIBANA_SETTINGS_TYPE,
     isReady: () => true,
-    async fetch() {
+    async fetch(this: KibanaSettingsCollector) {
       let kibanaSettingsData;
       const defaultAdminEmail = await checkForEmailValue(config);
 
@@ -64,7 +74,7 @@ export function getSettingsCollector(usageCollection: any, config: MonitoringCon
       // returns undefined if there was no result
       return kibanaSettingsData;
     },
-    getEmailValueStructure(email: string) {
+    getEmailValueStructure(email: string | null) {
       return {
         xpack: {
           default_admin_email: email,
diff --git a/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts b/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts
index dcd35b0d323eb..aa4853ab226f4 100644
--- a/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts
+++ b/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts
@@ -8,6 +8,8 @@ import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { getSettingsCollector } from './get_settings_collector';
 import { MonitoringConfig } from '../../config';
 
+export { KibanaSettingsCollector } from './get_settings_collector';
+
 export function registerCollectors(
   usageCollection: UsageCollectionSetup,
   config: MonitoringConfig
diff --git a/x-pack/plugins/observability/public/components/app/section/alerts/index.tsx b/x-pack/plugins/observability/public/components/app/section/alerts/index.tsx
index 02e841ec50ee2..b430b7d5959fe 100644
--- a/x-pack/plugins/observability/public/components/app/section/alerts/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/alerts/index.tsx
@@ -11,6 +11,7 @@ import {
   EuiIconTip,
   EuiLink,
   EuiText,
+  EuiSpacer,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import moment from 'moment';
@@ -80,13 +81,14 @@ export function AlertsSection({ alerts }: Props) {
               const isLastElement = index === alerts.length - 1;
               return (
                 <EuiFlexGroup direction="column" gutterSize="s" key={alert.id}>
+                  <EuiSpacer size="s" />
                   <EuiFlexItem>
                     <EuiLink
                       href={core.http.basePath.prepend(
                         `/app/management/insightsAndAlerting/triggersActions/alert/${alert.id}`
                       )}
                     >
-                      {alert.name}
+                      <EuiText size="s">{alert.name}</EuiText>
                     </EuiLink>
                   </EuiFlexItem>
                   <EuiFlexItem grow={false}>
diff --git a/x-pack/plugins/observability/public/plugin.ts b/x-pack/plugins/observability/public/plugin.ts
index 80173cd1560d7..0a82f37d10a7b 100644
--- a/x-pack/plugins/observability/public/plugin.ts
+++ b/x-pack/plugins/observability/public/plugin.ts
@@ -4,9 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { BehaviorSubject } from 'rxjs';
 import { i18n } from '@kbn/i18n';
 import {
   AppMountParameters,
+  AppUpdater,
   CoreSetup,
   DEFAULT_APP_CATEGORIES,
   Plugin as PluginClass,
@@ -28,6 +30,8 @@ interface SetupPlugins {
 export type ObservabilityPluginStart = void;
 
 export class Plugin implements PluginClass<ObservabilityPluginSetup, ObservabilityPluginStart> {
+  private readonly appUpdater$ = new BehaviorSubject<AppUpdater>(() => ({}));
+
   constructor(context: PluginInitializerContext) {}
 
   public setup(core: CoreSetup, plugins: SetupPlugins) {
@@ -37,6 +41,7 @@ export class Plugin implements PluginClass<ObservabilityPluginSetup, Observabili
       order: 8000,
       euiIconType: 'logoObservability',
       appRoute: '/app/observability',
+      updater$: this.appUpdater$,
       category: DEFAULT_APP_CATEGORIES.observability,
 
       mount: async (params: AppMountParameters<unknown>) => {
@@ -79,7 +84,7 @@ export class Plugin implements PluginClass<ObservabilityPluginSetup, Observabili
       dashboard: { register: registerDataHandler },
     };
   }
-  public start(core: CoreStart) {
-    toggleOverviewLinkInNav(core);
+  public start({ application }: CoreStart) {
+    toggleOverviewLinkInNav(this.appUpdater$, application);
   }
 }
diff --git a/x-pack/plugins/observability/public/toggle_overview_link_in_nav.test.tsx b/x-pack/plugins/observability/public/toggle_overview_link_in_nav.test.tsx
index d3218e6f00bd2..6ab7f95602db1 100644
--- a/x-pack/plugins/observability/public/toggle_overview_link_in_nav.test.tsx
+++ b/x-pack/plugins/observability/public/toggle_overview_link_in_nav.test.tsx
@@ -3,47 +3,58 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { CoreStart } from 'kibana/public';
+
+import { Subject } from 'rxjs';
+import { AppUpdater, AppNavLinkStatus } from '../../../../src/core/public';
+import { applicationServiceMock } from '../../../../src/core/public/mocks';
 
 import { toggleOverviewLinkInNav } from './toggle_overview_link_in_nav';
 
 describe('toggleOverviewLinkInNav', () => {
-  const update = jest.fn();
-  afterEach(() => {
-    update.mockClear();
+  let applicationStart: ReturnType<typeof applicationServiceMock.createStartContract>;
+  let subjectMock: jest.Mocked<Subject<AppUpdater>>;
+
+  beforeEach(() => {
+    applicationStart = applicationServiceMock.createStartContract();
+    subjectMock = {
+      next: jest.fn(),
+    } as any;
   });
+
   it('hides overview menu', () => {
-    const core = ({
-      application: {
-        capabilities: {
-          navLinks: {
-            apm: false,
-            logs: false,
-            metrics: false,
-            uptime: false,
-          },
-        },
+    applicationStart.capabilities = {
+      management: {},
+      catalogue: {},
+      navLinks: {
+        apm: false,
+        logs: false,
+        metrics: false,
+        uptime: false,
       },
-      chrome: { navLinks: { update } },
-    } as unknown) as CoreStart;
-    toggleOverviewLinkInNav(core);
-    expect(update).toHaveBeenCalledWith('observability-overview', { hidden: true });
+    };
+
+    toggleOverviewLinkInNav(subjectMock, applicationStart);
+
+    expect(subjectMock.next).toHaveBeenCalledTimes(1);
+    const updater = subjectMock.next.mock.calls[0][0]!;
+    expect(updater({} as any)).toEqual({
+      navLinkStatus: AppNavLinkStatus.hidden,
+    });
   });
   it('shows overview menu', () => {
-    const core = ({
-      application: {
-        capabilities: {
-          navLinks: {
-            apm: true,
-            logs: false,
-            metrics: false,
-            uptime: false,
-          },
-        },
+    applicationStart.capabilities = {
+      management: {},
+      catalogue: {},
+      navLinks: {
+        apm: true,
+        logs: false,
+        metrics: false,
+        uptime: false,
       },
-      chrome: { navLinks: { update } },
-    } as unknown) as CoreStart;
-    toggleOverviewLinkInNav(core);
-    expect(update).not.toHaveBeenCalled();
+    };
+
+    toggleOverviewLinkInNav(subjectMock, applicationStart);
+
+    expect(subjectMock.next).not.toHaveBeenCalled();
   });
 });
diff --git a/x-pack/plugins/observability/public/toggle_overview_link_in_nav.tsx b/x-pack/plugins/observability/public/toggle_overview_link_in_nav.tsx
index c33ca45e4fcd8..ad8b6a323a897 100644
--- a/x-pack/plugins/observability/public/toggle_overview_link_in_nav.tsx
+++ b/x-pack/plugins/observability/public/toggle_overview_link_in_nav.tsx
@@ -4,12 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CoreStart } from 'kibana/public';
+import { Subject } from 'rxjs';
+import { AppNavLinkStatus, AppUpdater, ApplicationStart } from '../../../../src/core/public';
 
-export function toggleOverviewLinkInNav(core: CoreStart) {
-  const { apm, logs, metrics, uptime } = core.application.capabilities.navLinks;
+export function toggleOverviewLinkInNav(
+  updater$: Subject<AppUpdater>,
+  { capabilities }: ApplicationStart
+) {
+  const { apm, logs, metrics, uptime } = capabilities.navLinks;
   const someVisible = Object.values({ apm, logs, metrics, uptime }).some((visible) => visible);
   if (!someVisible) {
-    core.chrome.navLinks.update('observability-overview', { hidden: true });
+    updater$.next(() => ({
+      navLinkStatus: AppNavLinkStatus.hidden,
+    }));
   }
 }
diff --git a/x-pack/plugins/reporting/common/schema_utils.ts b/x-pack/plugins/reporting/common/schema_utils.ts
new file mode 100644
index 0000000000000..f9b5c90e3c366
--- /dev/null
+++ b/x-pack/plugins/reporting/common/schema_utils.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ByteSizeValue } from '@kbn/config-schema';
+import moment from 'moment';
+
+/*
+ * For cleaner code: use these functions when a config schema value could be
+ * one type or another.  This allows you to treat the value as one type.
+ */
+
+export const durationToNumber = (value: number | moment.Duration): number => {
+  if (typeof value === 'number') {
+    return value;
+  }
+  return value.asMilliseconds();
+};
+
+export const byteSizeValueToNumber = (value: number | ByteSizeValue) => {
+  if (typeof value === 'number') {
+    return value;
+  }
+
+  return value.getValueInBytes();
+};
diff --git a/x-pack/plugins/reporting/public/components/report_listing.tsx b/x-pack/plugins/reporting/public/components/report_listing.tsx
index 65db13f22788b..f326d365351f2 100644
--- a/x-pack/plugins/reporting/public/components/report_listing.tsx
+++ b/x-pack/plugins/reporting/public/components/report_listing.tsx
@@ -6,8 +6,8 @@
 
 import {
   EuiBasicTable,
-  EuiFlexItem,
   EuiFlexGroup,
+  EuiFlexItem,
   EuiPageContent,
   EuiSpacer,
   EuiText,
@@ -23,6 +23,7 @@ import { Subscription } from 'rxjs';
 import { ApplicationStart, ToastsSetup } from 'src/core/public';
 import { ILicense, LicensingPluginSetup } from '../../../licensing/public';
 import { Poller } from '../../common/poller';
+import { durationToNumber } from '../../common/schema_utils';
 import { JobStatuses } from '../../constants';
 import { checkLicense } from '../lib/license_check';
 import { JobQueueEntry, ReportingAPIClient } from '../lib/reporting_api_client';
@@ -183,17 +184,19 @@ class ReportListingUi extends Component<Props, State> {
 
   public componentDidMount() {
     this.mounted = true;
+    const { pollConfig, license$ } = this.props;
+    const pollFrequencyInMillis = durationToNumber(pollConfig.jobsRefresh.interval);
     this.poller = new Poller({
       functionToPoll: () => {
         return this.fetchJobs();
       },
-      pollFrequencyInMillis: this.props.pollConfig.jobsRefresh.interval,
+      pollFrequencyInMillis,
       trailing: false,
       continuePollingOnError: true,
-      pollFrequencyErrorMultiplier: this.props.pollConfig.jobsRefresh.intervalErrorMultiplier,
+      pollFrequencyErrorMultiplier: pollConfig.jobsRefresh.intervalErrorMultiplier,
     });
     this.poller.start();
-    this.licenseSubscription = this.props.license$.subscribe(this.licenseHandler);
+    this.licenseSubscription = license$.subscribe(this.licenseHandler);
   }
 
   private licenseHandler = (license: ILicense) => {
diff --git a/x-pack/plugins/reporting/public/plugin.tsx b/x-pack/plugins/reporting/public/plugin.tsx
index d003d4c581699..a134377e194b8 100644
--- a/x-pack/plugins/reporting/public/plugin.tsx
+++ b/x-pack/plugins/reporting/public/plugin.tsx
@@ -26,6 +26,7 @@ import {
 import { ManagementSetup } from '../../../../src/plugins/management/public';
 import { SharePluginSetup } from '../../../../src/plugins/share/public';
 import { LicensingPluginSetup } from '../../licensing/public';
+import { durationToNumber } from '../common/schema_utils';
 import { JobId, JobStatusBuckets, ReportingConfigType } from '../common/types';
 import { JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY } from '../constants';
 import { getGeneralErrorToast } from './components';
@@ -158,8 +159,7 @@ export class ReportingPublicPlugin implements Plugin<void, void> {
     const { http, notifications } = core;
     const apiClient = new ReportingAPIClient(http);
     const streamHandler = new StreamHandler(notifications, apiClient);
-    const { interval } = this.config.poll.jobsRefresh;
-
+    const interval = durationToNumber(this.config.poll.jobsRefresh.interval);
     Rx.timer(0, interval)
       .pipe(
         takeUntil(this.stop$), // stop the interval when stop method is called
diff --git a/x-pack/plugins/reporting/server/browsers/chromium/driver_factory/index.ts b/x-pack/plugins/reporting/server/browsers/chromium/driver_factory/index.ts
index 88be86d1ecc30..6897f07c45e2b 100644
--- a/x-pack/plugins/reporting/server/browsers/chromium/driver_factory/index.ts
+++ b/x-pack/plugins/reporting/server/browsers/chromium/driver_factory/index.ts
@@ -21,6 +21,7 @@ import { InnerSubscriber } from 'rxjs/internal/InnerSubscriber';
 import { ignoreElements, map, mergeMap, tap } from 'rxjs/operators';
 import { getChromiumDisconnectedError } from '../';
 import { BROWSER_TYPE } from '../../../../common/constants';
+import { durationToNumber } from '../../../../common/schema_utils';
 import { CaptureConfig } from '../../../../server/types';
 import { LevelLogger } from '../../../lib';
 import { safeChildProcess } from '../../safe_child_process';
@@ -90,7 +91,7 @@ export class HeadlessChromiumDriverFactory {
 
         // Set the default timeout for all navigation methods to the openUrl timeout (30 seconds)
         // All waitFor methods have their own timeout config passed in to them
-        page.setDefaultTimeout(this.captureConfig.timeouts.openUrl);
+        page.setDefaultTimeout(durationToNumber(this.captureConfig.timeouts.openUrl));
 
         logger.debug(`Browser page driver created`);
       } catch (err) {
diff --git a/x-pack/plugins/reporting/server/config/index.ts b/x-pack/plugins/reporting/server/config/index.ts
index a89b952702e1b..b9c6f8e7591e3 100644
--- a/x-pack/plugins/reporting/server/config/index.ts
+++ b/x-pack/plugins/reporting/server/config/index.ts
@@ -17,6 +17,8 @@ export const config: PluginConfigDescriptor<ReportingConfigType> = {
     unused('capture.concurrency'),
     unused('capture.settleTime'),
     unused('capture.timeout'),
+    unused('poll.jobCompletionNotifier.intervalErrorMultiplier'),
+    unused('poll.jobsRefresh.intervalErrorMultiplier'),
     unused('kibanaApp'),
   ],
 };
diff --git a/x-pack/plugins/reporting/server/config/schema.test.ts b/x-pack/plugins/reporting/server/config/schema.test.ts
index 69e4d443cf040..9fc3d4329879e 100644
--- a/x-pack/plugins/reporting/server/config/schema.test.ts
+++ b/x-pack/plugins/reporting/server/config/schema.test.ts
@@ -8,101 +8,242 @@ import { ConfigSchema } from './schema';
 
 describe('Reporting Config Schema', () => {
   it(`context {"dev":false,"dist":false} produces correct config`, () => {
-    expect(ConfigSchema.validate({}, { dev: false, dist: false })).toMatchObject({
-      capture: {
-        browser: {
-          autoDownload: true,
-          chromium: { proxy: { enabled: false } },
-          type: 'chromium',
+    expect(ConfigSchema.validate({}, { dev: false, dist: false })).toMatchInlineSnapshot(`
+      Object {
+        "capture": Object {
+          "browser": Object {
+            "autoDownload": true,
+            "chromium": Object {
+              "proxy": Object {
+                "enabled": false,
+              },
+            },
+            "type": "chromium",
+          },
+          "loadDelay": "PT3S",
+          "maxAttempts": 1,
+          "networkPolicy": Object {
+            "enabled": true,
+            "rules": Array [
+              Object {
+                "allow": true,
+                "host": undefined,
+                "protocol": "http:",
+              },
+              Object {
+                "allow": true,
+                "host": undefined,
+                "protocol": "https:",
+              },
+              Object {
+                "allow": true,
+                "host": undefined,
+                "protocol": "ws:",
+              },
+              Object {
+                "allow": true,
+                "host": undefined,
+                "protocol": "wss:",
+              },
+              Object {
+                "allow": true,
+                "host": undefined,
+                "protocol": "data:",
+              },
+              Object {
+                "allow": false,
+                "host": undefined,
+                "protocol": undefined,
+              },
+            ],
+          },
+          "timeouts": Object {
+            "openUrl": "PT1M",
+            "renderComplete": "PT30S",
+            "waitForElements": "PT30S",
+          },
+          "viewport": Object {
+            "height": 1200,
+            "width": 1950,
+          },
+          "zoom": 2,
+        },
+        "csv": Object {
+          "checkForFormulas": true,
+          "enablePanelActionDownload": true,
+          "escapeFormulaValues": false,
+          "maxSizeBytes": ByteSizeValue {
+            "valueInBytes": 10485760,
+          },
+          "scroll": Object {
+            "duration": "30s",
+            "size": 500,
+          },
+          "useByteOrderMarkEncoding": false,
         },
-        loadDelay: 3000,
-        maxAttempts: 1,
-        networkPolicy: {
-          enabled: true,
-          rules: [
-            { allow: true, host: undefined, protocol: 'http:' },
-            { allow: true, host: undefined, protocol: 'https:' },
-            { allow: true, host: undefined, protocol: 'ws:' },
-            { allow: true, host: undefined, protocol: 'wss:' },
-            { allow: true, host: undefined, protocol: 'data:' },
-            { allow: false, host: undefined, protocol: undefined },
+        "enabled": true,
+        "encryptionKey": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "index": ".reporting",
+        "kibanaServer": Object {},
+        "poll": Object {
+          "jobCompletionNotifier": Object {
+            "interval": 10000,
+            "intervalErrorMultiplier": 5,
+          },
+          "jobsRefresh": Object {
+            "interval": 5000,
+            "intervalErrorMultiplier": 5,
+          },
+        },
+        "queue": Object {
+          "indexInterval": "week",
+          "pollEnabled": true,
+          "pollInterval": "PT3S",
+          "pollIntervalErrorMultiplier": 10,
+          "timeout": "PT2M",
+        },
+        "roles": Object {
+          "allow": Array [
+            "reporting_user",
           ],
         },
-        viewport: { height: 1200, width: 1950 },
-        zoom: 2,
-      },
-      csv: {
-        checkForFormulas: true,
-        enablePanelActionDownload: true,
-        maxSizeBytes: 10485760,
-        scroll: { duration: '30s', size: 500 },
-      },
-      encryptionKey: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-      index: '.reporting',
-      kibanaServer: {},
-      poll: {
-        jobCompletionNotifier: { interval: 10000, intervalErrorMultiplier: 5 },
-        jobsRefresh: { interval: 5000, intervalErrorMultiplier: 5 },
-      },
-      queue: {
-        indexInterval: 'week',
-        pollEnabled: true,
-        pollInterval: 3000,
-        pollIntervalErrorMultiplier: 10,
-        timeout: 120000,
-      },
-      roles: { allow: ['reporting_user'] },
-    });
+      }
+    `);
   });
 
   it(`context {"dev":false,"dist":true} produces correct config`, () => {
-    expect(ConfigSchema.validate({}, { dev: false, dist: true })).toMatchObject({
-      capture: {
-        browser: {
-          autoDownload: false,
-          chromium: {
-            inspect: false,
-            proxy: { enabled: false },
-          },
-          type: 'chromium',
+    expect(ConfigSchema.validate({}, { dev: false, dist: true })).toMatchInlineSnapshot(`
+      Object {
+        "capture": Object {
+          "browser": Object {
+            "autoDownload": false,
+            "chromium": Object {
+              "inspect": false,
+              "proxy": Object {
+                "enabled": false,
+              },
+            },
+            "type": "chromium",
+          },
+          "loadDelay": "PT3S",
+          "maxAttempts": 3,
+          "networkPolicy": Object {
+            "enabled": true,
+            "rules": Array [
+              Object {
+                "allow": true,
+                "host": undefined,
+                "protocol": "http:",
+              },
+              Object {
+                "allow": true,
+                "host": undefined,
+                "protocol": "https:",
+              },
+              Object {
+                "allow": true,
+                "host": undefined,
+                "protocol": "ws:",
+              },
+              Object {
+                "allow": true,
+                "host": undefined,
+                "protocol": "wss:",
+              },
+              Object {
+                "allow": true,
+                "host": undefined,
+                "protocol": "data:",
+              },
+              Object {
+                "allow": false,
+                "host": undefined,
+                "protocol": undefined,
+              },
+            ],
+          },
+          "timeouts": Object {
+            "openUrl": "PT1M",
+            "renderComplete": "PT30S",
+            "waitForElements": "PT30S",
+          },
+          "viewport": Object {
+            "height": 1200,
+            "width": 1950,
+          },
+          "zoom": 2,
+        },
+        "csv": Object {
+          "checkForFormulas": true,
+          "enablePanelActionDownload": true,
+          "escapeFormulaValues": false,
+          "maxSizeBytes": ByteSizeValue {
+            "valueInBytes": 10485760,
+          },
+          "scroll": Object {
+            "duration": "30s",
+            "size": 500,
+          },
+          "useByteOrderMarkEncoding": false,
         },
-        loadDelay: 3000,
-        maxAttempts: 3,
-        networkPolicy: {
-          enabled: true,
-          rules: [
-            { allow: true, host: undefined, protocol: 'http:' },
-            { allow: true, host: undefined, protocol: 'https:' },
-            { allow: true, host: undefined, protocol: 'ws:' },
-            { allow: true, host: undefined, protocol: 'wss:' },
-            { allow: true, host: undefined, protocol: 'data:' },
-            { allow: false, host: undefined, protocol: undefined },
+        "enabled": true,
+        "index": ".reporting",
+        "kibanaServer": Object {},
+        "poll": Object {
+          "jobCompletionNotifier": Object {
+            "interval": 10000,
+            "intervalErrorMultiplier": 5,
+          },
+          "jobsRefresh": Object {
+            "interval": 5000,
+            "intervalErrorMultiplier": 5,
+          },
+        },
+        "queue": Object {
+          "indexInterval": "week",
+          "pollEnabled": true,
+          "pollInterval": "PT3S",
+          "pollIntervalErrorMultiplier": 10,
+          "timeout": "PT2M",
+        },
+        "roles": Object {
+          "allow": Array [
+            "reporting_user",
           ],
         },
-        viewport: { height: 1200, width: 1950 },
-        zoom: 2,
-      },
-      csv: {
-        checkForFormulas: true,
-        enablePanelActionDownload: true,
-        maxSizeBytes: 10485760,
-        scroll: { duration: '30s', size: 500 },
-      },
-      index: '.reporting',
-      kibanaServer: {},
-      poll: {
-        jobCompletionNotifier: { interval: 10000, intervalErrorMultiplier: 5 },
-        jobsRefresh: { interval: 5000, intervalErrorMultiplier: 5 },
-      },
-      queue: {
-        indexInterval: 'week',
-        pollEnabled: true,
-        pollInterval: 3000,
-        pollIntervalErrorMultiplier: 10,
-        timeout: 120000,
-      },
-      roles: { allow: ['reporting_user'] },
-    });
+      }
+    `);
+  });
+
+  it('allows Duration values for certain keys', () => {
+    expect(ConfigSchema.validate({ queue: { timeout: '2m' } }).queue.timeout).toMatchInlineSnapshot(
+      `"PT2M"`
+    );
+
+    expect(
+      ConfigSchema.validate({ capture: { loadDelay: '3s' } }).capture.loadDelay
+    ).toMatchInlineSnapshot(`"PT3S"`);
+
+    expect(
+      ConfigSchema.validate({
+        capture: { timeouts: { openUrl: '1m', waitForElements: '30s', renderComplete: '10s' } },
+      }).capture.timeouts
+    ).toMatchInlineSnapshot(`
+      Object {
+        "openUrl": "PT1M",
+        "renderComplete": "PT10S",
+        "waitForElements": "PT30S",
+      }
+    `);
+  });
+
+  it('allows ByteSizeValue values for certain keys', () => {
+    expect(ConfigSchema.validate({ csv: { maxSizeBytes: '12mb' } }).csv.maxSizeBytes)
+      .toMatchInlineSnapshot(`
+      ByteSizeValue {
+        "valueInBytes": 12582912,
+      }
+    `);
   });
 
   it(`allows optional settings`, () => {
diff --git a/x-pack/plugins/reporting/server/config/schema.ts b/x-pack/plugins/reporting/server/config/schema.ts
index a81ffd754946b..8276e8b49d348 100644
--- a/x-pack/plugins/reporting/server/config/schema.ts
+++ b/x-pack/plugins/reporting/server/config/schema.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { schema, TypeOf } from '@kbn/config-schema';
+import { ByteSizeValue, schema, TypeOf } from '@kbn/config-schema';
 import moment from 'moment';
 
 const KibanaServerSchema = schema.object({
@@ -33,9 +33,13 @@ const KibanaServerSchema = schema.object({
 const QueueSchema = schema.object({
   indexInterval: schema.string({ defaultValue: 'week' }),
   pollEnabled: schema.boolean({ defaultValue: true }),
-  pollInterval: schema.number({ defaultValue: 3000 }),
+  pollInterval: schema.oneOf([schema.number(), schema.duration()], {
+    defaultValue: moment.duration({ seconds: 3 }),
+  }),
   pollIntervalErrorMultiplier: schema.number({ defaultValue: 10 }),
-  timeout: schema.number({ defaultValue: moment.duration(2, 'm').asMilliseconds() }),
+  timeout: schema.oneOf([schema.number(), schema.duration()], {
+    defaultValue: moment.duration({ minutes: 2 }),
+  }),
 });
 
 const RulesSchema = schema.object({
@@ -46,9 +50,15 @@ const RulesSchema = schema.object({
 
 const CaptureSchema = schema.object({
   timeouts: schema.object({
-    openUrl: schema.number({ defaultValue: 60000 }),
-    waitForElements: schema.number({ defaultValue: 30000 }),
-    renderComplete: schema.number({ defaultValue: 30000 }),
+    openUrl: schema.oneOf([schema.number(), schema.duration()], {
+      defaultValue: moment.duration({ minutes: 1 }),
+    }),
+    waitForElements: schema.oneOf([schema.number(), schema.duration()], {
+      defaultValue: moment.duration({ seconds: 30 }),
+    }),
+    renderComplete: schema.oneOf([schema.number(), schema.duration()], {
+      defaultValue: moment.duration({ seconds: 30 }),
+    }),
   }),
   networkPolicy: schema.object({
     enabled: schema.boolean({ defaultValue: true }),
@@ -68,9 +78,9 @@ const CaptureSchema = schema.object({
     width: schema.number({ defaultValue: 1950 }),
     height: schema.number({ defaultValue: 1200 }),
   }),
-  loadDelay: schema.number({
-    defaultValue: moment.duration(3, 's').asMilliseconds(),
-  }), // TODO: use schema.duration
+  loadDelay: schema.oneOf([schema.number(), schema.duration()], {
+    defaultValue: moment.duration({ seconds: 3 }),
+  }),
   browser: schema.object({
     autoDownload: schema.conditional(
       schema.contextRef('dist'),
@@ -116,13 +126,13 @@ const CsvSchema = schema.object({
   checkForFormulas: schema.boolean({ defaultValue: true }),
   escapeFormulaValues: schema.boolean({ defaultValue: false }),
   enablePanelActionDownload: schema.boolean({ defaultValue: true }),
-  maxSizeBytes: schema.number({
-    defaultValue: 1024 * 1024 * 10, // 10MB
-  }), // TODO: use schema.byteSize
+  maxSizeBytes: schema.oneOf([schema.number(), schema.byteSize()], {
+    defaultValue: ByteSizeValue.parse('10mb'),
+  }),
   useByteOrderMarkEncoding: schema.boolean({ defaultValue: false }),
   scroll: schema.object({
     duration: schema.string({
-      defaultValue: '30s',
+      defaultValue: '30s', // this value is passed directly to ES, so string only format is preferred
       validate(value) {
         if (!/^[0-9]+(d|h|m|s|ms|micros|nanos)$/.test(value)) {
           return 'must be a duration string';
@@ -146,18 +156,16 @@ const RolesSchema = schema.object({
 
 const IndexSchema = schema.string({ defaultValue: '.reporting' });
 
+// Browser side polling: job completion notifier, management table auto-refresh
+// NOTE: can not use schema.duration, a bug prevents it being passed to the browser correctly
 const PollSchema = schema.object({
   jobCompletionNotifier: schema.object({
-    interval: schema.number({
-      defaultValue: moment.duration(10, 's').asMilliseconds(),
-    }), // TODO: use schema.duration
-    intervalErrorMultiplier: schema.number({ defaultValue: 5 }),
+    interval: schema.number({ defaultValue: 10000 }),
+    intervalErrorMultiplier: schema.number({ defaultValue: 5 }), // unused
   }),
   jobsRefresh: schema.object({
-    interval: schema.number({
-      defaultValue: moment.duration(5, 's').asMilliseconds(),
-    }), // TODO: use schema.duration
-    intervalErrorMultiplier: schema.number({ defaultValue: 5 }),
+    interval: schema.number({ defaultValue: 5000 }),
+    intervalErrorMultiplier: schema.number({ defaultValue: 5 }), // unused
   }),
 });
 
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.test.ts b/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.test.ts
index 754bc7bc75cb5..a0d8ff0852544 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.test.ts
@@ -4,10 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import sinon from 'sinon';
 import { ReportingConfig } from '../../';
 import { ReportingCore } from '../../core';
-import { createMockReportingCore } from '../../test_helpers';
+import {
+  createMockConfig,
+  createMockConfigSchema,
+  createMockReportingCore,
+} from '../../test_helpers';
 import { BasePayload } from '../../types';
 import { TaskPayloadPDF } from '../printable_pdf/types';
 import { getConditionalHeaders, getCustomLogo } from './';
@@ -15,17 +18,10 @@ import { getConditionalHeaders, getCustomLogo } from './';
 let mockConfig: ReportingConfig;
 let mockReportingPlugin: ReportingCore;
 
-const getMockConfig = (mockConfigGet: sinon.SinonStub) => ({
-  get: mockConfigGet,
-  kbnConfig: { get: mockConfigGet },
-});
-
 beforeEach(async () => {
-  const mockConfigGet = sinon
-    .stub()
-    .withArgs('kibanaServer', 'hostname')
-    .returns('custom-hostname');
-  mockConfig = getMockConfig(mockConfigGet);
+  const reportingConfig = { kibanaServer: { hostname: 'custom-hostname' } };
+  const mockSchema = createMockConfigSchema(reportingConfig);
+  mockConfig = createMockConfig(mockSchema);
   mockReportingPlugin = await createMockReportingCore(mockConfig);
 });
 
@@ -84,10 +80,9 @@ test(`uses basePath from server if job doesn't have a basePath when creating sav
   const mockGetSavedObjectsClient = jest.fn();
   mockReportingPlugin.getSavedObjectsClient = mockGetSavedObjectsClient;
 
-  const mockConfigGet = sinon.stub();
-  mockConfigGet.withArgs('kibanaServer', 'hostname').returns('localhost');
-  mockConfigGet.withArgs('server', 'basePath').returns('/sbp');
-  mockConfig = getMockConfig(mockConfigGet);
+  const reportingConfig = { kibanaServer: { hostname: 'localhost' }, server: { basePath: '/sbp' } };
+  const mockSchema = createMockConfigSchema(reportingConfig);
+  mockConfig = createMockConfig(mockSchema);
 
   const permittedHeaders = {
     foo: 'bar',
@@ -134,25 +129,12 @@ test(`uses basePath from server if job doesn't have a basePath when creating sav
 });
 
 describe('config formatting', () => {
-  test(`lowercases server.host`, async () => {
-    const mockConfigGet = sinon.stub().withArgs('server', 'host').returns('COOL-HOSTNAME');
-    mockConfig = getMockConfig(mockConfigGet);
-
-    const conditionalHeaders = await getConditionalHeaders({
-      job: {} as BasePayload<any>,
-      filteredHeaders: {},
-      config: mockConfig,
-    });
-    expect(conditionalHeaders.conditions.hostname).toEqual('cool-hostname');
-  });
-
   test(`lowercases kibanaServer.hostname`, async () => {
-    const mockConfigGet = sinon
-      .stub()
-      .withArgs('kibanaServer', 'hostname')
-      .returns('GREAT-HOSTNAME');
-    mockConfig = getMockConfig(mockConfigGet);
-    const conditionalHeaders = await getConditionalHeaders({
+    const reportingConfig = { kibanaServer: { hostname: 'GREAT-HOSTNAME' } };
+    const mockSchema = createMockConfigSchema(reportingConfig);
+    mockConfig = createMockConfig(mockSchema);
+
+    const conditionalHeaders = getConditionalHeaders({
       job: {
         title: 'cool-job-bro',
         type: 'csv',
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts b/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts
index 8c02fdd69de8b..ec4e54632eef5 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts
@@ -4,18 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ReportingCore } from '../../core';
-import { createMockReportingCore } from '../../test_helpers';
+import { ReportingConfig, ReportingCore } from '../../';
+import {
+  createMockConfig,
+  createMockConfigSchema,
+  createMockReportingCore,
+} from '../../test_helpers';
 import { TaskPayloadPDF } from '../printable_pdf/types';
 import { getConditionalHeaders, getCustomLogo } from './';
 
-const mockConfigGet = jest.fn().mockImplementation((key: string) => {
-  return 'localhost';
-});
-const mockConfig = { get: mockConfigGet, kbnConfig: { get: mockConfigGet } };
-
+let mockConfig: ReportingConfig;
 let mockReportingPlugin: ReportingCore;
+
 beforeEach(async () => {
+  mockConfig = createMockConfig(createMockConfigSchema());
   mockReportingPlugin = await createMockReportingCore(mockConfig);
 });
 
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts b/x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts
index 355536000326e..fae66b26a83e0 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts
@@ -5,6 +5,7 @@
  */
 
 import { ReportingConfig } from '../../';
+import { createMockConfig } from '../../test_helpers';
 import { TaskPayloadPNG } from '../png/types';
 import { TaskPayloadPDF } from '../printable_pdf/types';
 import { getFullUrls } from './get_full_urls';
@@ -15,12 +16,6 @@ interface FullUrlsOpts {
 }
 
 let mockConfig: ReportingConfig;
-const getMockConfig = (mockConfigGet: jest.Mock<any, any>) => {
-  return {
-    get: mockConfigGet,
-    kbnConfig: { get: mockConfigGet },
-  };
-};
 
 beforeEach(() => {
   const reportingConfig: Record<string, any> = {
@@ -29,10 +24,7 @@ beforeEach(() => {
     'kibanaServer.protocol': 'http',
     'server.basePath': '/sbp',
   };
-  const mockConfigGet = jest.fn().mockImplementation((...keys: string[]) => {
-    return reportingConfig[keys.join('.') as string];
-  });
-  mockConfig = getMockConfig(mockConfigGet);
+  mockConfig = createMockConfig(reportingConfig);
 });
 
 const getMockJob = (base: object) => base as TaskPayloadPNG & TaskPayloadPDF;
diff --git a/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts b/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
index 15432d0cbd147..72b42143a24f7 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
@@ -6,6 +6,7 @@
 
 import nodeCrypto from '@elastic/node-crypto';
 import { ElasticsearchServiceSetup, IUiSettingsClient } from 'kibana/server';
+import moment from 'moment';
 // @ts-ignore
 import Puid from 'puid';
 import sinon from 'sinon';
@@ -73,6 +74,7 @@ describe('CSV Execute Job', function () {
 
   beforeEach(async function () {
     configGetStub = sinon.stub();
+    configGetStub.withArgs('queue', 'timeout').returns(moment.duration('2m'));
     configGetStub.withArgs('index').returns('.reporting-foo-test');
     configGetStub.withArgs('encryptionKey').returns(encryptionKey);
     configGetStub.withArgs('csv', 'maxSizeBytes').returns(1024 * 1000); // 1mB
diff --git a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts
index 06aa2434afc3f..e383f21143149 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts
@@ -6,11 +6,12 @@
 
 import { i18n } from '@kbn/i18n';
 import { IUiSettingsClient } from 'src/core/server';
-import { getFieldFormats } from '../../../services';
 import { ReportingConfig } from '../../../';
 import { CancellationToken } from '../../../../../../plugins/reporting/common';
 import { CSV_BOM_CHARS } from '../../../../common/constants';
+import { byteSizeValueToNumber } from '../../../../common/schema_utils';
 import { LevelLogger } from '../../../lib';
+import { getFieldFormats } from '../../../services';
 import { IndexPatternSavedObject, SavedSearchGeneratorResult } from '../types';
 import { checkIfRowsHaveFormulas } from './check_cells_for_formulas';
 import { createEscapeValue } from './escape_value';
@@ -64,7 +65,7 @@ export function createGenerateCsv(logger: LevelLogger) {
     );
     const escapeValue = createEscapeValue(settings.quoteValues, settings.escapeFormulaValues);
     const bom = config.get('csv', 'useByteOrderMarkEncoding') ? CSV_BOM_CHARS : '';
-    const builder = new MaxSizeStringBuilder(settings.maxSizeBytes, bom);
+    const builder = new MaxSizeStringBuilder(byteSizeValueToNumber(settings.maxSizeBytes), bom);
 
     const { fields, metaFields, conflictedTypesFields } = job;
     const header = `${fields.map(escapeValue).join(settings.separator)}\n`;
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts
index fdc51dc1c9c87..e7322bdc0d408 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts
@@ -10,7 +10,11 @@ import * as Rx from 'rxjs';
 import { ReportingCore } from '../../../';
 import { CancellationToken } from '../../../../common';
 import { cryptoFactory, LevelLogger } from '../../../lib';
-import { createMockReportingCore } from '../../../test_helpers';
+import {
+  createMockConfig,
+  createMockConfigSchema,
+  createMockReportingCore,
+} from '../../../test_helpers';
 import { generatePdfObservableFactory } from '../lib/generate_pdf';
 import { TaskPayloadPDF } from '../types';
 import { runTaskFnFactory } from './';
@@ -39,20 +43,16 @@ const encryptHeaders = async (headers: Record<string, string>) => {
 const getBasePayload = (baseObj: any) => baseObj as TaskPayloadPDF;
 
 beforeEach(async () => {
-  const kbnConfig = {
-    'server.basePath': '/sbp',
-  };
   const reportingConfig = {
+    'server.basePath': '/sbp',
     index: '.reports-test',
     encryptionKey: mockEncryptionKey,
     'kibanaServer.hostname': 'localhost',
     'kibanaServer.port': 5601,
     'kibanaServer.protocol': 'http',
   };
-  const mockReportingConfig = {
-    get: (...keys: string[]) => (reportingConfig as any)[keys.join('.')],
-    kbnConfig: { get: (...keys: string[]) => (kbnConfig as any)[keys.join('.')] },
-  };
+  const mockSchema = createMockConfigSchema(reportingConfig);
+  const mockReportingConfig = createMockConfig(mockSchema);
 
   mockReporting = await createMockReportingCore(mockReportingConfig);
 
@@ -79,7 +79,7 @@ test(`passes browserTimezone to generatePdf`, async () => {
   const generatePdfObservable = (await generatePdfObservableFactory(mockReporting)) as jest.Mock;
   generatePdfObservable.mockReturnValue(Rx.of(Buffer.from('')));
 
-  const runTask = await runTaskFnFactory(mockReporting, getMockLogger());
+  const runTask = runTaskFnFactory(mockReporting, getMockLogger());
   const browserTimezone = 'UTC';
   await runTask(
     'pdfJobId',
@@ -98,7 +98,7 @@ test(`passes browserTimezone to generatePdf`, async () => {
 
 test(`returns content_type of application/pdf`, async () => {
   const logger = getMockLogger();
-  const runTask = await runTaskFnFactory(mockReporting, logger);
+  const runTask = runTaskFnFactory(mockReporting, logger);
   const encryptedHeaders = await encryptHeaders({});
 
   const generatePdfObservable = await generatePdfObservableFactory(mockReporting);
@@ -117,7 +117,7 @@ test(`returns content of generatePdf getBuffer base64 encoded`, async () => {
   const generatePdfObservable = await generatePdfObservableFactory(mockReporting);
   (generatePdfObservable as jest.Mock).mockReturnValue(Rx.of({ buffer: Buffer.from(testContent) }));
 
-  const runTask = await runTaskFnFactory(mockReporting, getMockLogger());
+  const runTask = runTaskFnFactory(mockReporting, getMockLogger());
   const encryptedHeaders = await encryptHeaders({});
   const { content } = await runTask(
     'pdfJobId',
diff --git a/x-pack/plugins/reporting/server/lib/create_worker.test.ts b/x-pack/plugins/reporting/server/lib/create_worker.test.ts
index 85188c07eeb20..1fcd750849331 100644
--- a/x-pack/plugins/reporting/server/lib/create_worker.test.ts
+++ b/x-pack/plugins/reporting/server/lib/create_worker.test.ts
@@ -6,7 +6,12 @@
 
 import * as sinon from 'sinon';
 import { ReportingConfig, ReportingCore } from '../../server';
-import { createMockReportingCore } from '../test_helpers';
+import {
+  createMockConfig,
+  createMockConfigSchema,
+  createMockLevelLogger,
+  createMockReportingCore,
+} from '../test_helpers';
 import { createWorkerFactory } from './create_worker';
 // @ts-ignore
 import { Esqueue } from './esqueue';
@@ -14,16 +19,13 @@ import { Esqueue } from './esqueue';
 import { ClientMock } from './esqueue/__tests__/fixtures/legacy_elasticsearch';
 import { ExportTypesRegistry } from './export_types_registry';
 
-const configGetStub = sinon.stub();
-configGetStub.withArgs('queue').returns({
-  pollInterval: 3300,
-  pollIntervalErrorMultiplier: 10,
-});
-configGetStub.withArgs('server', 'name').returns('test-server-123');
-configGetStub.withArgs('server', 'uuid').returns('g9ymiujthvy6v8yrh7567g6fwzgzftzfr');
+const logger = createMockLevelLogger();
+const reportingConfig = {
+  queue: { pollInterval: 3300, pollIntervalErrorMultiplier: 10 },
+  server: { name: 'test-server-123', uuid: 'g9ymiujthvy6v8yrh7567g6fwzgzftzfr' },
+};
 
 const executeJobFactoryStub = sinon.stub();
-const getMockLogger = sinon.stub();
 
 const getMockExportTypesRegistry = (
   exportTypes: any[] = [{ runTaskFnFactory: executeJobFactoryStub }]
@@ -39,18 +41,18 @@ describe('Create Worker', () => {
   let client: ClientMock;
 
   beforeEach(async () => {
-    mockConfig = { get: configGetStub, kbnConfig: { get: configGetStub } };
+    const mockSchema = createMockConfigSchema(reportingConfig);
+    mockConfig = createMockConfig(mockSchema);
     mockReporting = await createMockReportingCore(mockConfig);
     mockReporting.getExportTypesRegistry = () => getMockExportTypesRegistry();
-    // @ts-ignore over-riding config manually
-    mockReporting.config = mockConfig;
+
     client = new ClientMock();
     queue = new Esqueue('reporting-queue', { client });
     executeJobFactoryStub.reset();
   });
 
   test('Creates a single Esqueue worker for Reporting', async () => {
-    const createWorker = createWorkerFactory(mockReporting, getMockLogger());
+    const createWorker = createWorkerFactory(mockReporting, logger);
     const registerWorkerSpy = sinon.spy(queue, 'registerWorker');
 
     await createWorker(queue);
@@ -82,7 +84,7 @@ Object {
       { runTaskFnFactory: executeJobFactoryStub },
     ]);
     mockReporting.getExportTypesRegistry = () => exportTypesRegistry;
-    const createWorker = createWorkerFactory(mockReporting, getMockLogger());
+    const createWorker = createWorkerFactory(mockReporting, logger);
     const registerWorkerSpy = sinon.spy(queue, 'registerWorker');
 
     await createWorker(queue);
diff --git a/x-pack/plugins/reporting/server/lib/create_worker.ts b/x-pack/plugins/reporting/server/lib/create_worker.ts
index dd5c560455274..c1c88dd8a54ba 100644
--- a/x-pack/plugins/reporting/server/lib/create_worker.ts
+++ b/x-pack/plugins/reporting/server/lib/create_worker.ts
@@ -6,6 +6,7 @@
 
 import { CancellationToken } from '../../common';
 import { PLUGIN_ID } from '../../common/constants';
+import { durationToNumber } from '../../common/schema_utils';
 import { ReportingCore } from '../../server';
 import { LevelLogger } from '../../server/lib';
 import { ExportTypeDefinition, JobSource, RunTaskFn } from '../../server/types';
@@ -57,7 +58,7 @@ export function createWorkerFactory<JobParamsType>(reporting: ReportingCore, log
     const workerOptions = {
       kibanaName,
       kibanaId,
-      interval: queueConfig.pollInterval,
+      interval: durationToNumber(queueConfig.pollInterval),
       intervalErrorMultiplier: queueConfig.pollIntervalErrorMultiplier,
     };
     const worker = queue.registerWorker(PLUGIN_ID, workerFn, workerOptions);
diff --git a/x-pack/plugins/reporting/server/lib/layouts/preserve_layout.css b/x-pack/plugins/reporting/server/lib/layouts/preserve_layout.css
index 12ac5b27c7a4a..35590df90fbb9 100644
--- a/x-pack/plugins/reporting/server/lib/layouts/preserve_layout.css
+++ b/x-pack/plugins/reporting/server/lib/layouts/preserve_layout.css
@@ -36,7 +36,7 @@ filter-bar,
 /* hide unusable controls */
 discover-app .dscTimechart,
 discover-app .dscSidebar__container,
-discover-app .kbnCollapsibleSidebar__collapseButton,
+discover-app .dscCollapsibleSidebar__collapseButton,
 discover-app .discover-table-footer {
   display: none;
 }
diff --git a/x-pack/plugins/reporting/server/lib/layouts/print.css b/x-pack/plugins/reporting/server/lib/layouts/print.css
index 9b07e3c923138..3ff39974536d2 100644
--- a/x-pack/plugins/reporting/server/lib/layouts/print.css
+++ b/x-pack/plugins/reporting/server/lib/layouts/print.css
@@ -35,7 +35,7 @@ filter-bar,
 /* hide unusable controls */
 discover-app .dscTimechart,
 discover-app .dscSidebar__container,
-discover-app .kbnCollapsibleSidebar__collapseButton,
+discover-app .dscCollapsibleSidebar__collapseButton,
 discover-app .discover-table-footer {
   display: none;
 }
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/get_number_of_items.ts b/x-pack/plugins/reporting/server/lib/screenshots/get_number_of_items.ts
index 49c690e8c024d..89cb4221c96b2 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/get_number_of_items.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/get_number_of_items.ts
@@ -5,9 +5,10 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { durationToNumber } from '../../../common/schema_utils';
+import { LevelLogger, startTrace } from '../';
 import { HeadlessChromiumDriver } from '../../browsers';
 import { CaptureConfig } from '../../types';
-import { LevelLogger, startTrace } from '../';
 import { LayoutInstance } from '../layouts';
 import { CONTEXT_GETNUMBEROFITEMS, CONTEXT_READMETADATA } from './constants';
 
@@ -31,9 +32,10 @@ export const getNumberOfItems = async (
     // the dashboard is using the `itemsCountAttribute` attribute to let us
     // know how many items to expect since gridster incrementally adds panels
     // we have to use this hint to wait for all of them
+    const timeout = durationToNumber(captureConfig.timeouts.waitForElements);
     await browser.waitForSelector(
       `${renderCompleteSelector},[${itemsCountAttribute}]`,
-      { timeout: captureConfig.timeouts.waitForElements },
+      { timeout },
       { context: CONTEXT_READMETADATA },
       logger
     );
@@ -59,6 +61,7 @@ export const getNumberOfItems = async (
       logger
     );
   } catch (err) {
+    logger.error(err);
     throw new Error(
       i18n.translate('xpack.reporting.screencapture.readVisualizationsError', {
         defaultMessage: `An error occurred when trying to read the page for visualization panel info. You may need to increase '{configKey}'. {error}`,
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/inject_css.ts b/x-pack/plugins/reporting/server/lib/screenshots/inject_css.ts
index f893951815e9e..2fc711d4d6f07 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/inject_css.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/inject_css.ts
@@ -43,6 +43,7 @@ export const injectCustomCss = async (
       logger
     );
   } catch (err) {
+    logger.error(err);
     throw new Error(
       i18n.translate('xpack.reporting.screencapture.injectCss', {
         defaultMessage: `An error occurred when trying to update Kibana CSS for reporting. {error}`,
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/observable.test.ts b/x-pack/plugins/reporting/server/lib/screenshots/observable.test.ts
index 3749e4372bdab..5b671e9f5b47e 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/observable.test.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/observable.test.ts
@@ -15,12 +15,17 @@ jest.mock('../../browsers/chromium/puppeteer', () => ({
   }),
 }));
 
+import moment from 'moment';
 import * as Rx from 'rxjs';
-import { LevelLogger } from '../';
-import { loggingSystemMock } from '../../../../../../src/core/server/mocks';
 import { HeadlessChromiumDriver } from '../../browsers';
-import { createMockBrowserDriverFactory, createMockLayoutInstance } from '../../test_helpers';
-import { CaptureConfig, ConditionalHeaders } from '../../types';
+import {
+  createMockBrowserDriverFactory,
+  createMockConfig,
+  createMockConfigSchema,
+  createMockLayoutInstance,
+  createMockLevelLogger,
+} from '../../test_helpers';
+import { ConditionalHeaders } from '../../types';
 import { ElementsPositionAndAttribute } from './';
 import * as contexts from './constants';
 import { screenshotsObservableFactory } from './observable';
@@ -28,11 +33,22 @@ import { screenshotsObservableFactory } from './observable';
 /*
  * Mocks
  */
-const mockLogger = jest.fn(loggingSystemMock.create);
-const logger = new LevelLogger(mockLogger());
+const logger = createMockLevelLogger();
 
-const mockConfig = { timeouts: { openUrl: 13 } } as CaptureConfig;
-const mockLayout = createMockLayoutInstance(mockConfig);
+const reportingConfig = {
+  capture: {
+    loadDelay: moment.duration(2, 's'),
+    timeouts: {
+      openUrl: moment.duration(2, 'm'),
+      waitForElements: moment.duration(20, 's'),
+      renderComplete: moment.duration(10, 's'),
+    },
+  },
+};
+const mockSchema = createMockConfigSchema(reportingConfig);
+const mockConfig = createMockConfig(mockSchema);
+const captureConfig = mockConfig.get('capture');
+const mockLayout = createMockLayoutInstance(captureConfig);
 
 /*
  * Tests
@@ -45,7 +61,7 @@ describe('Screenshot Observable Pipeline', () => {
   });
 
   it('pipelines a single url into screenshot and timeRange', async () => {
-    const getScreenshots$ = screenshotsObservableFactory(mockConfig, mockBrowserDriverFactory);
+    const getScreenshots$ = screenshotsObservableFactory(captureConfig, mockBrowserDriverFactory);
     const result = await getScreenshots$({
       logger,
       urls: ['/welcome/home/start/index.htm'],
@@ -106,7 +122,7 @@ describe('Screenshot Observable Pipeline', () => {
     });
 
     // test
-    const getScreenshots$ = screenshotsObservableFactory(mockConfig, mockBrowserDriverFactory);
+    const getScreenshots$ = screenshotsObservableFactory(captureConfig, mockBrowserDriverFactory);
     const result = await getScreenshots$({
       logger,
       urls: ['/welcome/home/start/index2.htm', '/welcome/home/start/index.php3?page=./home.php'],
@@ -205,7 +221,7 @@ describe('Screenshot Observable Pipeline', () => {
       });
 
       // test
-      const getScreenshots$ = screenshotsObservableFactory(mockConfig, mockBrowserDriverFactory);
+      const getScreenshots$ = screenshotsObservableFactory(captureConfig, mockBrowserDriverFactory);
       const getScreenshot = async () => {
         return await getScreenshots$({
           logger,
@@ -300,7 +316,7 @@ describe('Screenshot Observable Pipeline', () => {
       });
 
       // test
-      const getScreenshots$ = screenshotsObservableFactory(mockConfig, mockBrowserDriverFactory);
+      const getScreenshots$ = screenshotsObservableFactory(captureConfig, mockBrowserDriverFactory);
       const getScreenshot = async () => {
         return await getScreenshots$({
           logger,
@@ -333,7 +349,7 @@ describe('Screenshot Observable Pipeline', () => {
       mockLayout.getViewport = () => null;
 
       // test
-      const getScreenshots$ = screenshotsObservableFactory(mockConfig, mockBrowserDriverFactory);
+      const getScreenshots$ = screenshotsObservableFactory(captureConfig, mockBrowserDriverFactory);
       const getScreenshot = async () => {
         return await getScreenshots$({
           logger,
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/open_url.ts b/x-pack/plugins/reporting/server/lib/screenshots/open_url.ts
index c21ef3b91fab3..e28f50851f4d9 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/open_url.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/open_url.ts
@@ -5,9 +5,10 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { durationToNumber } from '../../../common/schema_utils';
+import { LevelLogger, startTrace } from '../';
 import { HeadlessChromiumDriver } from '../../browsers';
 import { CaptureConfig, ConditionalHeaders } from '../../types';
-import { LevelLogger, startTrace } from '../';
 
 export const openUrl = async (
   captureConfig: CaptureConfig,
@@ -19,16 +20,14 @@ export const openUrl = async (
 ): Promise<void> => {
   const endTrace = startTrace('open_url', 'wait');
   try {
+    const timeout = durationToNumber(captureConfig.timeouts.openUrl);
     await browser.open(
       url,
-      {
-        conditionalHeaders,
-        waitForSelector: pageLoadSelector,
-        timeout: captureConfig.timeouts.openUrl,
-      },
+      { conditionalHeaders, waitForSelector: pageLoadSelector, timeout },
       logger
     );
   } catch (err) {
+    logger.error(err);
     throw new Error(
       i18n.translate('xpack.reporting.screencapture.couldntLoadKibana', {
         defaultMessage: `An error occurred when trying to open the Kibana URL. You may need to increase '{configKey}'. {error}`,
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/wait_for_render.ts b/x-pack/plugins/reporting/server/lib/screenshots/wait_for_render.ts
index f36a7b6f73664..edd4f71b2adac 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/wait_for_render.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/wait_for_render.ts
@@ -5,6 +5,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { durationToNumber } from '../../../common/schema_utils';
 import { HeadlessChromiumDriver } from '../../browsers';
 import { CaptureConfig } from '../../types';
 import { LevelLogger, startTrace } from '../';
@@ -67,7 +68,7 @@ export const waitForRenderComplete = async (
 
           return Promise.all(renderedTasks).then(hackyWaitForVisualizations);
         },
-        args: [layout.selectors.renderComplete, captureConfig.loadDelay],
+        args: [layout.selectors.renderComplete, durationToNumber(captureConfig.loadDelay)],
       },
       { context: CONTEXT_WAITFORRENDER },
       logger
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/wait_for_visualizations.ts b/x-pack/plugins/reporting/server/lib/screenshots/wait_for_visualizations.ts
index 779d00442522d..5f86a2b3bf00b 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/wait_for_visualizations.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/wait_for_visualizations.ts
@@ -5,8 +5,9 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { HeadlessChromiumDriver } from '../../browsers';
+import { durationToNumber } from '../../../common/schema_utils';
 import { LevelLogger, startTrace } from '../';
+import { HeadlessChromiumDriver } from '../../browsers';
 import { CaptureConfig } from '../../types';
 import { LayoutInstance } from '../layouts';
 import { CONTEXT_WAITFORELEMENTSTOBEINDOM } from './constants';
@@ -25,7 +26,7 @@ const getCompletedItemsCount = ({ renderCompleteSelector }: SelectorArgs) => {
 export const waitForVisualizations = async (
   captureConfig: CaptureConfig,
   browser: HeadlessChromiumDriver,
-  itemsCount: number,
+  toEqual: number,
   layout: LayoutInstance,
   logger: LevelLogger
 ): Promise<void> => {
@@ -35,29 +36,26 @@ export const waitForVisualizations = async (
   logger.debug(
     i18n.translate('xpack.reporting.screencapture.waitingForRenderedElements', {
       defaultMessage: `waiting for {itemsCount} rendered elements to be in the DOM`,
-      values: { itemsCount },
+      values: { itemsCount: toEqual },
     })
   );
 
   try {
+    const timeout = durationToNumber(captureConfig.timeouts.renderComplete);
     await browser.waitFor(
-      {
-        fn: getCompletedItemsCount,
-        args: [{ renderCompleteSelector }],
-        toEqual: itemsCount,
-        timeout: captureConfig.timeouts.renderComplete,
-      },
+      { fn: getCompletedItemsCount, args: [{ renderCompleteSelector }], toEqual, timeout },
       { context: CONTEXT_WAITFORELEMENTSTOBEINDOM },
       logger
     );
 
-    logger.debug(`found ${itemsCount} rendered elements in the DOM`);
+    logger.debug(`found ${toEqual} rendered elements in the DOM`);
   } catch (err) {
+    logger.error(err);
     throw new Error(
       i18n.translate('xpack.reporting.screencapture.couldntFinishRendering', {
         defaultMessage: `An error occurred when trying to wait for {count} visualizations to finish rendering. You may need to increase '{configKey}'. {error}`,
         values: {
-          count: itemsCount,
+          count: toEqual,
           configKey: 'xpack.reporting.capture.timeouts.renderComplete',
           error: err,
         },
diff --git a/x-pack/plugins/reporting/server/lib/store/index_timestamp.ts b/x-pack/plugins/reporting/server/lib/store/index_timestamp.ts
index 71ce0b1e572f8..7b8b851f5bd72 100644
--- a/x-pack/plugins/reporting/server/lib/store/index_timestamp.ts
+++ b/x-pack/plugins/reporting/server/lib/store/index_timestamp.ts
@@ -8,7 +8,6 @@ import moment, { unitOfTime } from 'moment';
 
 export const intervals = ['year', 'month', 'week', 'day', 'hour', 'minute'];
 
-// TODO: This helper function can be removed by using `schema.duration` objects in the reporting config schema
 export function indexTimestamp(intervalStr: string, separator = '-') {
   const startOf = intervalStr as unitOfTime.StartOf;
   if (separator.match(/[a-z]/i)) throw new Error('Interval separator can not be a letter');
diff --git a/x-pack/plugins/reporting/server/lib/store/store.test.ts b/x-pack/plugins/reporting/server/lib/store/store.test.ts
index b87466ca289cf..8dc4edd200052 100644
--- a/x-pack/plugins/reporting/server/lib/store/store.test.ts
+++ b/x-pack/plugins/reporting/server/lib/store/store.test.ts
@@ -7,15 +7,15 @@
 import sinon from 'sinon';
 import { ElasticsearchServiceSetup } from 'src/core/server';
 import { ReportingConfig, ReportingCore } from '../..';
-import { createMockReportingCore, createMockLevelLogger } from '../../test_helpers';
+import {
+  createMockConfig,
+  createMockConfigSchema,
+  createMockLevelLogger,
+  createMockReportingCore,
+} from '../../test_helpers';
 import { Report } from './report';
 import { ReportingStore } from './store';
 
-const getMockConfig = (mockConfigGet: sinon.SinonStub) => ({
-  get: mockConfigGet,
-  kbnConfig: { get: mockConfigGet },
-});
-
 describe('ReportingStore', () => {
   const mockLogger = createMockLevelLogger();
   let mockConfig: ReportingConfig;
@@ -25,10 +25,12 @@ describe('ReportingStore', () => {
   const mockElasticsearch = { legacy: { client: { callAsInternalUser: callClusterStub } } };
 
   beforeEach(async () => {
-    const mockConfigGet = sinon.stub();
-    mockConfigGet.withArgs('index').returns('.reporting-test');
-    mockConfigGet.withArgs('queue', 'indexInterval').returns('week');
-    mockConfig = getMockConfig(mockConfigGet);
+    const reportingConfig = {
+      index: '.reporting-test',
+      queue: { indexInterval: 'week' },
+    };
+    const mockSchema = createMockConfigSchema(reportingConfig);
+    mockConfig = createMockConfig(mockSchema);
     mockCore = await createMockReportingCore(mockConfig);
 
     callClusterStub.reset();
@@ -67,15 +69,17 @@ describe('ReportingStore', () => {
         priority: 10,
         started_at: undefined,
         status: 'pending',
-        timeout: undefined,
+        timeout: 120000,
       });
     });
 
     it('throws if options has invalid indexInterval', async () => {
-      const mockConfigGet = sinon.stub();
-      mockConfigGet.withArgs('index').returns('.reporting-test');
-      mockConfigGet.withArgs('queue', 'indexInterval').returns('centurially');
-      mockConfig = getMockConfig(mockConfigGet);
+      const reportingConfig = {
+        index: '.reporting-test',
+        queue: { indexInterval: 'centurially' },
+      };
+      const mockSchema = createMockConfigSchema(reportingConfig);
+      mockConfig = createMockConfig(mockSchema);
       mockCore = await createMockReportingCore(mockConfig);
 
       const store = new ReportingStore(mockCore, mockLogger);
@@ -159,7 +163,7 @@ describe('ReportingStore', () => {
         priority: 10,
         started_at: undefined,
         status: 'pending',
-        timeout: undefined,
+        timeout: 120000,
       });
     });
 
@@ -190,7 +194,7 @@ describe('ReportingStore', () => {
         priority: 10,
         started_at: undefined,
         status: 'pending',
-        timeout: undefined,
+        timeout: 120000,
       });
     });
   });
diff --git a/x-pack/plugins/reporting/server/lib/store/store.ts b/x-pack/plugins/reporting/server/lib/store/store.ts
index b1309cbdeb94d..0aae8b567bcdb 100644
--- a/x-pack/plugins/reporting/server/lib/store/store.ts
+++ b/x-pack/plugins/reporting/server/lib/store/store.ts
@@ -5,6 +5,7 @@
  */
 
 import { ElasticsearchServiceSetup } from 'src/core/server';
+import { durationToNumber } from '../../../common/schema_utils';
 import { LevelLogger, statuses } from '../';
 import { ReportingCore } from '../../';
 import { BaseParams, BaseParamsEncryptedFields, ReportingUser } from '../../types';
@@ -45,7 +46,7 @@ export class ReportingStore {
     this.indexPrefix = config.get('index');
     this.indexInterval = config.get('queue', 'indexInterval');
     this.jobSettings = {
-      timeout: config.get('queue', 'timeout'),
+      timeout: durationToNumber(config.get('queue', 'timeout')),
       browser_type: config.get('capture', 'browser', 'type'),
       max_attempts: config.get('capture', 'maxAttempts'),
       priority: 10, // unused
diff --git a/x-pack/plugins/reporting/server/plugin.test.ts b/x-pack/plugins/reporting/server/plugin.test.ts
index d323a281c06ff..3f2f472ab0623 100644
--- a/x-pack/plugins/reporting/server/plugin.test.ts
+++ b/x-pack/plugins/reporting/server/plugin.test.ts
@@ -32,8 +32,8 @@ describe('Reporting Plugin', () => {
   beforeEach(async () => {
     configSchema = createMockConfigSchema();
     initContext = coreMock.createPluginInitializerContext(configSchema);
-    coreSetup = await coreMock.createSetup(configSchema);
-    coreStart = await coreMock.createStart();
+    coreSetup = coreMock.createSetup(configSchema);
+    coreStart = coreMock.createStart();
     pluginSetup = ({
       licensing: {},
       features: featuresPluginMock.createSetup(),
diff --git a/x-pack/plugins/reporting/server/routes/diagnostic/browser.test.ts b/x-pack/plugins/reporting/server/routes/diagnostic/browser.test.ts
index f92fbfc7013cf..71ca0661a42a9 100644
--- a/x-pack/plugins/reporting/server/routes/diagnostic/browser.test.ts
+++ b/x-pack/plugins/reporting/server/routes/diagnostic/browser.test.ts
@@ -33,7 +33,15 @@ describe('POST /diagnose/browser', () => {
   const mockedCreateInterface: any = createInterface;
 
   const config = {
-    get: jest.fn().mockImplementation(() => ({})),
+    get: jest.fn().mockImplementation((...keys) => {
+      const key = keys.join('.');
+      switch (key) {
+        case 'queue.timeout':
+          return 120000;
+        case 'capture.browser.chromium.proxy':
+          return { enabled: false };
+      }
+    }),
     kbnConfig: { get: jest.fn() },
   };
 
diff --git a/x-pack/plugins/reporting/server/routes/diagnostic/browser.ts b/x-pack/plugins/reporting/server/routes/diagnostic/browser.ts
index 24b85220defb4..33620bc9a0038 100644
--- a/x-pack/plugins/reporting/server/routes/diagnostic/browser.ts
+++ b/x-pack/plugins/reporting/server/routes/diagnostic/browser.ts
@@ -54,25 +54,30 @@ export const registerDiagnoseBrowser = (reporting: ReportingCore, logger: Logger
       validate: {},
     },
     userHandler(async (user, context, req, res) => {
-      const logs = await browserStartLogs(reporting, logger).toPromise();
-      const knownIssues = Object.keys(logsToHelpMap) as Array<keyof typeof logsToHelpMap>;
+      try {
+        const logs = await browserStartLogs(reporting, logger).toPromise();
+        const knownIssues = Object.keys(logsToHelpMap) as Array<keyof typeof logsToHelpMap>;
 
-      const boundSuccessfully = logs.includes(`DevTools listening on`);
-      const help = knownIssues.reduce((helpTexts: string[], knownIssue) => {
-        const helpText = logsToHelpMap[knownIssue];
-        if (logs.includes(knownIssue)) {
-          helpTexts.push(helpText);
-        }
-        return helpTexts;
-      }, []);
+        const boundSuccessfully = logs.includes(`DevTools listening on`);
+        const help = knownIssues.reduce((helpTexts: string[], knownIssue) => {
+          const helpText = logsToHelpMap[knownIssue];
+          if (logs.includes(knownIssue)) {
+            helpTexts.push(helpText);
+          }
+          return helpTexts;
+        }, []);
 
-      const response: DiagnosticResponse = {
-        success: boundSuccessfully && !help.length,
-        help,
-        logs,
-      };
+        const response: DiagnosticResponse = {
+          success: boundSuccessfully && !help.length,
+          help,
+          logs,
+        };
 
-      return res.ok({ body: response });
+        return res.ok({ body: response });
+      } catch (err) {
+        logger.error(err);
+        return res.custom({ statusCode: 500 });
+      }
     })
   );
 };
diff --git a/x-pack/plugins/reporting/server/routes/diagnostic/config.test.ts b/x-pack/plugins/reporting/server/routes/diagnostic/config.test.ts
index 624397246656d..a112d04f38c7b 100644
--- a/x-pack/plugins/reporting/server/routes/diagnostic/config.test.ts
+++ b/x-pack/plugins/reporting/server/routes/diagnostic/config.test.ts
@@ -35,7 +35,15 @@ describe('POST /diagnose/config', () => {
     } as unknown) as any;
 
     config = {
-      get: jest.fn(),
+      get: jest.fn().mockImplementation((...keys) => {
+        const key = keys.join('.');
+        switch (key) {
+          case 'queue.timeout':
+            return 120000;
+          case 'csv.maxSizeBytes':
+            return 1024;
+        }
+      }),
       kbnConfig: { get: jest.fn() },
     };
 
diff --git a/x-pack/plugins/reporting/server/routes/diagnostic/config.ts b/x-pack/plugins/reporting/server/routes/diagnostic/config.ts
index 198ba63e2614d..95c3a05bbf680 100644
--- a/x-pack/plugins/reporting/server/routes/diagnostic/config.ts
+++ b/x-pack/plugins/reporting/server/routes/diagnostic/config.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { ByteSizeValue } from '@kbn/config-schema';
 import { i18n } from '@kbn/i18n';
-import numeral from '@elastic/numeral';
 import { defaults, get } from 'lodash';
 import { ReportingCore } from '../..';
 import { API_DIAGNOSE_URL } from '../../../common/constants';
@@ -16,6 +16,14 @@ import { authorizedUserPreRoutingFactory } from '../lib/authorized_user_pre_rout
 const KIBANA_MAX_SIZE_BYTES_PATH = 'csv.maxSizeBytes';
 const ES_MAX_SIZE_BYTES_PATH = 'http.max_content_length';
 
+const numberToByteSizeValue = (value: number | ByteSizeValue) => {
+  if (typeof value === 'number') {
+    return new ByteSizeValue(value);
+  }
+
+  return value;
+};
+
 export const registerDiagnoseConfig = (reporting: ReportingCore, logger: Logger) => {
   const setupDeps = reporting.getPluginSetupDeps();
   const userHandler = authorizedUserPreRoutingFactory(reporting);
@@ -42,12 +50,10 @@ export const registerDiagnoseConfig = (reporting: ReportingCore, logger: Logger)
         'http.max_content_length',
         '100mb'
       );
-      const elasticSearchMaxContentBytes = numeral().unformat(
-        elasticSearchMaxContent.toUpperCase()
-      );
-      const kibanaMaxContentBytes = config.get('csv', 'maxSizeBytes');
+      const elasticSearchMaxContentBytes = ByteSizeValue.parse(elasticSearchMaxContent);
+      const kibanaMaxContentBytes = numberToByteSizeValue(config.get('csv', 'maxSizeBytes'));
 
-      if (kibanaMaxContentBytes > elasticSearchMaxContentBytes) {
+      if (kibanaMaxContentBytes.isGreaterThan(elasticSearchMaxContentBytes)) {
         const maxContentSizeWarning = i18n.translate(
           'xpack.reporting.diagnostic.configSizeMismatch',
           {
@@ -55,8 +61,8 @@ export const registerDiagnoseConfig = (reporting: ReportingCore, logger: Logger)
               `xpack.reporting.{KIBANA_MAX_SIZE_BYTES_PATH} ({kibanaMaxContentBytes}) is higher than ElasticSearch's {ES_MAX_SIZE_BYTES_PATH} ({elasticSearchMaxContentBytes}). ` +
               `Please set {ES_MAX_SIZE_BYTES_PATH} in ElasticSearch to match, or lower your xpack.reporting.{KIBANA_MAX_SIZE_BYTES_PATH} in Kibana.`,
             values: {
-              kibanaMaxContentBytes,
-              elasticSearchMaxContentBytes,
+              kibanaMaxContentBytes: kibanaMaxContentBytes.getValueInBytes(),
+              elasticSearchMaxContentBytes: elasticSearchMaxContentBytes.getValueInBytes(),
               KIBANA_MAX_SIZE_BYTES_PATH,
               ES_MAX_SIZE_BYTES_PATH,
             },
diff --git a/x-pack/plugins/reporting/server/routes/diagnostic/screenshot.test.ts b/x-pack/plugins/reporting/server/routes/diagnostic/screenshot.test.ts
index ec4ab0446ae5f..287da0d2ed5ec 100644
--- a/x-pack/plugins/reporting/server/routes/diagnostic/screenshot.test.ts
+++ b/x-pack/plugins/reporting/server/routes/diagnostic/screenshot.test.ts
@@ -33,7 +33,11 @@ describe('POST /diagnose/screenshot', () => {
   };
 
   const config = {
-    get: jest.fn(),
+    get: jest.fn().mockImplementation((...keys) => {
+      if (keys.join('.') === 'queue.timeout') {
+        return 120000;
+      }
+    }),
     kbnConfig: { get: jest.fn() },
   };
   const mockLogger = createMockLevelLogger();
diff --git a/x-pack/plugins/reporting/server/routes/jobs.test.ts b/x-pack/plugins/reporting/server/routes/jobs.test.ts
index 2957bc76f4682..187c69f4a72ef 100644
--- a/x-pack/plugins/reporting/server/routes/jobs.test.ts
+++ b/x-pack/plugins/reporting/server/routes/jobs.test.ts
@@ -10,9 +10,8 @@ import { setupServer } from 'src/core/server/test_utils';
 import supertest from 'supertest';
 import { ReportingCore } from '..';
 import { ReportingInternalSetup } from '../core';
-import { LevelLogger } from '../lib';
 import { ExportTypesRegistry } from '../lib/export_types_registry';
-import { createMockReportingCore } from '../test_helpers';
+import { createMockConfig, createMockConfigSchema, createMockReportingCore } from '../test_helpers';
 import { ExportTypeDefinition } from '../types';
 import { registerJobInfoRoutes } from './jobs';
 
@@ -25,11 +24,7 @@ describe('GET /api/reporting/jobs/download', () => {
   let exportTypesRegistry: ExportTypesRegistry;
   let core: ReportingCore;
 
-  const config = { get: jest.fn(), kbnConfig: { get: jest.fn() } };
-  const mockLogger = ({
-    error: jest.fn(),
-    debug: jest.fn(),
-  } as unknown) as jest.Mocked<LevelLogger>;
+  const config = createMockConfig(createMockConfigSchema());
 
   const getHits = (...sources: any) => {
     return {
@@ -86,8 +81,6 @@ describe('GET /api/reporting/jobs/download', () => {
   });
 
   afterEach(async () => {
-    mockLogger.debug.mockReset();
-    mockLogger.error.mockReset();
     await server.stop();
   });
 
diff --git a/x-pack/plugins/reporting/server/routes/lib/authorized_user_pre_routing.test.ts b/x-pack/plugins/reporting/server/routes/lib/authorized_user_pre_routing.test.ts
index 50780a577af02..932ebfdd22bbc 100644
--- a/x-pack/plugins/reporting/server/routes/lib/authorized_user_pre_routing.test.ts
+++ b/x-pack/plugins/reporting/server/routes/lib/authorized_user_pre_routing.test.ts
@@ -4,24 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { KibanaRequest, RequestHandlerContext, KibanaResponseFactory } from 'kibana/server';
+import { KibanaRequest, KibanaResponseFactory, RequestHandlerContext } from 'kibana/server';
 import { coreMock, httpServerMock } from 'src/core/server/mocks';
 import { ReportingCore } from '../../';
-import { createMockReportingCore } from '../../test_helpers';
-import { authorizedUserPreRoutingFactory } from './authorized_user_pre_routing';
 import { ReportingInternalSetup } from '../../core';
+import {
+  createMockConfig,
+  createMockConfigSchema,
+  createMockReportingCore,
+} from '../../test_helpers';
+import { authorizedUserPreRoutingFactory } from './authorized_user_pre_routing';
 
 let mockCore: ReportingCore;
-const kbnConfig = {
-  'server.basePath': '/sbp',
-};
-const reportingConfig = {
-  'roles.allow': ['reporting_user'],
-};
-const mockReportingConfig = {
-  get: (...keys: string[]) => (reportingConfig as any)[keys.join('.')] || 'whoah!',
-  kbnConfig: { get: (...keys: string[]) => (kbnConfig as any)[keys.join('.')] },
-};
+const mockConfig: any = { 'server.basePath': '/sbp', 'roles.allow': ['reporting_user'] };
+const mockReportingConfigSchema = createMockConfigSchema(mockConfig);
+const mockReportingConfig = createMockConfig(mockReportingConfigSchema);
 
 const getMockContext = () =>
   (({
diff --git a/x-pack/plugins/reporting/server/test_helpers/create_mock_browserdriverfactory.ts b/x-pack/plugins/reporting/server/test_helpers/create_mock_browserdriverfactory.ts
index f2785bce10964..d6996d2caf1bc 100644
--- a/x-pack/plugins/reporting/server/test_helpers/create_mock_browserdriverfactory.ts
+++ b/x-pack/plugins/reporting/server/test_helpers/create_mock_browserdriverfactory.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import moment from 'moment';
 import { Page } from 'puppeteer';
 import * as Rx from 'rxjs';
 import { chromium, HeadlessChromiumDriver, HeadlessChromiumDriverFactory } from '../browsers';
@@ -15,6 +16,7 @@ import { CaptureConfig } from '../types';
 interface CreateMockBrowserDriverFactoryOpts {
   evaluate: jest.Mock<Promise<any>, any[]>;
   waitForSelector: jest.Mock<Promise<any>, any[]>;
+  waitFor: jest.Mock<Promise<any>, any[]>;
   screenshot: jest.Mock<Promise<any>, any[]>;
   open: jest.Mock<Promise<any>, any[]>;
   getCreatePage: (driver: HeadlessChromiumDriver) => jest.Mock<any, any>;
@@ -86,6 +88,7 @@ const getCreatePage = (driver: HeadlessChromiumDriver) =>
 const defaultOpts: CreateMockBrowserDriverFactoryOpts = {
   evaluate: mockBrowserEvaluate,
   waitForSelector: mockWaitForSelector,
+  waitFor: jest.fn(),
   screenshot: mockScreenshot,
   open: jest.fn(),
   getCreatePage,
@@ -96,7 +99,11 @@ export const createMockBrowserDriverFactory = async (
   opts: Partial<CreateMockBrowserDriverFactoryOpts> = {}
 ): Promise<HeadlessChromiumDriverFactory> => {
   const captureConfig: CaptureConfig = {
-    timeouts: { openUrl: 30000, waitForElements: 30000, renderComplete: 30000 },
+    timeouts: {
+      openUrl: moment.duration(60, 's'),
+      waitForElements: moment.duration(30, 's'),
+      renderComplete: moment.duration(30, 's'),
+    },
     browser: {
       type: 'chromium',
       chromium: {
@@ -108,18 +115,14 @@ export const createMockBrowserDriverFactory = async (
     },
     networkPolicy: { enabled: true, rules: [] },
     viewport: { width: 800, height: 600 },
-    loadDelay: 2000,
+    loadDelay: moment.duration(2, 's'),
     zoom: 2,
     maxAttempts: 1,
   };
 
   const binaryPath = '/usr/local/share/common/secure/super_awesome_binary';
-  const mockBrowserDriverFactory = await chromium.createDriverFactory(
-    binaryPath,
-    captureConfig,
-    logger
-  );
-  const mockPage = {} as Page;
+  const mockBrowserDriverFactory = chromium.createDriverFactory(binaryPath, captureConfig, logger);
+  const mockPage = ({ setViewport: () => {} } as unknown) as Page;
   const mockBrowserDriver = new HeadlessChromiumDriver(mockPage, {
     inspect: true,
     networkPolicy: captureConfig.networkPolicy,
@@ -127,6 +130,7 @@ export const createMockBrowserDriverFactory = async (
 
   // mock the driver methods as either default mocks or passed-in
   mockBrowserDriver.waitForSelector = opts.waitForSelector ? opts.waitForSelector : defaultOpts.waitForSelector; // prettier-ignore
+  mockBrowserDriver.waitFor = opts.waitFor ? opts.waitFor : defaultOpts.waitFor;
   mockBrowserDriver.evaluate = opts.evaluate ? opts.evaluate : defaultOpts.evaluate;
   mockBrowserDriver.screenshot = opts.screenshot ? opts.screenshot : defaultOpts.screenshot;
   mockBrowserDriver.open = opts.open ? opts.open : defaultOpts.open;
diff --git a/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts b/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
index 559726e0b8a99..6ec35db5caec6 100644
--- a/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
+++ b/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
@@ -9,14 +9,16 @@ jest.mock('../usage');
 jest.mock('../browsers');
 jest.mock('../lib/create_queue');
 
+import _ from 'lodash';
 import * as Rx from 'rxjs';
-import { featuresPluginMock } from '../../../features/server/mocks';
 import { ReportingConfig, ReportingCore } from '../';
+import { featuresPluginMock } from '../../../features/server/mocks';
 import {
   chromium,
   HeadlessChromiumDriverFactory,
   initializeBrowserDriverFactory,
 } from '../browsers';
+import { ReportingConfigType } from '../config';
 import { ReportingInternalSetup, ReportingInternalStart } from '../core';
 import { ReportingStore } from '../lib';
 import { ReportingStartDeps } from '../types';
@@ -57,12 +59,58 @@ const createMockPluginStart = (
   };
 };
 
-export const createMockConfigSchema = (overrides?: any) => ({
-  index: '.reporting',
-  kibanaServer: { hostname: 'localhost', port: '80' },
-  capture: { browser: { chromium: { disableSandbox: true } } },
-  ...overrides,
-});
+interface ReportingConfigTestType {
+  index: string;
+  encryptionKey: string;
+  queue: Partial<ReportingConfigType['queue']>;
+  kibanaServer: Partial<ReportingConfigType['kibanaServer']>;
+  csv: Partial<ReportingConfigType['csv']>;
+  capture: any;
+  server?: any;
+}
+
+export const createMockConfigSchema = (
+  overrides: Partial<ReportingConfigTestType> = {}
+): ReportingConfigTestType => {
+  // deeply merge the defaults and the provided partial schema
+  return {
+    index: '.reporting',
+    encryptionKey: 'cool-encryption-key-where-did-you-find-it',
+    ...overrides,
+    kibanaServer: {
+      hostname: 'localhost',
+      port: 80,
+      ...overrides.kibanaServer,
+    },
+    capture: {
+      browser: {
+        chromium: {
+          disableSandbox: true,
+        },
+      },
+      ...overrides.capture,
+    },
+    queue: {
+      timeout: 120000,
+      ...overrides.queue,
+    },
+    csv: {
+      ...overrides.csv,
+    },
+  };
+};
+
+export const createMockConfig = (
+  reportingConfig: Partial<ReportingConfigTestType>
+): ReportingConfig => {
+  const mockConfigGet = jest.fn().mockImplementation((...keys: string[]) => {
+    return _.get(reportingConfig, keys.join('.'));
+  });
+  return {
+    get: mockConfigGet,
+    kbnConfig: { get: mockConfigGet },
+  };
+};
 
 export const createMockStartDeps = (startMock?: any): ReportingStartDeps => ({
   data: startMock.data,
diff --git a/x-pack/plugins/reporting/server/test_helpers/index.ts b/x-pack/plugins/reporting/server/test_helpers/index.ts
index 2d5ef9fdd768d..96357dc915eef 100644
--- a/x-pack/plugins/reporting/server/test_helpers/index.ts
+++ b/x-pack/plugins/reporting/server/test_helpers/index.ts
@@ -4,8 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { createMockServer } from './create_mock_server';
-export { createMockReportingCore, createMockConfigSchema } from './create_mock_reportingplugin';
 export { createMockBrowserDriverFactory } from './create_mock_browserdriverfactory';
 export { createMockLayoutInstance } from './create_mock_layoutinstance';
 export { createMockLevelLogger } from './create_mock_levellogger';
+export {
+  createMockConfig,
+  createMockConfigSchema,
+  createMockReportingCore,
+} from './create_mock_reportingplugin';
+export { createMockServer } from './create_mock_server';
diff --git a/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts b/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts
index 213bea3bc3eec..1211d4c2cf1c3 100644
--- a/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts
+++ b/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts
@@ -5,7 +5,7 @@
  */
 
 import { get } from 'lodash';
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { LegacyAPICaller } from 'kibana/server';
 import { ReportingConfig } from '../';
 import { ExportTypesRegistry } from '../lib/export_types_registry';
 import { GetLicense } from './';
@@ -118,7 +118,7 @@ async function handleResponse(response: SearchResponse): Promise<Partial<RangeSt
 export async function getReportingUsage(
   config: ReportingConfig,
   getLicense: GetLicense,
-  callCluster: CallCluster,
+  callCluster: LegacyAPICaller,
   exportTypesRegistry: ExportTypesRegistry
 ): Promise<ReportingUsageType> {
   const reportingIndex = config.get('index');
diff --git a/x-pack/plugins/reporting/server/usage/reporting_usage_collector.test.ts b/x-pack/plugins/reporting/server/usage/reporting_usage_collector.test.ts
index ed2abef2542de..fc2dce441c621 100644
--- a/x-pack/plugins/reporting/server/usage/reporting_usage_collector.test.ts
+++ b/x-pack/plugins/reporting/server/usage/reporting_usage_collector.test.ts
@@ -8,8 +8,8 @@ import * as Rx from 'rxjs';
 import sinon from 'sinon';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { ReportingConfig, ReportingCore } from '../';
-import { createMockReportingCore } from '../test_helpers';
 import { getExportTypesRegistry } from '../lib/export_types_registry';
+import { createMockConfig, createMockConfigSchema, createMockReportingCore } from '../test_helpers';
 import { ReportingSetupDeps } from '../types';
 import { FeaturesAvailability } from './';
 import {
@@ -54,17 +54,13 @@ function getPluginsMock(
   } as unknown) as ReportingSetupDeps & { usageCollection: UsageCollectionSetup };
 }
 
-const getMockReportingConfig = () => ({
-  get: () => {},
-  kbnConfig: { get: () => '' },
-});
 const getResponseMock = (base = {}) => base;
 
 describe('license checks', () => {
   let mockConfig: ReportingConfig;
   let mockCore: ReportingCore;
   beforeAll(async () => {
-    mockConfig = getMockReportingConfig();
+    mockConfig = createMockConfig(createMockConfigSchema());
     mockCore = await createMockReportingCore(mockConfig);
   });
 
@@ -189,7 +185,7 @@ describe('data modeling', () => {
   let mockConfig: ReportingConfig;
   let mockCore: ReportingCore;
   beforeAll(async () => {
-    mockConfig = getMockReportingConfig();
+    mockConfig = createMockConfig(createMockConfigSchema());
     mockCore = await createMockReportingCore(mockConfig);
   });
   test('with normal looking usage data', async () => {
@@ -455,7 +451,7 @@ describe('data modeling', () => {
 
 describe('Ready for collection observable', () => {
   test('converts observable to promise', async () => {
-    const mockConfig = getMockReportingConfig();
+    const mockConfig = createMockConfig(createMockConfigSchema());
     const mockReporting = await createMockReportingCore(mockConfig);
 
     const usageCollection = getMockUsageCollection();
diff --git a/x-pack/plugins/reporting/server/usage/reporting_usage_collector.ts b/x-pack/plugins/reporting/server/usage/reporting_usage_collector.ts
index 100d09a2da7e4..8f26579726ff1 100644
--- a/x-pack/plugins/reporting/server/usage/reporting_usage_collector.ts
+++ b/x-pack/plugins/reporting/server/usage/reporting_usage_collector.ts
@@ -5,7 +5,7 @@
  */
 
 import { first, map } from 'rxjs/operators';
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { LegacyAPICaller } from 'kibana/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { ReportingCore } from '../';
 import { ExportTypesRegistry } from '../lib/export_types_registry';
@@ -36,7 +36,7 @@ export function getReportingUsageCollector(
 ) {
   return usageCollection.makeUsageCollector<ReportingUsageType, XpackBulkUpload>({
     type: 'reporting',
-    fetch: (callCluster: CallCluster) => {
+    fetch: (callCluster: LegacyAPICaller) => {
       const config = reporting.getConfig();
       return getReportingUsage(config, getLicense, callCluster, exportTypesRegistry);
     },
diff --git a/x-pack/plugins/rollup/server/collectors/register.ts b/x-pack/plugins/rollup/server/collectors/register.ts
index aa06d3f696d00..daacc065629a4 100644
--- a/x-pack/plugins/rollup/server/collectors/register.ts
+++ b/x-pack/plugins/rollup/server/collectors/register.ts
@@ -6,7 +6,7 @@
 
 import { get } from 'lodash';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { LegacyAPICaller } from 'kibana/server';
 
 interface IdToFlagMap {
   [key: string]: boolean;
@@ -27,7 +27,7 @@ function createIdToFlagMap(ids: string[]) {
   }, {} as any);
 }
 
-async function fetchRollupIndexPatterns(kibanaIndex: string, callCluster: CallCluster) {
+async function fetchRollupIndexPatterns(kibanaIndex: string, callCluster: LegacyAPICaller) {
   const searchParams = {
     size: ES_MAX_RESULT_WINDOW_DEFAULT_VALUE,
     index: kibanaIndex,
@@ -56,7 +56,7 @@ async function fetchRollupIndexPatterns(kibanaIndex: string, callCluster: CallCl
 
 async function fetchRollupSavedSearches(
   kibanaIndex: string,
-  callCluster: CallCluster,
+  callCluster: LegacyAPICaller,
   rollupIndexPatternToFlagMap: IdToFlagMap
 ) {
   const searchParams = {
@@ -104,7 +104,7 @@ async function fetchRollupSavedSearches(
 
 async function fetchRollupVisualizations(
   kibanaIndex: string,
-  callCluster: CallCluster,
+  callCluster: LegacyAPICaller,
   rollupIndexPatternToFlagMap: IdToFlagMap,
   rollupSavedSearchesToFlagMap: IdToFlagMap
 ) {
@@ -211,7 +211,7 @@ export function registerRollupUsageCollector(
         total: { type: 'long' },
       },
     },
-    fetch: async (callCluster: CallCluster) => {
+    fetch: async (callCluster: LegacyAPICaller) => {
       const rollupIndexPatterns = await fetchRollupIndexPatterns(kibanaIndex, callCluster);
       const rollupIndexPatternToFlagMap = createIdToFlagMap(rollupIndexPatterns);
 
diff --git a/x-pack/plugins/rollup/server/lib/search_strategies/register_rollup_search_strategy.test.js b/x-pack/plugins/rollup/server/lib/search_strategies/register_rollup_search_strategy.test.js
index d466ebd69737e..8672a8b8f6849 100644
--- a/x-pack/plugins/rollup/server/lib/search_strategies/register_rollup_search_strategy.test.js
+++ b/x-pack/plugins/rollup/server/lib/search_strategies/register_rollup_search_strategy.test.js
@@ -6,21 +6,16 @@
 import { registerRollupSearchStrategy } from './register_rollup_search_strategy';
 
 describe('Register Rollup Search Strategy', () => {
-  let routeDependencies;
   let addSearchStrategy;
+  let getRollupService;
 
   beforeEach(() => {
-    routeDependencies = {
-      router: jest.fn().mockName('router'),
-      elasticsearchService: jest.fn().mockName('elasticsearchService'),
-      elasticsearch: jest.fn().mockName('elasticsearch'),
-    };
-
     addSearchStrategy = jest.fn().mockName('addSearchStrategy');
+    getRollupService = jest.fn().mockName('getRollupService');
   });
 
   test('should run initialization', () => {
-    registerRollupSearchStrategy(routeDependencies, addSearchStrategy);
+    registerRollupSearchStrategy(addSearchStrategy, getRollupService);
 
     expect(addSearchStrategy).toHaveBeenCalled();
   });
diff --git a/x-pack/plugins/rollup/server/lib/search_strategies/register_rollup_search_strategy.ts b/x-pack/plugins/rollup/server/lib/search_strategies/register_rollup_search_strategy.ts
index 333863979ba95..22dafbb71d802 100644
--- a/x-pack/plugins/rollup/server/lib/search_strategies/register_rollup_search_strategy.ts
+++ b/x-pack/plugins/rollup/server/lib/search_strategies/register_rollup_search_strategy.ts
@@ -4,27 +4,24 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { ILegacyScopedClusterClient } from 'src/core/server';
 import {
-  AbstractSearchRequest,
   DefaultSearchCapabilities,
   AbstractSearchStrategy,
+  ReqFacade,
 } from '../../../../../../src/plugins/vis_type_timeseries/server';
-import { CallWithRequestFactoryShim } from '../../types';
 import { getRollupSearchStrategy } from './rollup_search_strategy';
-import { getRollupSearchRequest } from './rollup_search_request';
 import { getRollupSearchCapabilities } from './rollup_search_capabilities';
 
 export const registerRollupSearchStrategy = (
-  callWithRequestFactory: CallWithRequestFactoryShim,
-  addSearchStrategy: (searchStrategy: any) => void
+  addSearchStrategy: (searchStrategy: any) => void,
+  getRollupService: (reg: ReqFacade) => Promise<ILegacyScopedClusterClient>
 ) => {
-  const RollupSearchRequest = getRollupSearchRequest(AbstractSearchRequest);
   const RollupSearchCapabilities = getRollupSearchCapabilities(DefaultSearchCapabilities);
   const RollupSearchStrategy = getRollupSearchStrategy(
     AbstractSearchStrategy,
-    RollupSearchRequest,
     RollupSearchCapabilities,
-    callWithRequestFactory
+    getRollupService
   );
 
   addSearchStrategy(new RollupSearchStrategy());
diff --git a/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_request.test.js b/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_request.test.js
deleted file mode 100644
index 2ea0612140946..0000000000000
--- a/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_request.test.js
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { getRollupSearchRequest } from './rollup_search_request';
-
-class AbstractSearchRequest {
-  indexPattern = 'indexPattern';
-  callWithRequest = jest.fn(({ body }) => Promise.resolve(body));
-}
-
-describe('Rollup search request', () => {
-  let RollupSearchRequest;
-
-  beforeEach(() => {
-    RollupSearchRequest = getRollupSearchRequest(AbstractSearchRequest);
-  });
-
-  test('should create instance of RollupSearchRequest', () => {
-    const rollupSearchRequest = new RollupSearchRequest();
-
-    expect(rollupSearchRequest).toBeInstanceOf(AbstractSearchRequest);
-    expect(rollupSearchRequest.search).toBeDefined();
-    expect(rollupSearchRequest.callWithRequest).toBeDefined();
-  });
-
-  test('should send one request for single search', async () => {
-    const rollupSearchRequest = new RollupSearchRequest();
-    const searches = [{ body: 'body', index: 'index' }];
-
-    await rollupSearchRequest.search(searches);
-
-    expect(rollupSearchRequest.callWithRequest).toHaveBeenCalledTimes(1);
-    expect(rollupSearchRequest.callWithRequest).toHaveBeenCalledWith('rollup.search', {
-      body: 'body',
-      index: 'index',
-      rest_total_hits_as_int: true,
-    });
-  });
-
-  test('should send multiple request for multi search', async () => {
-    const rollupSearchRequest = new RollupSearchRequest();
-    const searches = [
-      { body: 'body', index: 'index' },
-      { body: 'body1', index: 'index' },
-    ];
-
-    await rollupSearchRequest.search(searches);
-
-    expect(rollupSearchRequest.callWithRequest).toHaveBeenCalledTimes(2);
-  });
-});
diff --git a/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_request.ts b/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_request.ts
deleted file mode 100644
index 7e12d5286f34c..0000000000000
--- a/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_request.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-const SEARCH_METHOD = 'rollup.search';
-
-interface Search {
-  index: string;
-  body: {
-    [key: string]: any;
-  };
-}
-
-export const getRollupSearchRequest = (AbstractSearchRequest: any) =>
-  class RollupSearchRequest extends AbstractSearchRequest {
-    async search(searches: Search[]) {
-      const requests = searches.map(({ body, index }) =>
-        this.callWithRequest(SEARCH_METHOD, {
-          body,
-          index,
-          rest_total_hits_as_int: true,
-        })
-      );
-
-      return await Promise.all(requests);
-    }
-  };
diff --git a/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_strategy.test.js b/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_strategy.test.js
index 63f4628e36bfe..f3da7ed3fdd17 100644
--- a/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_strategy.test.js
+++ b/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_strategy.test.js
@@ -7,13 +7,32 @@ import { getRollupSearchStrategy } from './rollup_search_strategy';
 
 describe('Rollup Search Strategy', () => {
   let RollupSearchStrategy;
-  let RollupSearchRequest;
   let RollupSearchCapabilities;
   let callWithRequest;
   let rollupResolvedData;
 
-  const server = 'server';
-  const request = 'request';
+  const request = {
+    requestContext: {
+      core: {
+        elasticsearch: {
+          client: {
+            asCurrentUser: {
+              rollup: {
+                getRollupIndexCaps: jest.fn().mockImplementation(() => rollupResolvedData),
+              },
+            },
+          },
+        },
+      },
+    },
+  };
+  const getRollupService = jest.fn().mockImplementation(() => {
+    return {
+      callAsCurrentUser: async () => {
+        return rollupResolvedData;
+      },
+    };
+  });
   const indexPattern = 'indexPattern';
 
   beforeEach(() => {
@@ -33,19 +52,17 @@ describe('Rollup Search Strategy', () => {
       }
     }
 
-    RollupSearchRequest = jest.fn();
     RollupSearchCapabilities = jest.fn(() => 'capabilities');
-    callWithRequest = jest.fn().mockImplementation(() => rollupResolvedData);
 
     RollupSearchStrategy = getRollupSearchStrategy(
       AbstractSearchStrategy,
-      RollupSearchRequest,
-      RollupSearchCapabilities
+      RollupSearchCapabilities,
+      getRollupService
     );
   });
 
   test('should create instance of RollupSearchRequest', () => {
-    const rollupSearchStrategy = new RollupSearchStrategy(server);
+    const rollupSearchStrategy = new RollupSearchStrategy();
 
     expect(rollupSearchStrategy.name).toBe('rollup');
   });
@@ -55,7 +72,7 @@ describe('Rollup Search Strategy', () => {
     const rollupIndex = 'rollupIndex';
 
     beforeEach(() => {
-      rollupSearchStrategy = new RollupSearchStrategy(server);
+      rollupSearchStrategy = new RollupSearchStrategy();
       rollupSearchStrategy.getRollupData = jest.fn(() => ({
         [rollupIndex]: {
           rollup_jobs: [
@@ -104,7 +121,7 @@ describe('Rollup Search Strategy', () => {
     let rollupSearchStrategy;
 
     beforeEach(() => {
-      rollupSearchStrategy = new RollupSearchStrategy(server);
+      rollupSearchStrategy = new RollupSearchStrategy();
     });
 
     test('should return rollup data', async () => {
@@ -112,10 +129,7 @@ describe('Rollup Search Strategy', () => {
 
       const rollupData = await rollupSearchStrategy.getRollupData(request, indexPattern);
 
-      expect(callWithRequest).toHaveBeenCalledWith('rollup.rollupIndexCapabilities', {
-        indexPattern,
-      });
-      expect(rollupSearchStrategy.getCallWithRequestInstance).toHaveBeenCalledWith(request);
+      expect(getRollupService).toHaveBeenCalled();
       expect(rollupData).toBe('data');
     });
 
@@ -135,7 +149,7 @@ describe('Rollup Search Strategy', () => {
     const rollupIndex = 'rollupIndex';
 
     beforeEach(() => {
-      rollupSearchStrategy = new RollupSearchStrategy(server);
+      rollupSearchStrategy = new RollupSearchStrategy();
       fieldsCapabilities = {
         [rollupIndex]: {
           aggs: {
diff --git a/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_strategy.ts b/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_strategy.ts
index 885836780f1a9..e7794caf8697b 100644
--- a/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_strategy.ts
+++ b/x-pack/plugins/rollup/server/lib/search_strategies/rollup_search_strategy.ts
@@ -4,15 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { keyBy, isString } from 'lodash';
-import { KibanaRequest } from 'src/core/server';
-
-import { CallWithRequestFactoryShim } from '../../types';
+import { ILegacyScopedClusterClient } from 'src/core/server';
+import { ReqFacade } from '../../../../../../src/plugins/vis_type_timeseries/server';
+import { ENHANCED_ES_SEARCH_STRATEGY } from '../../../../data_enhanced/server';
 import { mergeCapabilitiesWithFields } from '../merge_capabilities_with_fields';
 import { getCapabilitiesForRollupIndices } from '../map_capabilities';
 
-const ROLLUP_INDEX_CAPABILITIES_METHOD = 'rollup.rollupIndexCapabilities';
-
-const getRollupIndices = (rollupData: { [key: string]: any[] }) => Object.keys(rollupData);
+const getRollupIndices = (rollupData: { [key: string]: any }) => Object.keys(rollupData);
 
 const isIndexPatternContainsWildcard = (indexPattern: string) => indexPattern.includes('*');
 const isIndexPatternValid = (indexPattern: string) =>
@@ -20,28 +18,40 @@ const isIndexPatternValid = (indexPattern: string) =>
 
 export const getRollupSearchStrategy = (
   AbstractSearchStrategy: any,
-  RollupSearchRequest: any,
   RollupSearchCapabilities: any,
-  callWithRequestFactory: CallWithRequestFactoryShim
+  getRollupService: (reg: ReqFacade) => Promise<ILegacyScopedClusterClient>
 ) =>
   class RollupSearchStrategy extends AbstractSearchStrategy {
     name = 'rollup';
 
     constructor() {
-      // TODO: When vis_type_timeseries and AbstractSearchStrategy are migrated to the NP, it
-      // shouldn't require elasticsearchService to be injected, and we can remove this null argument.
-      super(null, callWithRequestFactory, RollupSearchRequest);
+      super(ENHANCED_ES_SEARCH_STRATEGY, 'rollup', { rest_total_hits_as_int: true });
     }
 
-    getRollupData(req: KibanaRequest, indexPattern: string) {
-      const callWithRequest = this.getCallWithRequestInstance(req);
+    async search(req: ReqFacade, bodies: any[], options = {}) {
+      const rollupService = await getRollupService(req);
+      const requests: any[] = [];
+      bodies.forEach((body) => {
+        requests.push(
+          rollupService.callAsCurrentUser('rollup.search', {
+            ...body,
+            rest_total_hits_as_int: true,
+          })
+        );
+      });
+      return Promise.all(requests);
+    }
 
-      return callWithRequest(ROLLUP_INDEX_CAPABILITIES_METHOD, {
-        indexPattern,
-      }).catch(() => Promise.resolve({}));
+    async getRollupData(req: ReqFacade, indexPattern: string) {
+      const rollupService = await getRollupService(req);
+      return rollupService
+        .callAsCurrentUser('rollup.rollupIndexCapabilities', {
+          indexPattern,
+        })
+        .catch(() => Promise.resolve({}));
     }
 
-    async checkForViability(req: KibanaRequest, indexPattern: string) {
+    async checkForViability(req: ReqFacade, indexPattern: string) {
       let isViable = false;
       let capabilities = null;
 
@@ -66,7 +76,7 @@ export const getRollupSearchStrategy = (
     }
 
     async getFieldsForWildcard(
-      req: KibanaRequest,
+      req: ReqFacade,
       indexPattern: string,
       {
         fieldsCapabilities,
diff --git a/x-pack/plugins/rollup/server/plugin.ts b/x-pack/plugins/rollup/server/plugin.ts
index 8b3a6355f950d..fe193150fc1ca 100644
--- a/x-pack/plugins/rollup/server/plugin.ts
+++ b/x-pack/plugins/rollup/server/plugin.ts
@@ -17,17 +17,16 @@ import {
   ILegacyCustomClusterClient,
   Plugin,
   Logger,
-  KibanaRequest,
   PluginInitializerContext,
   ILegacyScopedClusterClient,
-  LegacyAPICaller,
   SharedGlobalConfig,
 } from 'src/core/server';
 import { i18n } from '@kbn/i18n';
 import { schema } from '@kbn/config-schema';
 
+import { ReqFacade } from '../../../../src/plugins/vis_type_timeseries/server';
 import { PLUGIN, CONFIG_ROLLUPS } from '../common';
-import { Dependencies, CallWithRequestFactoryShim } from './types';
+import { Dependencies } from './types';
 import { registerApiRoutes } from './routes';
 import { License } from './services';
 import { registerRollupUsageCollector } from './collectors';
@@ -132,19 +131,12 @@ export class RollupPlugin implements Plugin<void, void, any, any> {
     });
 
     if (visTypeTimeseries) {
-      // TODO: When vis_type_timeseries is fully migrated to the NP, it shouldn't require this shim.
-      const callWithRequestFactoryShim = (
-        elasticsearchServiceShim: CallWithRequestFactoryShim,
-        request: KibanaRequest
-      ): LegacyAPICaller => {
-        return async (...args: Parameters<LegacyAPICaller>) => {
-          this.rollupEsClient = this.rollupEsClient ?? (await getCustomEsClient(getStartServices));
-          return await this.rollupEsClient.asScoped(request).callAsCurrentUser(...args);
-        };
+      const getRollupService = async (request: ReqFacade) => {
+        this.rollupEsClient = this.rollupEsClient ?? (await getCustomEsClient(getStartServices));
+        return this.rollupEsClient.asScoped(request);
       };
-
       const { addSearchStrategy } = visTypeTimeseries;
-      registerRollupSearchStrategy(callWithRequestFactoryShim, addSearchStrategy);
+      registerRollupSearchStrategy(addSearchStrategy, getRollupService);
     }
 
     if (usageCollection) {
diff --git a/x-pack/plugins/rollup/server/types.ts b/x-pack/plugins/rollup/server/types.ts
index 290d2df050099..b167806cf8d5d 100644
--- a/x-pack/plugins/rollup/server/types.ts
+++ b/x-pack/plugins/rollup/server/types.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IRouter, LegacyAPICaller, KibanaRequest } from 'src/core/server';
+import { IRouter } from 'src/core/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { VisTypeTimeseriesSetup } from 'src/plugins/vis_type_timeseries/server';
 
@@ -39,9 +39,3 @@ export interface RouteDependencies {
     IndexPatternsFetcher: typeof IndexPatternsFetcher;
   };
 }
-
-// TODO: When vis_type_timeseries is fully migrated to the NP, it shouldn't require this shim.
-export type CallWithRequestFactoryShim = (
-  elasticsearchServiceShim: CallWithRequestFactoryShim,
-  request: KibanaRequest
-) => LegacyAPICaller;
diff --git a/x-pack/plugins/searchprofiler/server/plugin.ts b/x-pack/plugins/searchprofiler/server/plugin.ts
index 0dfb65aa6f857..032593d5e3b31 100644
--- a/x-pack/plugins/searchprofiler/server/plugin.ts
+++ b/x-pack/plugins/searchprofiler/server/plugin.ts
@@ -20,10 +20,9 @@ export class SearchProfilerServerPlugin implements Plugin {
     this.licenseStatus = { valid: false };
   }
 
-  async setup({ http }: CoreSetup, { licensing, elasticsearch }: AppServerPluginDependencies) {
+  async setup({ http }: CoreSetup, { licensing }: AppServerPluginDependencies) {
     const router = http.createRouter();
     profileRoute.register({
-      elasticsearch,
       router,
       getLicenseStatus: () => this.licenseStatus,
       log: this.log,
diff --git a/x-pack/plugins/searchprofiler/server/types.ts b/x-pack/plugins/searchprofiler/server/types.ts
index 7aa0032afba13..84733b0ccfd95 100644
--- a/x-pack/plugins/searchprofiler/server/types.ts
+++ b/x-pack/plugins/searchprofiler/server/types.ts
@@ -5,18 +5,15 @@
  */
 
 import { IRouter, Logger } from 'kibana/server';
-import { ElasticsearchPlugin } from '../../../../src/legacy/core_plugins/elasticsearch';
 import { LicensingPluginSetup } from '../../licensing/server';
 import { LicenseStatus } from '../common';
 
 export interface AppServerPluginDependencies {
   licensing: LicensingPluginSetup;
-  elasticsearch: ElasticsearchPlugin;
 }
 
 export interface RouteDependencies {
   getLicenseStatus: () => LicenseStatus;
-  elasticsearch: ElasticsearchPlugin;
   router: IRouter;
   log: Logger;
 }
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx b/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx
index 01f8969e61f43..650d7c9c86c2b 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import _, { get } from 'lodash';
 import {
   EuiButton,
   EuiButtonEmpty,
@@ -526,7 +525,12 @@ export const EditRolePage: FunctionComponent<Props> = ({
       try {
         await rolesAPIClient.saveRole({ role, spacesEnabled: spaces.enabled });
       } catch (error) {
-        notifications.toasts.addDanger(get(error, 'data.message'));
+        notifications.toasts.addDanger(
+          error?.body?.message ??
+            i18n.translate('xpack.security.management.editRole.errorSavingRoleError', {
+              defaultMessage: 'Error saving role',
+            })
+        );
         return;
       }
 
@@ -545,7 +549,12 @@ export const EditRolePage: FunctionComponent<Props> = ({
     try {
       await rolesAPIClient.deleteRole(role.name);
     } catch (error) {
-      notifications.toasts.addDanger(get(error, 'data.message'));
+      notifications.toasts.addDanger(
+        error?.data?.message ??
+          i18n.translate('xpack.security.management.editRole.errorDeletingRoleError', {
+            defaultMessage: 'Error deleting role',
+          })
+      );
       return;
     }
 
diff --git a/x-pack/plugins/security/server/session_management/session_management_service.test.ts b/x-pack/plugins/security/server/session_management/session_management_service.test.ts
index df528e3f97cb4..0328455fc8379 100644
--- a/x-pack/plugins/security/server/session_management/session_management_service.test.ts
+++ b/x-pack/plugins/security/server/session_management/session_management_service.test.ts
@@ -147,7 +147,9 @@ describe('SessionManagementService', () => {
       mockStatusSubject.next({ scheduleRetry: mockScheduleRetry });
       await nextTick();
       expect(mockSessionIndexInitialize).toHaveBeenCalledTimes(2);
-      expect(mockTaskManager.ensureScheduled).toHaveBeenCalledTimes(2);
+
+      // Session index task shouldn't be scheduled twice due to TM issue.
+      expect(mockTaskManager.ensureScheduled).toHaveBeenCalledTimes(1);
 
       expect(mockScheduleRetry).not.toHaveBeenCalled();
     });
@@ -199,16 +201,8 @@ describe('SessionManagementService', () => {
       expect(mockTaskManager.get).toHaveBeenCalledWith(SESSION_INDEX_CLEANUP_TASK_NAME);
 
       expect(mockTaskManager.remove).not.toHaveBeenCalled();
-
-      expect(mockTaskManager.ensureScheduled).toHaveBeenCalledTimes(1);
-      expect(mockTaskManager.ensureScheduled).toHaveBeenCalledWith({
-        id: SESSION_INDEX_CLEANUP_TASK_NAME,
-        taskType: SESSION_INDEX_CLEANUP_TASK_NAME,
-        scope: ['security'],
-        schedule: { interval: '3600s' },
-        params: {},
-        state: {},
-      });
+      // No need to schedule a task if Task Manager says it's already scheduled.
+      expect(mockTaskManager.ensureScheduled).not.toHaveBeenCalled();
     });
 
     it('schedules retry if index initialization fails', async () => {
@@ -224,11 +218,12 @@ describe('SessionManagementService', () => {
       expect(mockTaskManager.ensureScheduled).toHaveBeenCalledTimes(1);
       expect(mockScheduleRetry).toHaveBeenCalledTimes(1);
 
-      // Still fails.
+      // Still fails, but cleanup task is scheduled already
+      mockTaskManager.get.mockResolvedValue({ schedule: { interval: '3600s' } } as any);
       mockStatusSubject.next({ scheduleRetry: mockScheduleRetry });
       await nextTick();
       expect(mockSessionIndexInitialize).toHaveBeenCalledTimes(2);
-      expect(mockTaskManager.ensureScheduled).toHaveBeenCalledTimes(2);
+      expect(mockTaskManager.ensureScheduled).toHaveBeenCalledTimes(1);
       expect(mockScheduleRetry).toHaveBeenCalledTimes(2);
 
       // And finally succeeds, retry is not scheduled.
@@ -237,7 +232,7 @@ describe('SessionManagementService', () => {
       mockStatusSubject.next({ scheduleRetry: mockScheduleRetry });
       await nextTick();
       expect(mockSessionIndexInitialize).toHaveBeenCalledTimes(3);
-      expect(mockTaskManager.ensureScheduled).toHaveBeenCalledTimes(3);
+      expect(mockTaskManager.ensureScheduled).toHaveBeenCalledTimes(1);
       expect(mockScheduleRetry).toHaveBeenCalledTimes(2);
     });
 
diff --git a/x-pack/plugins/security/server/session_management/session_management_service.ts b/x-pack/plugins/security/server/session_management/session_management_service.ts
index 6691b47638e27..60c0f7c23e959 100644
--- a/x-pack/plugins/security/server/session_management/session_management_service.ts
+++ b/x-pack/plugins/security/server/session_management/session_management_service.ts
@@ -47,6 +47,7 @@ export class SessionManagementService {
   private statusSubscription?: Subscription;
   private sessionIndex!: SessionIndex;
   private config!: ConfigType;
+  private isCleanupTaskScheduled = false;
 
   constructor(private readonly logger: Logger) {}
 
@@ -124,7 +125,12 @@ export class SessionManagementService {
 
     // Check if currently scheduled task is scheduled with the correct interval.
     const cleanupInterval = `${this.config.session.cleanupInterval.asSeconds()}s`;
-    if (currentTask && currentTask.schedule?.interval !== cleanupInterval) {
+    if (currentTask) {
+      if (currentTask.schedule?.interval === cleanupInterval) {
+        this.logger.debug('Session index cleanup task is already scheduled.');
+        return;
+      }
+
       this.logger.debug(
         'Session index cleanup interval has changed, the cleanup task will be rescheduled.'
       );
@@ -139,6 +145,13 @@ export class SessionManagementService {
           throw err;
         }
       }
+    } else if (this.isCleanupTaskScheduled) {
+      // WORKAROUND: This is a workaround for the Task Manager issue: https://github.com/elastic/kibana/issues/75501
+      // and should be removed as soon as this issue is resolved.
+      this.logger.error(
+        'Session index cleanup task has been already scheduled, but is missing in the task list for some reason. Please restart Kibana to automatically reschedule this task.'
+      );
+      return;
     }
 
     try {
@@ -151,10 +164,11 @@ export class SessionManagementService {
         state: {},
       });
     } catch (err) {
-      this.logger.error(`Failed to register session index cleanup task: ${err.message}`);
+      this.logger.error(`Failed to schedule session index cleanup task: ${err.message}`);
       throw err;
     }
 
+    this.isCleanupTaskScheduled = true;
     this.logger.debug('Successfully scheduled session index cleanup task.');
   }
 }
diff --git a/x-pack/plugins/security_solution/common/ecs/agent/index.ts b/x-pack/plugins/security_solution/common/ecs/agent/index.ts
new file mode 100644
index 0000000000000..6f29a2020c944
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/ecs/agent/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface AgentEcs {
+  type?: string[];
+}
diff --git a/x-pack/plugins/security_solution/common/ecs/endgame/index.ts b/x-pack/plugins/security_solution/common/ecs/endgame/index.ts
index f435db4f47810..d2fc5d61527a5 100644
--- a/x-pack/plugins/security_solution/common/ecs/endgame/index.ts
+++ b/x-pack/plugins/security_solution/common/ecs/endgame/index.ts
@@ -5,29 +5,17 @@
  */
 
 export interface EndgameEcs {
-  exit_code?: number;
-
-  file_name?: string;
-
-  file_path?: string;
-
-  logon_type?: number;
-
-  parent_process_name?: string;
-
-  pid?: number;
-
-  process_name?: string;
-
-  subject_domain_name?: string;
-
-  subject_logon_id?: string;
-
-  subject_user_name?: string;
-
-  target_domain_name?: string;
-
-  target_logon_id?: string;
-
-  target_user_name?: string;
+  exit_code?: number[];
+  file_name?: string[];
+  file_path?: string[];
+  logon_type?: number[];
+  parent_process_name?: string[];
+  pid?: number[];
+  process_name?: string[];
+  subject_domain_name?: string[];
+  subject_logon_id?: string[];
+  subject_user_name?: string[];
+  target_domain_name?: string[];
+  target_logon_id?: string[];
+  target_user_name?: string[];
 }
diff --git a/x-pack/plugins/security_solution/common/ecs/index.ts b/x-pack/plugins/security_solution/common/ecs/index.ts
index e31d42b02f80b..b8190463f5da5 100644
--- a/x-pack/plugins/security_solution/common/ecs/index.ts
+++ b/x-pack/plugins/security_solution/common/ecs/index.ts
@@ -4,11 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { AgentEcs } from './agent';
 import { AuditdEcs } from './auditd';
 import { DestinationEcs } from './destination';
 import { DnsEcs } from './dns';
 import { EndgameEcs } from './endgame';
 import { EventEcs } from './event';
+import { FileEcs } from './file';
 import { GeoEcs } from './geo';
 import { HostEcs } from './host';
 import { NetworkEcs } from './network';
@@ -28,6 +30,7 @@ import { SystemEcs } from './system';
 export interface Ecs {
   _id: string;
   _index?: string;
+  agent?: AgentEcs;
   auditd?: AuditdEcs;
   destination?: DestinationEcs;
   dns?: DnsEcs;
@@ -49,6 +52,6 @@ export interface Ecs {
   user?: UserEcs;
   winlog?: WinlogEcs;
   process?: ProcessEcs;
-  file?: File;
+  file?: FileEcs;
   system?: SystemEcs;
 }
diff --git a/x-pack/plugins/security_solution/common/ecs/process/index.ts b/x-pack/plugins/security_solution/common/ecs/process/index.ts
index 0584d95c8059d..451f1455f55d4 100644
--- a/x-pack/plugins/security_solution/common/ecs/process/index.ts
+++ b/x-pack/plugins/security_solution/common/ecs/process/index.ts
@@ -5,35 +5,25 @@
  */
 
 export interface ProcessEcs {
+  entity_id?: string[];
   hash?: ProcessHashData;
-
   pid?: number[];
-
   name?: string[];
-
   ppid?: number[];
-
   args?: string[];
-
   executable?: string[];
-
   title?: string[];
-
   thread?: Thread;
-
   working_directory?: string[];
 }
 
 export interface ProcessHashData {
   md5?: string[];
-
   sha1?: string[];
-
   sha256?: string[];
 }
 
 export interface Thread {
   id?: number[];
-
   start?: string[];
 }
diff --git a/x-pack/plugins/security_solution/common/ecs/rule/index.ts b/x-pack/plugins/security_solution/common/ecs/rule/index.ts
index c1ef1ee17ca0c..47316c7791e4b 100644
--- a/x-pack/plugins/security_solution/common/ecs/rule/index.ts
+++ b/x-pack/plugins/security_solution/common/ecs/rule/index.ts
@@ -6,64 +6,38 @@
 
 export interface RuleEcs {
   id?: string[];
-
   rule_id?: string[];
-
   false_positives: string[];
-
   saved_id?: string[];
-
   timeline_id?: string[];
-
   timeline_title?: string[];
-
   max_signals?: number[];
-
   risk_score?: string[];
-
   output_index?: string[];
-
   description?: string[];
-
   from?: string[];
-
   immutable?: boolean[];
-
   index?: string[];
-
   interval?: string[];
-
   language?: string[];
-
   query?: string[];
-
   references?: string[];
-
   severity?: string[];
-
   tags?: string[];
-
   threat?: unknown;
-
+  threshold?: {
+    field: string;
+    value: number;
+  };
   type?: string[];
-
   size?: string[];
-
   to?: string[];
-
   enabled?: boolean[];
-
   filters?: unknown;
-
   created_at?: string[];
-
   updated_at?: string[];
-
   created_by?: string[];
-
   updated_by?: string[];
-
   version?: string[];
-
   note?: string[];
 }
diff --git a/x-pack/plugins/security_solution/common/ecs/signal/index.ts b/x-pack/plugins/security_solution/common/ecs/signal/index.ts
index 66e35e26af341..55a889f3a5dd1 100644
--- a/x-pack/plugins/security_solution/common/ecs/signal/index.ts
+++ b/x-pack/plugins/security_solution/common/ecs/signal/index.ts
@@ -8,6 +8,6 @@ import { RuleEcs } from '../rule';
 
 export interface SignalEcs {
   rule?: RuleEcs;
-
   original_time?: string[];
+  status?: string[];
 }
diff --git a/x-pack/plugins/security_solution/common/endpoint/constants.ts b/x-pack/plugins/security_solution/common/endpoint/constants.ts
index a6018837fa4fe..74ccf9105ba6b 100644
--- a/x-pack/plugins/security_solution/common/endpoint/constants.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/constants.ts
@@ -8,11 +8,13 @@ export const eventsIndexPattern = 'logs-endpoint.events.*';
 export const alertsIndexPattern = 'logs-endpoint.alerts-*';
 export const metadataIndexPattern = 'metrics-endpoint.metadata-*';
 export const metadataCurrentIndexPattern = 'metrics-endpoint.metadata_current-*';
+export const metadataTransformPrefix = 'metrics-endpoint.metadata-current-default';
 export const policyIndexPattern = 'metrics-endpoint.policy-*';
 export const telemetryIndexPattern = 'metrics-endpoint.telemetry-*';
 export const LIMITED_CONCURRENCY_ENDPOINT_ROUTE_TAG = 'endpoint:limited-concurrency';
 export const LIMITED_CONCURRENCY_ENDPOINT_COUNT = 100;
 
+export const TRUSTED_APPS_SUPPORTED_OS_TYPES: readonly string[] = ['macos', 'windows', 'linux'];
 export const TRUSTED_APPS_LIST_API = '/api/endpoint/trusted_apps';
 export const TRUSTED_APPS_CREATE_API = '/api/endpoint/trusted_apps';
 export const TRUSTED_APPS_DELETE_API = '/api/endpoint/trusted_apps/{id}';
diff --git a/x-pack/plugins/security_solution/common/endpoint/models/event.ts b/x-pack/plugins/security_solution/common/endpoint/models/event.ts
index 07208214a641a..9634659b1a5dd 100644
--- a/x-pack/plugins/security_solution/common/endpoint/models/event.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/models/event.ts
@@ -3,20 +3,24 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import {
-  LegacyEndpointEvent,
-  ResolverEvent,
-  SafeResolverEvent,
-  SafeLegacyEndpointEvent,
-} from '../types';
+import { LegacyEndpointEvent, ResolverEvent, SafeResolverEvent, ECSField } from '../types';
 import { firstNonNullValue, hasValue, values } from './ecs_safety_helpers';
 
+/**
+ * Legacy events will define the `endgame` object. This is used to narrow a ResolverEvent.
+ */
+interface LegacyEvent {
+  endgame?: object;
+}
+
 /*
- * Determine if a `ResolverEvent` is the legacy variety. Can be used to narrow `ResolverEvent` to `LegacyEndpointEvent`.
+ * Determine if a higher level event type is the legacy variety. Can be used to narrow an event type.
+ * T optionally defines an `endgame` object field used for determining the type of event. If T doesn't contain the
+ * `endgame` field it will serve as the narrowed type.
  */
-export function isLegacyEventSafeVersion(
-  event: SafeResolverEvent
-): event is SafeLegacyEndpointEvent {
+export function isLegacyEventSafeVersion<T extends LegacyEvent>(
+  event: LegacyEvent | {}
+): event is T {
   return 'endgame' in event && event.endgame !== undefined;
 }
 
@@ -27,7 +31,30 @@ export function isLegacyEvent(event: ResolverEvent): event is LegacyEndpointEven
   return (event as LegacyEndpointEvent).endgame !== undefined;
 }
 
-export function isProcessRunning(event: SafeResolverEvent): boolean {
+/**
+ * Minimum fields needed from the `SafeResolverEvent` type for the function below to operate correctly.
+ */
+type ProcessRunningFields = Partial<
+  | {
+      endgame: object;
+      event: Partial<{
+        type: ECSField<string>;
+        action: ECSField<string>;
+      }>;
+    }
+  | {
+      event: Partial<{
+        type: ECSField<string>;
+      }>;
+    }
+>;
+
+/**
+ * Checks if an event describes a process as running (whether it was started, already running, or changed)
+ *
+ * @param event a document to check for running fields
+ */
+export function isProcessRunning(event: ProcessRunningFields): boolean {
   if (isLegacyEventSafeVersion(event)) {
     return (
       hasValue(event.event?.type, 'process_start') ||
@@ -43,7 +70,18 @@ export function isProcessRunning(event: SafeResolverEvent): boolean {
   );
 }
 
-export function timestampSafeVersion(event: SafeResolverEvent): undefined | number {
+/**
+ * Minimum fields needed from the `SafeResolverEvent` type for the function below to operate correctly.
+ */
+type TimestampFields = Pick<SafeResolverEvent, '@timestamp'>;
+
+/**
+ * Extracts the first non null value from the `@timestamp` field in the document. Returns undefined if the field doesn't
+ * exist in the document.
+ *
+ * @param event a document from ES
+ */
+export function timestampSafeVersion(event: TimestampFields): undefined | number {
   return firstNonNullValue(event?.['@timestamp']);
 }
 
@@ -51,7 +89,7 @@ export function timestampSafeVersion(event: SafeResolverEvent): undefined | numb
  * The `@timestamp` for the event, as a `Date` object.
  * If `@timestamp` couldn't be parsed as a `Date`, returns `undefined`.
  */
-export function timestampAsDateSafeVersion(event: SafeResolverEvent): Date | undefined {
+export function timestampAsDateSafeVersion(event: TimestampFields): Date | undefined {
   const value = timestampSafeVersion(event);
   if (value === undefined) {
     return undefined;
@@ -93,9 +131,30 @@ export function eventId(event: ResolverEvent): number | undefined | string {
   return event.event.id;
 }
 
-export function eventSequence(event: SafeResolverEvent): number | undefined {
+/**
+ * Minimum fields needed from the `SafeResolverEvent` type for the function below to operate correctly.
+ */
+type EventSequenceFields = Partial<
+  | {
+      endgame: Partial<{
+        serial_event_id: ECSField<number>;
+      }>;
+    }
+  | {
+      event: Partial<{
+        sequence: ECSField<number>;
+      }>;
+    }
+>;
+
+/**
+ * Extract the first non null event sequence value from a document. Returns undefined if the field doesn't exist in the document.
+ *
+ * @param event a document from ES
+ */
+export function eventSequence(event: EventSequenceFields): number | undefined {
   if (isLegacyEventSafeVersion(event)) {
-    return firstNonNullValue(event.endgame.serial_event_id);
+    return firstNonNullValue(event.endgame?.serial_event_id);
   }
   return firstNonNullValue(event.event?.sequence);
 }
@@ -113,7 +172,29 @@ export function entityId(event: ResolverEvent): string {
   return event.process.entity_id;
 }
 
-export function entityIDSafeVersion(event: SafeResolverEvent): string | undefined {
+/**
+ * Minimum fields needed from the `SafeResolverEvent` type for the function below to operate correctly.
+ */
+type EntityIDFields = Partial<
+  | {
+      endgame: Partial<{
+        unique_pid: ECSField<number>;
+      }>;
+    }
+  | {
+      process: Partial<{
+        entity_id: ECSField<string>;
+      }>;
+    }
+>;
+
+/**
+ * Extract the first non null value from either the `entity_id` or `unique_pid` depending on the document type. Returns
+ * undefined if the field doesn't exist in the document.
+ *
+ * @param event a document from ES
+ */
+export function entityIDSafeVersion(event: EntityIDFields): string | undefined {
   if (isLegacyEventSafeVersion(event)) {
     return event.endgame?.unique_pid === undefined
       ? undefined
@@ -130,14 +211,59 @@ export function parentEntityId(event: ResolverEvent): string | undefined {
   return event.process.parent?.entity_id;
 }
 
-export function parentEntityIDSafeVersion(event: SafeResolverEvent): string | undefined {
+/**
+ * Minimum fields needed from the `SafeResolverEvent` type for the function below to operate correctly.
+ */
+type ParentEntityIDFields = Partial<
+  | {
+      endgame: Partial<{
+        unique_ppid: ECSField<number>;
+      }>;
+    }
+  | {
+      process: Partial<{
+        parent: Partial<{
+          entity_id: ECSField<string>;
+        }>;
+      }>;
+    }
+>;
+
+/**
+ * Extract the first non null value from either the `parent.entity_id` or `unique_ppid` depending on the document type. Returns
+ * undefined if the field doesn't exist in the document.
+ *
+ * @param event a document from ES
+ */
+export function parentEntityIDSafeVersion(event: ParentEntityIDFields): string | undefined {
   if (isLegacyEventSafeVersion(event)) {
-    return String(firstNonNullValue(event.endgame.unique_ppid));
+    return String(firstNonNullValue(event.endgame?.unique_ppid));
   }
   return firstNonNullValue(event.process?.parent?.entity_id);
 }
 
-export function ancestryArray(event: SafeResolverEvent): string[] | undefined {
+/**
+ * Minimum fields needed from the `SafeResolverEvent` type for the function below to operate correctly.
+ */
+type AncestryArrayFields = Partial<
+  | {
+      endgame: object;
+    }
+  | {
+      process: Partial<{
+        Ext: Partial<{
+          ancestry: ECSField<string>;
+        }>;
+      }>;
+    }
+>;
+
+/**
+ * Extracts all ancestry array from a document if it exists.
+ *
+ * @param event an ES document
+ */
+export function ancestryArray(event: AncestryArrayFields): string[] | undefined {
   if (isLegacyEventSafeVersion(event)) {
     return undefined;
   }
@@ -146,7 +272,17 @@ export function ancestryArray(event: SafeResolverEvent): string[] | undefined {
   return values(event.process?.Ext?.ancestry);
 }
 
-export function getAncestryAsArray(event: SafeResolverEvent | undefined): string[] {
+/**
+ * Minimum fields needed from the `SafeResolverEvent` type for the function below to operate correctly.
+ */
+type GetAncestryArrayFields = AncestryArrayFields & ParentEntityIDFields;
+
+/**
+ * Returns an array of strings representing the ancestry for a process.
+ *
+ * @param event an ES document
+ */
+export function getAncestryAsArray(event: GetAncestryArrayFields | undefined): string[] {
   if (!event) {
     return [];
   }
diff --git a/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts b/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts
index b0c769216732d..fc94e9a7c312a 100644
--- a/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts
@@ -76,7 +76,7 @@ describe('When invoking Trusted Apps Schema', () => {
       os: 'windows',
       entries: [
         {
-          field: 'path',
+          field: 'process.path',
           type: 'match',
           operator: 'included',
           value: 'c:/programs files/Anti-Virus',
@@ -111,14 +111,6 @@ describe('When invoking Trusted Apps Schema', () => {
       expect(body.validate(bodyMsg)).toStrictEqual(bodyMsg);
     });
 
-    it('should validate `description` to be non-empty if defined', () => {
-      const bodyMsg = {
-        ...getCreateTrustedAppItem(),
-        description: '',
-      };
-      expect(() => body.validate(bodyMsg)).toThrow();
-    });
-
     it('should validate `os` to to only accept known values', () => {
       const bodyMsg = {
         ...getCreateTrustedAppItem(),
@@ -202,7 +194,7 @@ describe('When invoking Trusted Apps Schema', () => {
         };
         expect(() => body.validate(bodyMsg2)).toThrow();
 
-        ['hash', 'path'].forEach((field) => {
+        ['process.hash.*', 'process.path'].forEach((field) => {
           const bodyMsg3 = {
             ...getCreateTrustedAppItem(),
             entries: [
@@ -217,9 +209,55 @@ describe('When invoking Trusted Apps Schema', () => {
         });
       });
 
-      it.todo('should validate `entry.type` is limited to known values');
+      it('should validate `entry.type` is limited to known values', () => {
+        const bodyMsg = {
+          ...getCreateTrustedAppItem(),
+          entries: [
+            {
+              ...getTrustedAppItemEntryItem(),
+              type: 'invalid',
+            },
+          ],
+        };
+        expect(() => body.validate(bodyMsg)).toThrow();
+
+        // Allow `match`
+        const bodyMsg2 = {
+          ...getCreateTrustedAppItem(),
+          entries: [
+            {
+              ...getTrustedAppItemEntryItem(),
+              type: 'match',
+            },
+          ],
+        };
+        expect(() => body.validate(bodyMsg2)).not.toThrow();
+      });
+
+      it('should validate `entry.operator` is limited to known values', () => {
+        const bodyMsg = {
+          ...getCreateTrustedAppItem(),
+          entries: [
+            {
+              ...getTrustedAppItemEntryItem(),
+              operator: 'invalid',
+            },
+          ],
+        };
+        expect(() => body.validate(bodyMsg)).toThrow();
 
-      it.todo('should validate `entry.operator` is limited to known values');
+        // Allow `match`
+        const bodyMsg2 = {
+          ...getCreateTrustedAppItem(),
+          entries: [
+            {
+              ...getTrustedAppItemEntryItem(),
+              operator: 'included',
+            },
+          ],
+        };
+        expect(() => body.validate(bodyMsg2)).not.toThrow();
+      });
 
       it('should validate `entry.value` required', () => {
         const { value, ...entry } = getTrustedAppItemEntryItem();
diff --git a/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts b/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts
index 7c0de84b637c9..72e24a7d694d4 100644
--- a/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts
@@ -22,11 +22,11 @@ export const GetTrustedAppsRequestSchema = {
 export const PostTrustedAppCreateRequestSchema = {
   body: schema.object({
     name: schema.string({ minLength: 1 }),
-    description: schema.maybe(schema.string({ minLength: 1 })),
+    description: schema.maybe(schema.string({ minLength: 0, defaultValue: '' })),
     os: schema.oneOf([schema.literal('linux'), schema.literal('macos'), schema.literal('windows')]),
     entries: schema.arrayOf(
       schema.object({
-        field: schema.oneOf([schema.literal('hash'), schema.literal('path')]),
+        field: schema.oneOf([schema.literal('process.hash.*'), schema.literal('process.path')]),
         type: schema.literal('match'),
         operator: schema.literal('included'),
         value: schema.string({ minLength: 1 }),
diff --git a/x-pack/plugins/security_solution/common/endpoint/types/index.ts b/x-pack/plugins/security_solution/common/endpoint/types/index.ts
index cc40225ec1a10..6afec75903477 100644
--- a/x-pack/plugins/security_solution/common/endpoint/types/index.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/types/index.ts
@@ -297,6 +297,8 @@ export interface HostResultList {
   request_page_size: number;
   /* the page index requested */
   request_page_index: number;
+  /* the version of the query strategy */
+  query_strategy_version: MetadataQueryStrategyVersions;
 }
 
 /**
@@ -504,9 +506,16 @@ export enum HostStatus {
   UNENROLLING = 'unenrolling',
 }
 
+export enum MetadataQueryStrategyVersions {
+  VERSION_1 = 'v1',
+  VERSION_2 = 'v2',
+}
+
 export type HostInfo = Immutable<{
   metadata: HostMetadata;
   host_status: HostStatus;
+  /* the version of the query strategy */
+  query_strategy_version: MetadataQueryStrategyVersions;
 }>;
 
 export type HostMetadataDetails = Immutable<{
diff --git a/x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts b/x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts
index 7aeb6c6024b99..3356fc67d2682 100644
--- a/x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts
@@ -25,17 +25,17 @@ export interface PostTrustedAppCreateResponse {
   data: TrustedApp;
 }
 
-interface MacosLinuxConditionEntry {
-  field: 'hash' | 'path';
+export interface MacosLinuxConditionEntry {
+  field: 'process.hash.*' | 'process.path';
   type: 'match';
   operator: 'included';
   value: string;
 }
 
-type WindowsConditionEntry =
+export type WindowsConditionEntry =
   | MacosLinuxConditionEntry
   | (Omit<MacosLinuxConditionEntry, 'field'> & {
-      field: 'signer';
+      field: 'process.code_signature';
     });
 
 /** Type for a new Trusted App Entry */
diff --git a/x-pack/plugins/security_solution/common/search_strategy/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/common/index.ts
index b55226b08b800..48437e12f75a5 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/common/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/common/index.ts
@@ -113,3 +113,13 @@ export interface GenericBuckets {
 }
 
 export type StringOrNumber = string | number;
+
+export interface TimerangeFilter {
+  range: {
+    [timestamp: string]: {
+      gte: string;
+      lte: string;
+      format: string;
+    };
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/events/all/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/all/index.ts
new file mode 100644
index 0000000000000..0503a9c327467
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/all/index.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { Ecs } from '../../../../ecs';
+import { CursorType, Inspect, Maybe } from '../../../common';
+import { TimelineRequestOptionsPaginated } from '../..';
+
+export interface TimelineEdges {
+  node: TimelineItem;
+  cursor: CursorType;
+}
+
+export interface TimelineItem {
+  _id: string;
+  _index?: Maybe<string>;
+  data: TimelineNonEcsData[];
+  ecs: Ecs;
+}
+
+export interface TimelineNonEcsData {
+  field: string;
+  value?: Maybe<string[]>;
+}
+
+export interface TimelineEventsAllStrategyResponse extends IEsSearchResponse {
+  edges: TimelineEdges[];
+  totalCount: number;
+  pageInfo: {
+    activePage: number;
+    totalPages: number;
+  };
+  inspect?: Maybe<Inspect>;
+}
+
+export interface TimelineEventsAllRequestOptions extends TimelineRequestOptionsPaginated {
+  fields: string[];
+  fieldRequested: string[];
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/events/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/common/index.ts
new file mode 100644
index 0000000000000..200f400ef6816
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/common/index.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Ecs } from '../../../../ecs';
+import { CursorType, Maybe } from '../../../common';
+
+export interface TimelineEdges {
+  node: TimelineItem;
+  cursor: CursorType;
+}
+
+export interface TimelineItem {
+  _id: string;
+  _index?: Maybe<string>;
+  data: TimelineNonEcsData[];
+  ecs: Ecs;
+}
+
+export interface TimelineNonEcsData {
+  field: string;
+  value?: Maybe<string[] | string>;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/details/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/details/index.ts
similarity index 50%
rename from x-pack/plugins/security_solution/common/search_strategy/timeline/details/index.ts
rename to x-pack/plugins/security_solution/common/search_strategy/timeline/events/details/index.ts
index e5e1c41f4731a..6f9192be40150 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/timeline/details/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/details/index.ts
@@ -4,25 +4,25 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IEsSearchResponse } from '../../../../../../../src/plugins/data/common';
-import { Inspect, Maybe } from '../../common';
-import { TimelineRequestOptionsPaginated } from '..';
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../common';
+import { TimelineRequestOptionsPaginated } from '../..';
 
-export interface DetailItem {
+export interface TimelineEventsDetailsItem {
   field: string;
   values?: Maybe<string[]>;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   originalValue?: Maybe<any>;
 }
 
-export interface TimelineDetailsStrategyResponse extends IEsSearchResponse {
-  data?: Maybe<DetailItem[]>;
+export interface TimelineEventsDetailsStrategyResponse extends IEsSearchResponse {
+  data?: Maybe<TimelineEventsDetailsItem[]>;
   inspect?: Maybe<Inspect>;
 }
 
-export interface TimelineDetailsRequestOptions extends Partial<TimelineRequestOptionsPaginated> {
+export interface TimelineEventsDetailsRequestOptions
+  extends Partial<TimelineRequestOptionsPaginated> {
   defaultIndex: string[];
-  executeQuery: boolean;
   indexName: string;
   eventId: string;
 }
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/events/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/index.ts
new file mode 100644
index 0000000000000..6bb9461995974
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './all';
+export * from './details';
+export * from './last_event_time';
+
+export enum TimelineEventsQueries {
+  all = 'eventsAll',
+  details = 'eventsDetails',
+  lastEventTime = 'eventsLastEventTime',
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/events/last_event_time/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/last_event_time/index.ts
new file mode 100644
index 0000000000000..10750503fc807
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/last_event_time/index.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../common';
+import { TimelineRequestBasicOptions } from '../..';
+
+export enum LastEventIndexKey {
+  hostDetails = 'hostDetails',
+  hosts = 'hosts',
+  ipDetails = 'ipDetails',
+  network = 'network',
+}
+
+export interface LastTimeDetails {
+  hostName?: Maybe<string>;
+  ip?: Maybe<string>;
+}
+
+export interface TimelineEventsLastEventTimeStrategyResponse extends IEsSearchResponse {
+  lastSeen: Maybe<string>;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface TimelineEventsLastEventTimeRequestOptions
+  extends Omit<TimelineRequestBasicOptions, 'filterQuery' | 'timerange'> {
+  indexKey: LastEventIndexKey;
+  details: LastTimeDetails;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
index a7bf61c102cd4..773ee60855886 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
@@ -3,45 +3,22 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
 import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
 import { ESQuery } from '../../typed_json';
-import { Ecs } from '../../ecs';
 import {
-  CursorType,
-  Maybe,
-  TimerangeInput,
-  DocValueFields,
-  PaginationInput,
-  PaginationInputPaginated,
-  SortField,
-} from '../common';
-import { TimelineDetailsRequestOptions, TimelineDetailsStrategyResponse } from './details';
-
-export * from './details';
+  TimelineEventsQueries,
+  TimelineEventsAllRequestOptions,
+  TimelineEventsAllStrategyResponse,
+  TimelineEventsDetailsRequestOptions,
+  TimelineEventsDetailsStrategyResponse,
+  TimelineEventsLastEventTimeRequestOptions,
+  TimelineEventsLastEventTimeStrategyResponse,
+} from './events';
+import { DocValueFields, TimerangeInput, SortField } from '../common';
 
-export enum TimelineQueries {
-  details = 'details',
-}
+export * from './events';
 
-export type TimelineFactoryQueryTypes = TimelineQueries;
-
-export interface TimelineEdges {
-  node: TimelineItem;
-  cursor: CursorType;
-}
-
-export interface TimelineItem {
-  _id: string;
-  _index?: Maybe<string>;
-  data: TimelineNonEcsData[];
-  ecs: Ecs;
-}
-
-export interface TimelineNonEcsData {
-  field: string;
-  value?: Maybe<string[] | string>;
-}
+export type TimelineFactoryQueryTypes = TimelineEventsQueries;
 
 export interface TimelineRequestBasicOptions extends IEsSearchRequest {
   timerange: TimerangeInput;
@@ -51,20 +28,39 @@ export interface TimelineRequestBasicOptions extends IEsSearchRequest {
   factoryQueryType?: TimelineFactoryQueryTypes;
 }
 
-export interface TimelineRequestOptions extends TimelineRequestBasicOptions {
-  pagination: PaginationInput;
-  sortField?: SortField;
+export interface TimelineRequestOptions<Field = string> extends TimelineRequestBasicOptions {
+  pagination: {
+    activePage: number;
+    querySize: number;
+  };
+  sort: SortField<Field>;
 }
 
-export interface TimelineRequestOptionsPaginated extends TimelineRequestBasicOptions {
-  pagination: PaginationInputPaginated;
-  sortField?: SortField;
+export interface TimelineRequestOptionsPaginated<Field = string>
+  extends TimelineRequestBasicOptions {
+  pagination: {
+    activePage: number;
+    querySize: number;
+  };
+  sort: SortField<Field>;
 }
 
 export type TimelineStrategyResponseType<
   T extends TimelineFactoryQueryTypes
-> = T extends TimelineQueries.details ? TimelineDetailsStrategyResponse : never;
+> = T extends TimelineEventsQueries.all
+  ? TimelineEventsAllStrategyResponse
+  : T extends TimelineEventsQueries.details
+  ? TimelineEventsDetailsStrategyResponse
+  : T extends TimelineEventsQueries.lastEventTime
+  ? TimelineEventsLastEventTimeStrategyResponse
+  : never;
 
 export type TimelineStrategyRequestType<
   T extends TimelineFactoryQueryTypes
-> = T extends TimelineQueries.details ? TimelineDetailsRequestOptions : never;
+> = T extends TimelineEventsQueries.all
+  ? TimelineEventsAllRequestOptions
+  : T extends TimelineEventsQueries.details
+  ? TimelineEventsDetailsRequestOptions
+  : T extends TimelineEventsQueries.lastEventTime
+  ? TimelineEventsLastEventTimeRequestOptions
+  : never;
diff --git a/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts b/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts
index 6194d6892d799..a45b1fd18a4b6 100644
--- a/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts
@@ -24,17 +24,16 @@ import {
   ALL_CASES_TAGS_COUNT,
 } from '../screens/all_cases';
 import {
-  ACTION,
   CASE_DETAILS_DESCRIPTION,
   CASE_DETAILS_PAGE_TITLE,
   CASE_DETAILS_PUSH_TO_EXTERNAL_SERVICE_BTN,
   CASE_DETAILS_STATUS,
   CASE_DETAILS_TAGS,
-  CASE_DETAILS_USER_ACTION,
+  CASE_DETAILS_USER_ACTION_DESCRIPTION_USERNAME,
+  CASE_DETAILS_USER_ACTION_DESCRIPTION_EVENT,
   CASE_DETAILS_USERNAMES,
   PARTICIPANTS,
   REPORTER,
-  USER,
 } from '../screens/case_details';
 import { TIMELINE_DESCRIPTION, TIMELINE_QUERY, TIMELINE_TITLE } from '../screens/timeline';
 
@@ -84,8 +83,8 @@ describe('Cases', () => {
     const expectedTags = case1.tags.join('');
     cy.get(CASE_DETAILS_PAGE_TITLE).should('have.text', case1.name);
     cy.get(CASE_DETAILS_STATUS).should('have.text', 'open');
-    cy.get(CASE_DETAILS_USER_ACTION).eq(USER).should('have.text', case1.reporter);
-    cy.get(CASE_DETAILS_USER_ACTION).eq(ACTION).should('have.text', 'added description');
+    cy.get(CASE_DETAILS_USER_ACTION_DESCRIPTION_USERNAME).should('have.text', case1.reporter);
+    cy.get(CASE_DETAILS_USER_ACTION_DESCRIPTION_EVENT).should('have.text', 'added description');
     cy.get(CASE_DETAILS_DESCRIPTION).should(
       'have.text',
       `${case1.description} ${case1.timeline.title}`
diff --git a/x-pack/plugins/security_solution/cypress/integration/timeline_attach_to_case.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timeline_attach_to_case.spec.ts
index 6af4d174b9583..3862a89a7d833 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timeline_attach_to_case.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timeline_attach_to_case.spec.ts
@@ -11,7 +11,7 @@ import {
   addNewCase,
   selectCase,
 } from '../tasks/timeline';
-import { DESCRIPTION_INPUT } from '../screens/create_new_case';
+import { DESCRIPTION_INPUT, ADD_COMMENT_INPUT } from '../screens/create_new_case';
 import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
 import { caseTimeline, TIMELINE_CASE_ID } from '../objects/case';
 
@@ -34,7 +34,7 @@ describe('attach timeline to case', () => {
       cy.location('origin').then((origin) => {
         cy.get(DESCRIPTION_INPUT).should(
           'have.text',
-          `[${caseTimeline.title}](${origin}/app/security/timelines?timeline=(id:'${caseTimeline.id}',isOpen:!t))`
+          `[${caseTimeline.title}](${origin}/app/security/timelines?timeline=(id:%27${caseTimeline.id}%27,isOpen:!t))`
         );
       });
     });
@@ -46,7 +46,7 @@ describe('attach timeline to case', () => {
       cy.location('origin').then((origin) => {
         cy.get(DESCRIPTION_INPUT).should(
           'have.text',
-          `[${caseTimeline.title}](${origin}/app/security/timelines?timeline=(id:'${caseTimeline.id}',isOpen:!t))`
+          `[${caseTimeline.title}](${origin}/app/security/timelines?timeline=(id:%27${caseTimeline.id}%27,isOpen:!t))`
         );
       });
     });
@@ -66,9 +66,9 @@ describe('attach timeline to case', () => {
       selectCase(TIMELINE_CASE_ID);
 
       cy.location('origin').then((origin) => {
-        cy.get(DESCRIPTION_INPUT).should(
+        cy.get(ADD_COMMENT_INPUT).should(
           'have.text',
-          `[${caseTimeline.title}](${origin}/app/security/timelines?timeline=(id:'${caseTimeline.id}',isOpen:!t))`
+          `[${caseTimeline.title}](${origin}/app/security/timelines?timeline=(id:%27${caseTimeline.id}%27,isOpen:!t))`
         );
       });
     });
diff --git a/x-pack/plugins/security_solution/cypress/screens/case_details.ts b/x-pack/plugins/security_solution/cypress/screens/case_details.ts
index f2cdaa6994356..7b995f5395543 100644
--- a/x-pack/plugins/security_solution/cypress/screens/case_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/case_details.ts
@@ -4,9 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export const ACTION = 2;
-
-export const CASE_DETAILS_DESCRIPTION = '[data-test-subj="markdown-root"]';
+export const CASE_DETAILS_DESCRIPTION =
+  '[data-test-subj="description-action"] [data-test-subj="user-action-markdown"]';
 
 export const CASE_DETAILS_PAGE_TITLE = '[data-test-subj="header-page-title"]';
 
@@ -17,14 +16,17 @@ export const CASE_DETAILS_STATUS = '[data-test-subj="case-view-status"]';
 
 export const CASE_DETAILS_TAGS = '[data-test-subj="case-tags"]';
 
-export const CASE_DETAILS_TIMELINE_LINK_MARKDOWN = '[data-test-subj="markdown-timeline-link"]';
+export const CASE_DETAILS_TIMELINE_LINK_MARKDOWN =
+  '[data-test-subj="description-action"] [data-test-subj="user-action-markdown"] button';
+
+export const CASE_DETAILS_USER_ACTION_DESCRIPTION_EVENT =
+  '[data-test-subj="description-action"] .euiCommentEvent__headerEvent';
 
-export const CASE_DETAILS_USER_ACTION = '[data-test-subj="user-action-title"] .euiFlexItem';
+export const CASE_DETAILS_USER_ACTION_DESCRIPTION_USERNAME =
+  '[data-test-subj="description-action"] .euiCommentEvent__headerUsername';
 
 export const CASE_DETAILS_USERNAMES = '[data-test-subj="case-view-username"]';
 
 export const PARTICIPANTS = 1;
 
 export const REPORTER = 0;
-
-export const USER = 1;
diff --git a/x-pack/plugins/security_solution/cypress/screens/create_new_case.ts b/x-pack/plugins/security_solution/cypress/screens/create_new_case.ts
index 9431c054d96a4..4f348b4dcdbd1 100644
--- a/x-pack/plugins/security_solution/cypress/screens/create_new_case.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/create_new_case.ts
@@ -4,11 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+export const ADD_COMMENT_INPUT = '[data-test-subj="add-comment"] textarea';
+
 export const BACK_TO_CASES_BTN = '[data-test-subj="backToCases"]';
 
-export const DESCRIPTION_INPUT = '[data-test-subj="textAreaInput"]';
+export const DESCRIPTION_INPUT = '[data-test-subj="caseDescription"] textarea';
 
-export const INSERT_TIMELINE_BTN = '[data-test-subj="insert-timeline-button"]';
+export const INSERT_TIMELINE_BTN = '.euiMarkdownEditorToolbar [aria-label="Insert timeline link"]';
 
 export const LOADING_SPINNER = '[data-test-subj="create-case-loading-spinner"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts b/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts
index 1d5d240c5c53d..f5013eed07d29 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts
@@ -13,7 +13,6 @@ import {
   INSERT_TIMELINE_BTN,
   LOADING_SPINNER,
   TAGS_INPUT,
-  TIMELINE,
   TIMELINE_SEARCHBOX,
   TITLE_INPUT,
 } from '../screens/create_new_case';
@@ -43,9 +42,6 @@ export const createNewCaseWithTimeline = (newCase: TestCase) => {
 
   cy.get(INSERT_TIMELINE_BTN).click({ force: true });
   cy.get(TIMELINE_SEARCHBOX).type(`${newCase.timeline.title}{enter}`);
-  cy.get(TIMELINE).should('be.visible');
-  cy.wait(300);
-  cy.get(TIMELINE).eq(0).click({ force: true });
 
   cy.get(SUBMIT_BTN).click({ force: true });
   cy.get(LOADING_SPINNER).should('exist');
diff --git a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
index ef13c87a92dbb..14c42697dcbb4 100644
--- a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
@@ -11,14 +11,14 @@ import styled from 'styled-components';
 import { CommentRequest } from '../../../../../case/common/api';
 import { usePostComment } from '../../containers/use_post_comment';
 import { Case } from '../../containers/types';
-import { MarkdownEditorForm } from '../../../common/components/markdown_editor/form';
+import { MarkdownEditorForm } from '../../../common/components/markdown_editor/eui_form';
 import { InsertTimelinePopover } from '../../../timelines/components/timeline/insert_timeline_popover';
 import { useInsertTimeline } from '../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline';
 import { Form, useForm, UseField, useFormData } from '../../../shared_imports';
 
 import * as i18n from './translations';
 import { schema } from './schema';
-import { useTimelineClick } from '../utils/use_timeline_click';
+import { useTimelineClick } from '../../../common/utils/timeline/use_timeline_click';
 
 const MySpinner = styled(EuiLoadingSpinner)`
   position: absolute;
diff --git a/x-pack/plugins/security_solution/public/cases/components/case_view/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/case_view/index.test.tsx
index e1d7d98ba8c51..246df1c94b817 100644
--- a/x-pack/plugins/security_solution/public/cases/components/case_view/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/case_view/index.test.tsx
@@ -114,34 +114,41 @@ describe('CaseView ', () => {
       expect(wrapper.find(`[data-test-subj="case-view-title"]`).first().prop('title')).toEqual(
         data.title
       );
+
       expect(wrapper.find(`[data-test-subj="case-view-status"]`).first().text()).toEqual(
         data.status
       );
+
       expect(
         wrapper
-          .find(`[data-test-subj="case-view-tag-list"] [data-test-subj="case-tag-coke"]`)
+          .find(`[data-test-subj="case-view-tag-list"] [data-test-subj="tag-coke"]`)
           .first()
           .text()
       ).toEqual(data.tags[0]);
+
       expect(
         wrapper
-          .find(`[data-test-subj="case-view-tag-list"] [data-test-subj="case-tag-pepsi"]`)
+          .find(`[data-test-subj="case-view-tag-list"] [data-test-subj="tag-pepsi"]`)
           .first()
           .text()
       ).toEqual(data.tags[1]);
+
       expect(wrapper.find(`[data-test-subj="case-view-username"]`).first().text()).toEqual(
         data.createdBy.username
       );
+
       expect(wrapper.contains(`[data-test-subj="case-view-closedAt"]`)).toBe(false);
+
       expect(wrapper.find(`[data-test-subj="case-view-createdAt"]`).first().prop('value')).toEqual(
         data.createdAt
       );
+
       expect(
         wrapper
           .find(`[data-test-subj="description-action"] [data-test-subj="user-action-markdown"]`)
           .first()
-          .prop('raw')
-      ).toEqual(data.description);
+          .text()
+      ).toBe(data.description);
     });
   });
 
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
index 3c3cc95218b03..a8babe729fde0 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
@@ -31,10 +31,10 @@ import { schema } from './schema';
 import { InsertTimelinePopover } from '../../../timelines/components/timeline/insert_timeline_popover';
 import { useInsertTimeline } from '../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline';
 import * as i18n from '../../translations';
-import { MarkdownEditorForm } from '../../../common/components//markdown_editor/form';
+import { MarkdownEditorForm } from '../../../common/components/markdown_editor/eui_form';
 import { useGetTags } from '../../containers/use_get_tags';
 import { getCaseDetailsUrl } from '../../../common/components/link_to';
-import { useTimelineClick } from '../utils/use_timeline_click';
+import { useTimelineClick } from '../../../common/utils/timeline/use_timeline_click';
 
 export const CommonUseField = getUseField({ component: Field });
 
diff --git a/x-pack/plugins/security_solution/public/cases/components/tag_list/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/tag_list/index.test.tsx
index 7c3fcde687033..a60167a18762f 100644
--- a/x-pack/plugins/security_solution/public/cases/components/tag_list/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/tag_list/index.test.tsx
@@ -58,6 +58,7 @@ describe('TagList ', () => {
       fetchTags,
     }));
   });
+
   it('Renders no tags, and then edit', () => {
     const wrapper = mount(
       <TestProviders>
@@ -69,6 +70,7 @@ describe('TagList ', () => {
     expect(wrapper.find(`[data-test-subj="no-tags"]`).last().exists()).toBeFalsy();
     expect(wrapper.find(`[data-test-subj="edit-tags"]`).last().exists()).toBeTruthy();
   });
+
   it('Edit tag on submit', async () => {
     const wrapper = mount(
       <TestProviders>
@@ -81,6 +83,7 @@ describe('TagList ', () => {
       await waitFor(() => expect(onSubmit).toBeCalledWith(sampleTags));
     });
   });
+
   it('Tag options render with new tags added', () => {
     const wrapper = mount(
       <TestProviders>
@@ -92,6 +95,7 @@ describe('TagList ', () => {
       wrapper.find(`[data-test-subj="caseTags"] [data-test-subj="input"]`).first().prop('options')
     ).toEqual([{ label: 'coke' }, { label: 'pepsi' }, { label: 'rad' }, { label: 'dude' }]);
   });
+
   it('Cancels on cancel', async () => {
     const props = {
       ...defaultProps,
@@ -102,17 +106,19 @@ describe('TagList ', () => {
         <TagList {...props} />
       </TestProviders>
     );
-    expect(wrapper.find(`[data-test-subj="case-tag-pepsi"]`).last().exists()).toBeTruthy();
+
+    expect(wrapper.find(`[data-test-subj="tag-pepsi"]`).last().exists()).toBeTruthy();
     wrapper.find(`[data-test-subj="tag-list-edit-button"]`).last().simulate('click');
     await act(async () => {
-      expect(wrapper.find(`[data-test-subj="case-tag-pepsi"]`).last().exists()).toBeFalsy();
+      expect(wrapper.find(`[data-test-subj="tag-pepsi"]`).last().exists()).toBeFalsy();
       wrapper.find(`[data-test-subj="edit-tags-cancel"]`).last().simulate('click');
       await waitFor(() => {
         wrapper.update();
-        expect(wrapper.find(`[data-test-subj="case-tag-pepsi"]`).last().exists()).toBeTruthy();
+        expect(wrapper.find(`[data-test-subj="tag-pepsi"]`).last().exists()).toBeTruthy();
       });
     });
   });
+
   it('Renders disabled button', () => {
     const props = { ...defaultProps, disabled: true };
     const wrapper = mount(
diff --git a/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx b/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
index eeb7c49eceab5..4af781e3c31f4 100644
--- a/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
@@ -10,8 +10,6 @@ import {
   EuiHorizontalRule,
   EuiFlexGroup,
   EuiFlexItem,
-  EuiBadgeGroup,
-  EuiBadge,
   EuiButton,
   EuiButtonEmpty,
   EuiButtonIcon,
@@ -25,6 +23,8 @@ import { schema } from './schema';
 import { CommonUseField } from '../create';
 import { useGetTags } from '../../containers/use_get_tags';
 
+import { Tags } from './tags';
+
 interface TagListProps {
   disabled?: boolean;
   isLoading: boolean;
@@ -99,15 +99,7 @@ export const TagList = React.memo(
         <EuiHorizontalRule margin="xs" />
         <MyFlexGroup gutterSize="xs" data-test-subj="case-tags">
           {tags.length === 0 && !isEditTags && <p data-test-subj="no-tags">{i18n.NO_TAGS}</p>}
-          <EuiBadgeGroup>
-            {tags.length > 0 &&
-              !isEditTags &&
-              tags.map((tag) => (
-                <EuiBadge data-test-subj={`case-tag-${tag}`} color="hollow" key={tag}>
-                  {tag}
-                </EuiBadge>
-              ))}
-          </EuiBadgeGroup>
+          {!isEditTags && <Tags tags={tags} color="hollow" />}
           {isEditTags && (
             <EuiFlexGroup data-test-subj="edit-tags" direction="column">
               <EuiFlexItem>
diff --git a/x-pack/plugins/security_solution/public/cases/components/tag_list/tags.tsx b/x-pack/plugins/security_solution/public/cases/components/tag_list/tags.tsx
new file mode 100644
index 0000000000000..e257563ce751e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/tag_list/tags.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo } from 'react';
+import { EuiBadgeGroup, EuiBadge, EuiBadgeGroupProps } from '@elastic/eui';
+
+interface TagsProps {
+  tags: string[];
+  color?: string;
+  gutterSize?: EuiBadgeGroupProps['gutterSize'];
+}
+
+const TagsComponent: React.FC<TagsProps> = ({ tags, color = 'default', gutterSize }) => {
+  return (
+    <>
+      {tags.length > 0 && (
+        <EuiBadgeGroup gutterSize={gutterSize}>
+          {tags.map((tag) => (
+            <EuiBadge data-test-subj={`tag-${tag}`} color={color} key={tag}>
+              {tag}
+            </EuiBadge>
+          ))}
+        </EuiBadgeGroup>
+      )}
+    </>
+  );
+};
+
+export const Tags = memo(TagsComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.test.tsx
index b5be84db59920..4e5c05f2f1404 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.test.tsx
@@ -14,7 +14,7 @@ import { connectorsMock } from '../../containers/configure/mock';
 describe('User action tree helpers', () => {
   const connectors = connectorsMock;
   it('label title generated for update tags', () => {
-    const action = getUserAction(['title'], 'update');
+    const action = getUserAction(['tags'], 'update');
     const result: string | JSX.Element = getLabelTitle({
       action,
       connectors,
@@ -27,8 +27,11 @@ describe('User action tree helpers', () => {
       ` ${i18n.TAGS.toLowerCase()}`
     );
 
-    expect(wrapper.find(`[data-test-subj="ua-tag"]`).first().text()).toEqual(action.newValue);
+    expect(wrapper.find(`[data-test-subj="tag-${action.newValue}"]`).first().text()).toEqual(
+      action.newValue
+    );
   });
+
   it('label title generated for update title', () => {
     const action = getUserAction(['title'], 'update');
     const result: string | JSX.Element = getLabelTitle({
@@ -44,6 +47,7 @@ describe('User action tree helpers', () => {
       }"`
     );
   });
+
   it('label title generated for update description', () => {
     const action = getUserAction(['description'], 'update');
     const result: string | JSX.Element = getLabelTitle({
@@ -55,6 +59,7 @@ describe('User action tree helpers', () => {
 
     expect(result).toEqual(`${i18n.EDITED_FIELD} ${i18n.DESCRIPTION.toLowerCase()}`);
   });
+
   it('label title generated for update status to open', () => {
     const action = { ...getUserAction(['status'], 'update'), newValue: 'open' };
     const result: string | JSX.Element = getLabelTitle({
@@ -66,6 +71,7 @@ describe('User action tree helpers', () => {
 
     expect(result).toEqual(`${i18n.REOPENED_CASE.toLowerCase()} ${i18n.CASE}`);
   });
+
   it('label title generated for update status to closed', () => {
     const action = { ...getUserAction(['status'], 'update'), newValue: 'closed' };
     const result: string | JSX.Element = getLabelTitle({
@@ -77,6 +83,7 @@ describe('User action tree helpers', () => {
 
     expect(result).toEqual(`${i18n.CLOSED_CASE.toLowerCase()} ${i18n.CASE}`);
   });
+
   it('label title generated for update comment', () => {
     const action = getUserAction(['comment'], 'update');
     const result: string | JSX.Element = getLabelTitle({
@@ -88,6 +95,7 @@ describe('User action tree helpers', () => {
 
     expect(result).toEqual(`${i18n.EDITED_FIELD} ${i18n.COMMENT.toLowerCase()}`);
   });
+
   it('label title generated for pushed incident', () => {
     const action = getUserAction(['pushed'], 'push-to-service');
     const result: string | JSX.Element = getLabelTitle({
@@ -105,6 +113,7 @@ describe('User action tree helpers', () => {
       JSON.parse(action.newValue).external_url
     );
   });
+
   it('label title generated for needs update incident', () => {
     const action = getUserAction(['pushed'], 'push-to-service');
     const result: string | JSX.Element = getLabelTitle({
@@ -122,6 +131,7 @@ describe('User action tree helpers', () => {
       JSON.parse(action.newValue).external_url
     );
   });
+
   it('label title generated for update connector', () => {
     const action = getUserAction(['connector_id'], 'update');
     const result: string | JSX.Element = getLabelTitle({
@@ -136,6 +146,8 @@ describe('User action tree helpers', () => {
       ` ${i18n.TAGS.toLowerCase()}`
     );
 
-    expect(wrapper.find(`[data-test-subj="ua-tag"]`).first().text()).toEqual(action.newValue);
+    expect(wrapper.find(`[data-test-subj="tag-${action.newValue}"]`).first().text()).toEqual(
+      action.newValue
+    );
   });
 });
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.tsx
index e343c3da6cc8b..4d8bb9ba078e5 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.tsx
@@ -4,12 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiFlexGroup, EuiFlexItem, EuiBadgeGroup, EuiBadge, EuiLink } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiLink } from '@elastic/eui';
 import React from 'react';
 
 import { CaseFullExternalService, Connector } from '../../../../../case/common/api';
 import { CaseUserActions } from '../../containers/types';
+import { CaseServices } from '../../containers/use_get_case_user_actions';
 import * as i18n from '../case_view/translations';
+import { Tags } from '../tag_list/tags';
 
 interface LabelTitle {
   action: CaseUserActions;
@@ -44,22 +46,21 @@ export const getLabelTitle = ({ action, connectors, field, firstPush }: LabelTit
   return '';
 };
 
-const getTagsLabelTitle = (action: CaseUserActions) => (
-  <EuiFlexGroup alignItems="baseline" gutterSize="xs" component="span">
-    <EuiFlexItem data-test-subj="ua-tags-label">
-      {action.action === 'add' && i18n.ADDED_FIELD}
-      {action.action === 'delete' && i18n.REMOVED_FIELD} {i18n.TAGS.toLowerCase()}
-    </EuiFlexItem>
-    <EuiBadgeGroup>
-      {action.newValue != null &&
-        action.newValue.split(',').map((tag) => (
-          <EuiBadge data-test-subj={`ua-tag`} color="default" key={tag}>
-            {tag}
-          </EuiBadge>
-        ))}
-    </EuiBadgeGroup>
-  </EuiFlexGroup>
-);
+const getTagsLabelTitle = (action: CaseUserActions) => {
+  const tags = action.newValue != null ? action.newValue.split(',') : [];
+
+  return (
+    <EuiFlexGroup alignItems="baseline" gutterSize="xs" component="span">
+      <EuiFlexItem data-test-subj="ua-tags-label" grow={false}>
+        {action.action === 'add' && i18n.ADDED_FIELD}
+        {action.action === 'delete' && i18n.REMOVED_FIELD} {i18n.TAGS.toLowerCase()}
+      </EuiFlexItem>
+      <EuiFlexItem grow={false}>
+        <Tags tags={tags} gutterSize="xs" />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
 
 const getPushedServiceLabelTitle = (action: CaseUserActions, firstPush: boolean) => {
   const pushedVal = JSON.parse(action.newValue ?? '') as CaseFullExternalService;
@@ -78,3 +79,20 @@ const getPushedServiceLabelTitle = (action: CaseUserActions, firstPush: boolean)
     </EuiFlexGroup>
   );
 };
+
+export const getPushInfo = (
+  caseServices: CaseServices,
+  parsedValue: { connector_id: string; connector_name: string },
+  index: number
+) =>
+  parsedValue != null
+    ? {
+        firstPush: caseServices[parsedValue.connector_id].firstPushIndex === index,
+        parsedConnectorId: parsedValue.connector_id,
+        parsedConnectorName: parsedValue.connector_name,
+      }
+    : {
+        firstPush: false,
+        parsedConnectorId: 'none',
+        parsedConnectorName: 'none',
+      };
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx
index d67c364bbda10..d2bb2fb243458 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx
@@ -6,6 +6,9 @@
 
 import React from 'react';
 import { mount } from 'enzyme';
+// we don't have the types for waitFor just yet, so using "as waitFor" until when we do
+import { wait as waitFor } from '@testing-library/react';
+import { act } from 'react-dom/test-utils';
 
 import { Router, routeData, mockHistory, mockLocation } from '../__mock__/router';
 import { getFormMock, useFormMock, useFormDataMock } from '../__mock__/form';
@@ -13,9 +16,6 @@ import { useUpdateComment } from '../../containers/use_update_comment';
 import { basicCase, basicPush, getUserAction } from '../../containers/mock';
 import { UserActionTree } from '.';
 import { TestProviders } from '../../../common/mock';
-// we don't have the types for waitFor just yet, so using "as waitFor" until when we do
-import { wait as waitFor } from '@testing-library/react';
-import { act } from 'react-dom/test-utils';
 
 const fetchUserActions = jest.fn();
 const onUpdateField = jest.fn();
@@ -66,9 +66,10 @@ describe('UserActionTree ', () => {
     expect(wrapper.find(`[data-test-subj="user-action-avatar"]`).first().prop('name')).toEqual(
       defaultProps.data.createdBy.fullName
     );
-    expect(wrapper.find(`[data-test-subj="user-action-title"] strong`).first().text()).toEqual(
-      defaultProps.data.createdBy.username
-    );
+
+    expect(
+      wrapper.find(`[data-test-subj="description-action"] figcaption strong`).first().text()
+    ).toEqual(defaultProps.data.createdBy.username);
   });
 
   it('Renders service now update line with top and bottom when push is required', async () => {
@@ -76,6 +77,7 @@ describe('UserActionTree ', () => {
       getUserAction(['pushed'], 'push-to-service'),
       getUserAction(['comment'], 'update'),
     ];
+
     const props = {
       ...defaultProps,
       caseServices: {
@@ -90,20 +92,18 @@ describe('UserActionTree ', () => {
       caseUserActions: ourActions,
     };
 
-    const wrapper = mount(
-      <TestProviders>
-        <Router history={mockHistory}>
-          <UserActionTree {...props} />
-        </Router>
-      </TestProviders>
-    );
-
     await act(async () => {
-      wrapper.update();
+      const wrapper = mount(
+        <TestProviders>
+          <Router history={mockHistory}>
+            <UserActionTree {...props} />
+          </Router>
+        </TestProviders>
+      );
+
+      expect(wrapper.find(`[data-test-subj="top-footer"]`).exists()).toBeTruthy();
+      expect(wrapper.find(`[data-test-subj="bottom-footer"]`).exists()).toBeTruthy();
     });
-
-    expect(wrapper.find(`[data-test-subj="show-top-footer"]`).exists()).toBeTruthy();
-    expect(wrapper.find(`[data-test-subj="show-bottom-footer"]`).exists()).toBeTruthy();
   });
 
   it('Renders service now update line with top only when push is up to date', async () => {
@@ -122,20 +122,17 @@ describe('UserActionTree ', () => {
       },
     };
 
-    const wrapper = mount(
-      <TestProviders>
-        <Router history={mockHistory}>
-          <UserActionTree {...props} />
-        </Router>
-      </TestProviders>
-    );
-
     await act(async () => {
-      wrapper.update();
+      const wrapper = mount(
+        <TestProviders>
+          <Router history={mockHistory}>
+            <UserActionTree {...props} />
+          </Router>
+        </TestProviders>
+      );
+      expect(wrapper.find(`[data-test-subj="top-footer"]`).exists()).toBeTruthy();
+      expect(wrapper.find(`[data-test-subj="bottom-footer"]`).exists()).toBeFalsy();
     });
-
-    expect(wrapper.find(`[data-test-subj="show-top-footer"]`).exists()).toBeTruthy();
-    expect(wrapper.find(`[data-test-subj="show-bottom-footer"]`).exists()).toBeFalsy();
   });
 
   it('Outlines comment when update move to link is clicked', async () => {
@@ -145,89 +142,104 @@ describe('UserActionTree ', () => {
       caseUserActions: ourActions,
     };
 
-    const wrapper = mount(
-      <TestProviders>
-        <Router history={mockHistory}>
-          <UserActionTree {...props} />
-        </Router>
-      </TestProviders>
-    );
-
     await act(async () => {
-      wrapper.update();
-    });
+      const wrapper = mount(
+        <TestProviders>
+          <Router history={mockHistory}>
+            <UserActionTree {...props} />
+          </Router>
+        </TestProviders>
+      );
+
+      expect(
+        wrapper
+          .find(`[data-test-subj="comment-create-action-${props.data.comments[0].id}"]`)
+          .first()
+          .hasClass('outlined')
+      ).toBeFalsy();
 
-    expect(
-      wrapper.find(`[data-test-subj="comment-create-action"]`).first().prop('idToOutline')
-    ).toEqual('');
-    wrapper
-      .find(`[data-test-subj="comment-update-action"] [data-test-subj="move-to-link"]`)
-      .first()
-      .simulate('click');
-    expect(
-      wrapper.find(`[data-test-subj="comment-create-action"]`).first().prop('idToOutline')
-    ).toEqual(ourActions[0].commentId);
+      wrapper
+        .find(
+          `[data-test-subj="comment-update-action-${ourActions[1].actionId}"] [data-test-subj="move-to-link-${props.data.comments[0].id}"]`
+        )
+        .first()
+        .simulate('click');
+
+      await waitFor(() => {
+        wrapper.update();
+        expect(
+          wrapper
+            .find(`[data-test-subj="comment-create-action-${props.data.comments[0].id}"]`)
+            .first()
+            .hasClass('outlined')
+        ).toBeTruthy();
+      });
+    });
   });
 
   it('Switches to markdown when edit is clicked and back to panel when canceled', async () => {
-    const ourActions = [getUserAction(['comment'], 'create')];
-    const props = {
-      ...defaultProps,
-      caseUserActions: ourActions,
-    };
-
-    const wrapper = mount(
-      <TestProviders>
-        <Router history={mockHistory}>
-          <UserActionTree {...props} />
-        </Router>
-      </TestProviders>
-    );
-
-    await act(async () => {
-      wrapper.update();
-    });
+    await waitFor(() => {
+      const ourActions = [getUserAction(['comment'], 'create')];
+      const props = {
+        ...defaultProps,
+        caseUserActions: ourActions,
+      };
+
+      const wrapper = mount(
+        <TestProviders>
+          <Router history={mockHistory}>
+            <UserActionTree {...props} />
+          </Router>
+        </TestProviders>
+      );
+
+      expect(
+        wrapper
+          .find(
+            `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="user-action-markdown-form"]`
+          )
+          .exists()
+      ).toEqual(false);
 
-    expect(
       wrapper
         .find(
-          `[data-test-subj="user-action-${props.data.comments[0].id}"] [data-test-subj="user-action-markdown-form"]`
+          `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-ellipses"]`
         )
-        .exists()
-    ).toEqual(false);
+        .first()
+        .simulate('click');
 
-    wrapper
-      .find(`[data-test-subj="comment-create-action"] [data-test-subj="property-actions-ellipses"]`)
-      .first()
-      .simulate('click');
-
-    wrapper
-      .find(`[data-test-subj="comment-create-action"] [data-test-subj="property-actions-pencil"]`)
-      .first()
-      .simulate('click');
+      wrapper.update();
 
-    expect(
       wrapper
         .find(
-          `[data-test-subj="user-action-${props.data.comments[0].id}"] [data-test-subj="user-action-markdown-form"]`
+          `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-pencil"]`
         )
-        .exists()
-    ).toEqual(true);
+        .first()
+        .simulate('click');
 
-    wrapper
-      .find(
-        `[data-test-subj="user-action-${props.data.comments[0].id}"] [data-test-subj="user-action-cancel-markdown"]`
-      )
-      .first()
-      .simulate('click');
+      expect(
+        wrapper
+          .find(
+            `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="user-action-markdown-form"]`
+          )
+          .exists()
+      ).toEqual(true);
 
-    expect(
       wrapper
         .find(
-          `[data-test-subj="user-action-${props.data.comments[0].id}"] [data-test-subj="user-action-markdown-form"]`
+          `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="user-action-cancel-markdown"]`
         )
-        .exists()
-    ).toEqual(false);
+        .first()
+        .simulate('click');
+
+      expect(
+        wrapper
+          .find(
+            `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="user-action-markdown-form"]`
+          )
+          .exists()
+      ).toEqual(false);
+    });
   });
 
   it('calls update comment when comment markdown is saved', async () => {
@@ -236,6 +248,7 @@ describe('UserActionTree ', () => {
       ...defaultProps,
       caseUserActions: ourActions,
     };
+
     const wrapper = mount(
       <TestProviders>
         <Router history={mockHistory}>
@@ -243,27 +256,35 @@ describe('UserActionTree ', () => {
         </Router>
       </TestProviders>
     );
+
     wrapper
-      .find(`[data-test-subj="comment-create-action"] [data-test-subj="property-actions-ellipses"]`)
+      .find(
+        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-ellipses"]`
+      )
       .first()
       .simulate('click');
+
     wrapper
-      .find(`[data-test-subj="comment-create-action"] [data-test-subj="property-actions-pencil"]`)
+      .find(
+        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-pencil"]`
+      )
       .first()
       .simulate('click');
+
     wrapper
       .find(
-        `[data-test-subj="user-action-${props.data.comments[0].id}"] [data-test-subj="user-action-save-markdown"]`
+        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="user-action-save-markdown"]`
       )
       .first()
       .simulate('click');
+
     await act(async () => {
       await waitFor(() => {
         wrapper.update();
         expect(
           wrapper
             .find(
-              `[data-test-subj="user-action-${props.data.comments[0].id}"] [data-test-subj="user-action-markdown-form"]`
+              `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="user-action-markdown-form"]`
             )
             .exists()
         ).toEqual(false);
@@ -288,93 +309,101 @@ describe('UserActionTree ', () => {
         </Router>
       </TestProviders>
     );
+
     wrapper
       .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-ellipses"]`)
       .first()
       .simulate('click');
+
     wrapper
       .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-pencil"]`)
       .first()
       .simulate('click');
-    wrapper
-      .find(
-        `[data-test-subj="user-action-description"] [data-test-subj="user-action-save-markdown"]`
-      )
-      .first()
-      .simulate('click');
+
     await act(async () => {
-      await waitFor(() => {
-        expect(
-          wrapper
-            .find(
-              `[data-test-subj="user-action-${props.data.id}"] [data-test-subj="user-action-markdown-form"]`
-            )
-            .exists()
-        ).toEqual(false);
-        expect(onUpdateField).toBeCalledWith({ key: 'description', value: sampleData.content });
-      });
+      wrapper
+        .find(`[data-test-subj="description-action"] [data-test-subj="user-action-save-markdown"]`)
+        .first()
+        .simulate('click');
     });
+
+    wrapper.update();
+
+    expect(
+      wrapper
+        .find(`[data-test-subj="description-action"] [data-test-subj="user-action-markdown-form"]`)
+        .exists()
+    ).toEqual(false);
+
+    expect(onUpdateField).toBeCalledWith({ key: 'description', value: sampleData.content });
   });
 
   it('quotes', async () => {
-    const commentData = {
-      comment: '',
-    };
-    const formHookMock = getFormMock(commentData);
-    const setFieldValue = jest.fn();
-    useFormMock.mockImplementation(() => ({ form: { ...formHookMock, setFieldValue } }));
-    const props = defaultProps;
-    const wrapper = mount(
-      <TestProviders>
-        <Router history={mockHistory}>
-          <UserActionTree {...props} />
-        </Router>
-      </TestProviders>
-    );
-
     await act(async () => {
+      const commentData = {
+        comment: '',
+      };
+      const setFieldValue = jest.fn();
+
+      const formHookMock = getFormMock(commentData);
+      useFormMock.mockImplementation(() => ({ form: { ...formHookMock, setFieldValue } }));
+
+      const props = defaultProps;
+      const wrapper = mount(
+        <TestProviders>
+          <Router history={mockHistory}>
+            <UserActionTree {...props} />
+          </Router>
+        </TestProviders>
+      );
+
+      wrapper
+        .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-ellipses"]`)
+        .first()
+        .simulate('click');
+
       await waitFor(() => {
-        wrapper
-          .find(
-            `[data-test-subj="description-action"] [data-test-subj="property-actions-ellipses"]`
-          )
-          .first()
-          .simulate('click');
         wrapper.update();
       });
-    });
 
-    wrapper
-      .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-quote"]`)
-      .first()
-      .simulate('click');
+      wrapper
+        .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-quote"]`)
+        .first()
+        .simulate('click');
 
-    expect(setFieldValue).toBeCalledWith('comment', `> ${props.data.description} \n`);
+      expect(setFieldValue).toBeCalledWith('comment', `> ${props.data.description} \n`);
+    });
   });
 
   it('Outlines comment when url param is provided', async () => {
-    const commentId = 'neat-comment-id';
-    const ourActions = [getUserAction(['comment'], 'create')];
-    const props = {
-      ...defaultProps,
-      caseUserActions: ourActions,
-    };
-
+    const commentId = 'basic-comment-id';
     jest.spyOn(routeData, 'useParams').mockReturnValue({ commentId });
-    const wrapper = mount(
-      <TestProviders>
-        <Router history={mockHistory}>
-          <UserActionTree {...props} />
-        </Router>
-      </TestProviders>
-    );
 
     await act(async () => {
-      wrapper.update();
-    });
+      const ourActions = [getUserAction(['comment'], 'create')];
+      const props = {
+        ...defaultProps,
+        caseUserActions: ourActions,
+      };
+
+      const wrapper = mount(
+        <TestProviders>
+          <Router history={mockHistory}>
+            <UserActionTree {...props} />
+          </Router>
+        </TestProviders>
+      );
 
-    expect(
-      wrapper.find(`[data-test-subj="comment-create-action"]`).first().prop('idToOutline')
-    ).toEqual(commentId);
+      await waitFor(() => {
+        wrapper.update();
+      });
+
+      expect(
+        wrapper
+          .find(`[data-test-subj="comment-create-action-${commentId}"]`)
+          .first()
+          .hasClass('outlined')
+      ).toBeTruthy();
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx
index d1263ab13f41b..bada15294de09 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx
@@ -3,25 +3,38 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import classNames from 'classnames';
 
-import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiLoadingSpinner,
+  EuiCommentList,
+  EuiCommentProps,
+} from '@elastic/eui';
 import React, { useCallback, useMemo, useRef, useState, useEffect } from 'react';
 import { useParams } from 'react-router-dom';
 import styled from 'styled-components';
 
-import * as i18n from '../case_view/translations';
+import * as i18n from './translations';
 
 import { Case, CaseUserActions } from '../../containers/types';
 import { useUpdateComment } from '../../containers/use_update_comment';
 import { useCurrentUser } from '../../../common/lib/kibana';
 import { AddComment, AddCommentRefObject } from '../add_comment';
-import { getLabelTitle } from './helpers';
-import { UserActionItem } from './user_action_item';
-import { UserActionMarkdown } from './user_action_markdown';
 import { Connector } from '../../../../../case/common/api/cases';
 import { CaseServices } from '../../containers/use_get_case_user_actions';
 import { parseString } from '../../containers/utils';
 import { OnUpdateFields } from '../case_view';
+import { getLabelTitle, getPushInfo } from './helpers';
+import { UserActionAvatar } from './user_action_avatar';
+import { UserActionMarkdown } from './user_action_markdown';
+import { UserActionTimestamp } from './user_action_timestamp';
+import { UserActionCopyLink } from './user_action_copy_link';
+import { UserActionMoveToReference } from './user_action_move_to_reference';
+import { UserActionUsername } from './user_action_username';
+import { UserActionUsernameWithAvatar } from './user_action_username_with_avatar';
+import { UserActionContentToolbar } from './user_action_content_toolbar';
 
 export interface UserActionTreeProps {
   caseServices: CaseServices;
@@ -40,6 +53,31 @@ const MyEuiFlexGroup = styled(EuiFlexGroup)`
   margin-bottom: 8px;
 `;
 
+const MyEuiCommentList = styled(EuiCommentList)`
+  ${({ theme }) => `
+    & .userAction__comment.outlined .euiCommentEvent {
+      outline: solid 5px ${theme.eui.euiColorVis1_behindText};
+      margin: 0.5em;
+      transition: 0.8s;
+    }
+
+    & .euiComment.isEdit {
+      & .euiCommentEvent {
+        border: none;
+        box-shadow: none;
+      }
+
+      & .euiCommentEvent__body {
+        padding: 0;
+      }
+
+      & .euiCommentEvent__header {
+        display: none;
+      }
+    }
+  `}
+`;
+
 const DESCRIPTION_ID = 'description';
 const NEW_ID = 'newComment';
 
@@ -86,8 +124,7 @@ export const UserActionTree = React.memo(
           updateCase,
         });
       },
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-      [caseData, handleManageMarkdownEditId, patchComment, updateCase]
+      [caseData.id, fetchUserActions, patchComment, updateCase]
     );
 
     const handleOutlineComment = useCallback(
@@ -172,117 +209,246 @@ export const UserActionTree = React.memo(
         }
       }
     }, [commentId, initLoading, isLoadingUserActions, isLoadingIds, handleOutlineComment]);
-    return (
-      <>
-        <UserActionItem
-          createdAt={caseData.createdAt}
-          data-test-subj="description-action"
-          disabled={!userCanCrud}
-          id={DESCRIPTION_ID}
-          isEditable={manageMarkdownEditIds.includes(DESCRIPTION_ID)}
-          isLoading={isLoadingDescription}
-          labelEditAction={i18n.EDIT_DESCRIPTION}
-          labelQuoteAction={i18n.QUOTE}
-          labelTitle={<>{i18n.ADDED_DESCRIPTION}</>}
-          fullName={caseData.createdBy.fullName ?? caseData.createdBy.username ?? ''}
-          markdown={MarkdownDescription}
-          onEdit={handleManageMarkdownEditId.bind(null, DESCRIPTION_ID)}
-          onQuote={handleManageQuote.bind(null, caseData.description)}
-          username={caseData.createdBy.username ?? i18n.UNKNOWN}
-        />
 
-        {caseUserActions.map((action, index) => {
-          if (action.commentId != null && action.action === 'create') {
-            const comment = caseData.comments.find((c) => c.id === action.commentId);
-            if (comment != null) {
-              return (
-                <UserActionItem
-                  key={action.actionId}
-                  createdAt={comment.createdAt}
-                  data-test-subj={`comment-create-action`}
-                  disabled={!userCanCrud}
-                  id={comment.id}
-                  idToOutline={selectedOutlineCommentId}
-                  isEditable={manageMarkdownEditIds.includes(comment.id)}
-                  isLoading={isLoadingIds.includes(comment.id)}
-                  labelEditAction={i18n.EDIT_COMMENT}
-                  labelQuoteAction={i18n.QUOTE}
-                  labelTitle={<>{i18n.ADDED_COMMENT}</>}
-                  fullName={comment.createdBy.fullName ?? comment.createdBy.username ?? ''}
-                  markdown={
-                    <UserActionMarkdown
-                      id={comment.id}
-                      content={comment.comment}
-                      isEditable={manageMarkdownEditIds.includes(comment.id)}
-                      onChangeEditable={handleManageMarkdownEditId}
-                      onSaveContent={handleSaveComment.bind(null, {
-                        id: comment.id,
-                        version: comment.version,
-                      })}
-                    />
-                  }
-                  onEdit={handleManageMarkdownEditId.bind(null, comment.id)}
-                  onQuote={handleManageQuote.bind(null, comment.comment)}
-                  outlineComment={handleOutlineComment}
-                  username={comment.createdBy.username ?? ''}
-                  updatedAt={comment.updatedAt}
-                />
+    const descriptionCommentListObj: EuiCommentProps = useMemo(
+      () => ({
+        username: (
+          <UserActionUsername
+            username={caseData.createdBy.username ?? i18n.UNKNOWN}
+            fullName={caseData.createdBy.fullName ?? caseData.createdBy.username ?? ''}
+          />
+        ),
+        event: i18n.ADDED_DESCRIPTION,
+        'data-test-subj': 'description-action',
+        timestamp: <UserActionTimestamp createdAt={caseData.createdAt} />,
+        children: MarkdownDescription,
+        timelineIcon: (
+          <UserActionAvatar
+            username={caseData.createdBy.username}
+            fullName={caseData.createdBy.fullName}
+          />
+        ),
+        className: classNames({
+          isEdit: manageMarkdownEditIds.includes(DESCRIPTION_ID),
+        }),
+        actions: (
+          <UserActionContentToolbar
+            id={DESCRIPTION_ID}
+            editLabel={i18n.EDIT_DESCRIPTION}
+            quoteLabel={i18n.QUOTE}
+            disabled={!userCanCrud}
+            isLoading={isLoadingDescription}
+            onEdit={handleManageMarkdownEditId.bind(null, DESCRIPTION_ID)}
+            onQuote={handleManageQuote.bind(null, caseData.description)}
+          />
+        ),
+      }),
+      [
+        MarkdownDescription,
+        caseData,
+        handleManageMarkdownEditId,
+        handleManageQuote,
+        isLoadingDescription,
+        userCanCrud,
+        manageMarkdownEditIds,
+      ]
+    );
+
+    const userActions: EuiCommentProps[] = useMemo(
+      () =>
+        caseUserActions.reduce<EuiCommentProps[]>(
+          (comments, action, index) => {
+            if (action.commentId != null && action.action === 'create') {
+              const comment = caseData.comments.find((c) => c.id === action.commentId);
+              if (comment != null) {
+                return [
+                  ...comments,
+                  {
+                    username: (
+                      <UserActionUsername
+                        username={comment.createdBy.username ?? ''}
+                        fullName={comment.createdBy.fullName ?? comment.createdBy.username ?? ''}
+                      />
+                    ),
+                    'data-test-subj': `comment-create-action-${comment.id}`,
+                    timestamp: (
+                      <UserActionTimestamp
+                        createdAt={comment.createdAt}
+                        updatedAt={comment.updatedAt}
+                      />
+                    ),
+                    className: classNames('userAction__comment', {
+                      outlined: comment.id === selectedOutlineCommentId,
+                      isEdit: manageMarkdownEditIds.includes(comment.id),
+                    }),
+                    children: (
+                      <UserActionMarkdown
+                        id={comment.id}
+                        content={comment.comment}
+                        isEditable={manageMarkdownEditIds.includes(comment.id)}
+                        onChangeEditable={handleManageMarkdownEditId}
+                        onSaveContent={handleSaveComment.bind(null, {
+                          id: comment.id,
+                          version: comment.version,
+                        })}
+                      />
+                    ),
+                    timelineIcon: (
+                      <UserActionAvatar
+                        username={comment.createdBy.username}
+                        fullName={comment.createdBy.fullName}
+                      />
+                    ),
+                    actions: (
+                      <UserActionContentToolbar
+                        id={comment.id}
+                        editLabel={i18n.EDIT_COMMENT}
+                        quoteLabel={i18n.QUOTE}
+                        disabled={!userCanCrud}
+                        isLoading={isLoadingIds.includes(comment.id)}
+                        onEdit={handleManageMarkdownEditId.bind(null, comment.id)}
+                        onQuote={handleManageQuote.bind(null, comment.comment)}
+                      />
+                    ),
+                  },
+                ];
+              }
+            }
+
+            if (action.actionField.length === 1) {
+              const myField = action.actionField[0];
+              const parsedValue = parseString(`${action.newValue}`);
+              const { firstPush, parsedConnectorId, parsedConnectorName } = getPushInfo(
+                caseServices,
+                parsedValue,
+                index
               );
+
+              const labelTitle: string | JSX.Element = getLabelTitle({
+                action,
+                field: myField,
+                firstPush,
+                connectors,
+              });
+
+              const showTopFooter =
+                action.action === 'push-to-service' &&
+                index === caseServices[parsedConnectorId].lastPushIndex;
+
+              const showBottomFooter =
+                action.action === 'push-to-service' &&
+                index === caseServices[parsedConnectorId].lastPushIndex &&
+                caseServices[parsedConnectorId].hasDataToPush;
+
+              let footers: EuiCommentProps[] = [];
+
+              if (showTopFooter) {
+                footers = [
+                  ...footers,
+                  {
+                    username: '',
+                    type: 'update',
+                    event: i18n.ALREADY_PUSHED_TO_SERVICE(`${parsedConnectorName}`),
+                    timelineIcon: 'sortUp',
+                    'data-test-subj': 'top-footer',
+                  },
+                ];
+              }
+
+              if (showBottomFooter) {
+                footers = [
+                  ...footers,
+                  {
+                    username: '',
+                    type: 'update',
+                    event: i18n.REQUIRED_UPDATE_TO_SERVICE(`${parsedConnectorName}`),
+                    timelineIcon: 'sortDown',
+                    'data-test-subj': 'bottom-footer',
+                  },
+                ];
+              }
+
+              return [
+                ...comments,
+                {
+                  username: (
+                    <UserActionUsernameWithAvatar
+                      username={action.actionBy.username ?? ''}
+                      fullName={action.actionBy.fullName ?? action.actionBy.username ?? ''}
+                    />
+                  ),
+                  type: 'update',
+                  event: labelTitle,
+                  'data-test-subj': `${action.actionField[0]}-${action.action}-action-${action.actionId}`,
+                  timestamp: <UserActionTimestamp createdAt={action.actionAt} />,
+                  timelineIcon:
+                    action.action === 'add' || action.action === 'delete' ? 'tag' : 'dot',
+                  actions: (
+                    <EuiFlexGroup>
+                      <EuiFlexItem>
+                        <UserActionCopyLink id={action.actionId} />
+                      </EuiFlexItem>
+                      {action.action === 'update' && action.commentId != null && (
+                        <EuiFlexItem>
+                          <UserActionMoveToReference
+                            id={action.commentId}
+                            outlineComment={handleOutlineComment}
+                          />
+                        </EuiFlexItem>
+                      )}
+                    </EuiFlexGroup>
+                  ),
+                },
+                ...footers,
+              ];
             }
-          }
-          if (action.actionField.length === 1) {
-            const myField = action.actionField[0];
-            const parsedValue = parseString(`${action.newValue}`);
-            const { firstPush, parsedConnectorId, parsedConnectorName } =
-              parsedValue != null
-                ? {
-                    firstPush: caseServices[parsedValue.connector_id].firstPushIndex === index,
-                    parsedConnectorId: parsedValue.connector_id,
-                    parsedConnectorName: parsedValue.connector_name,
-                  }
-                : {
-                    firstPush: false,
-                    parsedConnectorId: 'none',
-                    parsedConnectorName: 'none',
-                  };
-            const labelTitle: string | JSX.Element = getLabelTitle({
-              action,
-              field: myField,
-              firstPush,
-              connectors,
-            });
-
-            return (
-              <UserActionItem
-                key={action.actionId}
-                caseConnectorName={parsedConnectorName}
-                createdAt={action.actionAt}
-                data-test-subj={`${action.actionField[0]}-${action.action}-action`}
-                disabled={!userCanCrud}
-                id={action.actionId}
-                isEditable={false}
-                isLoading={false}
-                labelTitle={<>{labelTitle}</>}
-                linkId={
-                  action.action === 'update' && action.commentId != null ? action.commentId : null
-                }
-                fullName={action.actionBy.fullName ?? action.actionBy.username ?? ''}
-                outlineComment={handleOutlineComment}
-                showTopFooter={
-                  action.action === 'push-to-service' &&
-                  index === caseServices[parsedConnectorId].lastPushIndex
-                }
-                showBottomFooter={
-                  action.action === 'push-to-service' &&
-                  index === caseServices[parsedConnectorId].lastPushIndex &&
-                  caseServices[parsedConnectorId].hasDataToPush
-                }
-                username={action.actionBy.username ?? ''}
-              />
-            );
-          }
-          return null;
-        })}
+
+            return comments;
+          },
+          [descriptionCommentListObj]
+        ),
+      [
+        caseData,
+        caseServices,
+        caseUserActions,
+        connectors,
+        handleOutlineComment,
+        descriptionCommentListObj,
+        handleManageMarkdownEditId,
+        handleManageQuote,
+        handleSaveComment,
+        isLoadingIds,
+        manageMarkdownEditIds,
+        selectedOutlineCommentId,
+        userCanCrud,
+      ]
+    );
+
+    const bottomActions = [
+      {
+        username: (
+          <UserActionUsername
+            username={currentUser != null ? currentUser.username ?? '' : ''}
+            fullName={currentUser != null ? currentUser.fullName ?? '' : ''}
+          />
+        ),
+        'data-test-subj': 'add-comment',
+        timelineIcon: (
+          <UserActionAvatar
+            username={currentUser != null ? currentUser.username ?? '' : ''}
+            fullName={currentUser != null ? currentUser.fullName ?? '' : ''}
+          />
+        ),
+        className: 'isEdit',
+        children: MarkdownNewComment,
+      },
+    ];
+
+    const comments = [...userActions, ...bottomActions];
+
+    return (
+      <>
+        <MyEuiCommentList comments={comments} data-test-subj="user-actions" />
         {(isLoadingUserActions || isLoadingIds.includes(NEW_ID)) && (
           <MyEuiFlexGroup justifyContent="center" alignItems="center">
             <EuiFlexItem grow={false}>
@@ -290,17 +456,6 @@ export const UserActionTree = React.memo(
             </EuiFlexItem>
           </MyEuiFlexGroup>
         )}
-        <UserActionItem
-          data-test-subj={`add-comment`}
-          createdAt={new Date().toISOString()}
-          disabled={!userCanCrud}
-          id={NEW_ID}
-          isEditable={true}
-          isLoading={isLoadingIds.includes(NEW_ID)}
-          fullName={currentUser != null ? currentUser.fullName ?? '' : ''}
-          markdown={MarkdownNewComment}
-          username={currentUser != null ? currentUser.username ?? '' : ''}
-        />
       </>
     );
   }
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_avatar.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_avatar.test.tsx
new file mode 100644
index 0000000000000..df5c51394b88a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_avatar.test.tsx
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount, ReactWrapper } from 'enzyme';
+import { UserActionAvatar } from './user_action_avatar';
+
+const props = {
+  username: 'elastic',
+  fullName: 'Elastic',
+};
+
+describe('UserActionAvatar ', () => {
+  let wrapper: ReactWrapper;
+
+  beforeAll(() => {
+    wrapper = mount(<UserActionAvatar {...props} />);
+  });
+
+  it('it renders', async () => {
+    expect(wrapper.find(`[data-test-subj="user-action-avatar"]`).first().exists()).toBeTruthy();
+    expect(
+      wrapper.find(`[data-test-subj="user-action-avatar-loading-spinner"]`).first().exists()
+    ).toBeFalsy();
+    expect(wrapper.find(`[data-test-subj="user-action-avatar"]`).first().text()).toBe('E');
+  });
+
+  it('it shows the username if the fullName is undefined', async () => {
+    wrapper = mount(<UserActionAvatar username={'elastic'} />);
+    expect(wrapper.find(`[data-test-subj="user-action-avatar"]`).first().exists()).toBeTruthy();
+    expect(
+      wrapper.find(`[data-test-subj="user-action-avatar-loading-spinner"]`).first().exists()
+    ).toBeFalsy();
+    expect(wrapper.find(`[data-test-subj="user-action-avatar"]`).first().text()).toBe('e');
+  });
+
+  it('shows the loading spinner when the username AND the fullName are undefined', async () => {
+    wrapper = mount(<UserActionAvatar />);
+    expect(wrapper.find(`[data-test-subj="user-action-avatar"]`).first().exists()).toBeFalsy();
+    expect(
+      wrapper.find(`[data-test-subj="user-action-avatar-loading-spinner"]`).first().exists()
+    ).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_avatar.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_avatar.tsx
index f3276bd50e72c..8339d9bedd123 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_avatar.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_avatar.tsx
@@ -4,15 +4,26 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiAvatar } from '@elastic/eui';
-import React from 'react';
+import React, { memo } from 'react';
+import { EuiAvatar, EuiLoadingSpinner } from '@elastic/eui';
 
 interface UserActionAvatarProps {
-  name: string;
+  username?: string | null;
+  fullName?: string | null;
 }
 
-export const UserActionAvatar = ({ name }: UserActionAvatarProps) => {
+const UserActionAvatarComponent = ({ username, fullName }: UserActionAvatarProps) => {
+  const avatarName = fullName && fullName.length > 0 ? fullName : username ?? null;
+
   return (
-    <EuiAvatar data-test-subj={`user-action-avatar`} className="userAction__circle" name={name} />
+    <>
+      {avatarName ? (
+        <EuiAvatar name={avatarName} data-test-subj={`user-action-avatar`} />
+      ) : (
+        <EuiLoadingSpinner data-test-subj={`user-action-avatar-loading-spinner`} />
+      )}
+    </>
   );
 };
+
+export const UserActionAvatar = memo(UserActionAvatarComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_content_toolbar.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_content_toolbar.test.tsx
new file mode 100644
index 0000000000000..1f4c858e9581e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_content_toolbar.test.tsx
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount, ReactWrapper } from 'enzyme';
+import { UserActionContentToolbar } from './user_action_content_toolbar';
+
+jest.mock('react-router-dom', () => {
+  const originalModule = jest.requireActual('react-router-dom');
+
+  return {
+    ...originalModule,
+    useParams: jest.fn().mockReturnValue({ detailName: 'case-1' }),
+  };
+});
+
+jest.mock('../../../common/components/navigation/use_get_url_search');
+
+jest.mock('../../../common/lib/kibana', () => {
+  return {
+    useKibana: () => ({
+      services: {
+        application: {
+          getUrlForApp: jest.fn(),
+        },
+      },
+    }),
+  };
+});
+
+const props = {
+  id: '1',
+  editLabel: 'edit',
+  quoteLabel: 'quote',
+  disabled: false,
+  isLoading: false,
+  onEdit: jest.fn(),
+  onQuote: jest.fn(),
+};
+
+describe('UserActionContentToolbar ', () => {
+  let wrapper: ReactWrapper;
+
+  beforeAll(() => {
+    wrapper = mount(<UserActionContentToolbar {...props} />);
+  });
+
+  it('it renders', async () => {
+    expect(wrapper.find(`[data-test-subj="copy-link-${props.id}"]`).first().exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="property-actions"]').first().exists()).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_content_toolbar.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_content_toolbar.tsx
new file mode 100644
index 0000000000000..89239c9e8392c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_content_toolbar.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo } from 'react';
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+
+import { UserActionCopyLink } from './user_action_copy_link';
+import { UserActionPropertyActions } from './user_action_property_actions';
+
+interface UserActionContentToolbarProps {
+  id: string;
+  editLabel: string;
+  quoteLabel: string;
+  disabled: boolean;
+  isLoading: boolean;
+  onEdit: (id: string) => void;
+  onQuote: (id: string) => void;
+}
+
+const UserActionContentToolbarComponent = ({
+  id,
+  editLabel,
+  quoteLabel,
+  disabled,
+  isLoading,
+  onEdit,
+  onQuote,
+}: UserActionContentToolbarProps) => {
+  return (
+    <EuiFlexGroup>
+      <EuiFlexItem>
+        <UserActionCopyLink id={id} />
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <UserActionPropertyActions
+          id={id}
+          editLabel={editLabel}
+          quoteLabel={quoteLabel}
+          disabled={disabled}
+          isLoading={isLoading}
+          onEdit={onEdit}
+          onQuote={onQuote}
+        />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+export const UserActionContentToolbar = memo(UserActionContentToolbarComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_copy_link.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_copy_link.test.tsx
new file mode 100644
index 0000000000000..0566281dac130
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_copy_link.test.tsx
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount, ReactWrapper } from 'enzyme';
+import { useParams } from 'react-router-dom';
+import copy from 'copy-to-clipboard';
+
+import { TestProviders } from '../../../common/mock';
+import { UserActionCopyLink } from './user_action_copy_link';
+import { useGetUrlSearch } from '../../../common/components/navigation/use_get_url_search';
+
+const searchURL =
+  '?timerange=(global:(linkTo:!(),timerange:(from:1585487656371,fromStr:now-24h,kind:relative,to:1585574056371,toStr:now)),timeline:(linkTo:!(),timerange:(from:1585227005527,kind:absolute,to:1585313405527)))';
+
+jest.mock('react-router-dom', () => {
+  const originalModule = jest.requireActual('react-router-dom');
+
+  return {
+    ...originalModule,
+    useParams: jest.fn(),
+  };
+});
+
+jest.mock('copy-to-clipboard', () => {
+  return jest.fn();
+});
+
+jest.mock('../../../common/components/navigation/use_get_url_search');
+
+const mockGetUrlForApp = jest.fn(
+  (appId: string, options?: { path?: string; absolute?: boolean }) =>
+    `${appId}${options?.path ?? ''}`
+);
+
+jest.mock('../../../common/lib/kibana', () => {
+  return {
+    useKibana: () => ({
+      services: {
+        application: {
+          getUrlForApp: mockGetUrlForApp,
+        },
+      },
+    }),
+  };
+});
+
+const props = {
+  id: 'comment-id',
+};
+
+describe('UserActionCopyLink ', () => {
+  let wrapper: ReactWrapper;
+
+  beforeAll(() => {
+    (useParams as jest.Mock).mockReturnValue({ detailName: 'case-1' });
+    (useGetUrlSearch as jest.Mock).mockReturnValue(searchURL);
+    wrapper = mount(<UserActionCopyLink {...props} />, { wrappingComponent: TestProviders });
+  });
+
+  it('it renders', async () => {
+    expect(wrapper.find(`[data-test-subj="copy-link-${props.id}"]`).first().exists()).toBeTruthy();
+  });
+
+  it('calls copy clipboard correctly', async () => {
+    wrapper.find(`[data-test-subj="copy-link-${props.id}"]`).first().simulate('click');
+    expect(copy).toHaveBeenCalledWith(
+      'securitySolution:case/case-1/comment-id?timerange=(global:(linkTo:!(),timerange:(from:1585487656371,fromStr:now-24h,kind:relative,to:1585574056371,toStr:now)),timeline:(linkTo:!(),timerange:(from:1585227005527,kind:absolute,to:1585313405527)))'
+    );
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_copy_link.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_copy_link.tsx
new file mode 100644
index 0000000000000..98de2ab3288a8
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_copy_link.tsx
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useCallback } from 'react';
+import { EuiToolTip, EuiButtonIcon } from '@elastic/eui';
+import { useParams } from 'react-router-dom';
+import copy from 'copy-to-clipboard';
+
+import { useFormatUrl, getCaseDetailsUrlWithCommentId } from '../../../common/components/link_to';
+import { SecurityPageName } from '../../../app/types';
+import * as i18n from './translations';
+
+interface UserActionCopyLinkProps {
+  id: string;
+}
+
+const UserActionCopyLinkComponent = ({ id }: UserActionCopyLinkProps) => {
+  const { detailName: caseId } = useParams<{ detailName: string }>();
+  const { formatUrl } = useFormatUrl(SecurityPageName.case);
+
+  const handleAnchorLink = useCallback(() => {
+    copy(
+      formatUrl(getCaseDetailsUrlWithCommentId({ id: caseId, commentId: id }), { absolute: true })
+    );
+  }, [caseId, formatUrl, id]);
+
+  return (
+    <EuiToolTip position="top" content={<p>{i18n.COPY_REFERENCE_LINK}</p>}>
+      <EuiButtonIcon
+        aria-label={i18n.COPY_REFERENCE_LINK}
+        data-test-subj={`copy-link-${id}`}
+        onClick={handleAnchorLink}
+        iconType="link"
+        id={`${id}-permLink`}
+      />
+    </EuiToolTip>
+  );
+};
+
+export const UserActionCopyLink = memo(UserActionCopyLinkComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_item.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_item.tsx
deleted file mode 100644
index eeb728aa7d1df..0000000000000
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_item.tsx
+++ /dev/null
@@ -1,197 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiLoadingSpinner,
-  EuiPanel,
-  EuiHorizontalRule,
-  EuiText,
-} from '@elastic/eui';
-import React from 'react';
-import styled, { css } from 'styled-components';
-
-import { UserActionAvatar } from './user_action_avatar';
-import { UserActionTitle } from './user_action_title';
-import * as i18n from './translations';
-
-interface UserActionItemProps {
-  caseConnectorName?: string;
-  createdAt: string;
-  'data-test-subj'?: string;
-  disabled: boolean;
-  id: string;
-  isEditable: boolean;
-  isLoading: boolean;
-  labelEditAction?: string;
-  labelQuoteAction?: string;
-  labelTitle?: JSX.Element;
-  linkId?: string | null;
-  fullName?: string | null;
-  markdown?: React.ReactNode;
-  onEdit?: (id: string) => void;
-  onQuote?: (id: string) => void;
-  username: string;
-  updatedAt?: string | null;
-  outlineComment?: (id: string) => void;
-  showBottomFooter?: boolean;
-  showTopFooter?: boolean;
-  idToOutline?: string | null;
-}
-
-export const UserActionItemContainer = styled(EuiFlexGroup)`
-  ${({ theme }) => css`
-    & {
-      background-image: linear-gradient(
-        to right,
-        transparent 0,
-        transparent 15px,
-        ${theme.eui.euiBorderColor} 15px,
-        ${theme.eui.euiBorderColor} 17px,
-        transparent 17px,
-        transparent 100%
-      );
-      background-repeat: no-repeat;
-      background-position: left ${theme.eui.euiSizeXXL};
-      margin-bottom: ${theme.eui.euiSizeS};
-    }
-    .userAction__panel {
-      margin-bottom: ${theme.eui.euiSize};
-    }
-    .userAction__circle {
-      flex-shrink: 0;
-      margin-right: ${theme.eui.euiSize};
-      vertical-align: top;
-    }
-    .userAction_loadingAvatar {
-      position: relative;
-      margin-right: ${theme.eui.euiSizeXL};
-      top: ${theme.eui.euiSizeM};
-      left: ${theme.eui.euiSizeS};
-    }
-    .userAction__title {
-      padding: ${theme.eui.euiSizeS} ${theme.eui.euiSizeL};
-      background: ${theme.eui.euiColorLightestShade};
-      border-bottom: ${theme.eui.euiBorderThin};
-      border-radius: ${theme.eui.euiBorderRadius} ${theme.eui.euiBorderRadius} 0 0;
-    }
-    .euiText--small * {
-      margin-bottom: 0;
-    }
-  `}
-`;
-
-const MyEuiPanel = styled(EuiPanel)<{ showoutline: string }>`
-  flex-grow: 0;
-  ${({ theme, showoutline }) =>
-    showoutline === 'true'
-      ? `
-      outline: solid 5px ${theme.eui.euiColorVis1_behindText};
-      margin: 0.5em;
-      transition: 0.8s;
-    `
-      : ''}
-`;
-
-const PushedContainer = styled(EuiFlexItem)`
-  ${({ theme }) => `
-    margin-top: ${theme.eui.euiSizeS};
-    margin-bottom: ${theme.eui.euiSizeXL};
-    hr {
-      margin: 5px;
-      height: ${theme.eui.euiBorderWidthThick};
-    }
-  `}
-`;
-
-const PushedInfoContainer = styled.div`
-  margin-left: 48px;
-`;
-
-export const UserActionItem = ({
-  caseConnectorName,
-  createdAt,
-  disabled,
-  'data-test-subj': dataTestSubj,
-  id,
-  idToOutline,
-  isEditable,
-  isLoading,
-  labelEditAction,
-  labelQuoteAction,
-  labelTitle,
-  linkId,
-  fullName,
-  markdown,
-  onEdit,
-  onQuote,
-  outlineComment,
-  showBottomFooter,
-  showTopFooter,
-  username,
-  updatedAt,
-}: UserActionItemProps) => (
-  <UserActionItemContainer data-test-subj={dataTestSubj} gutterSize={'none'} direction="column">
-    <EuiFlexItem>
-      <EuiFlexGroup gutterSize={'none'}>
-        <EuiFlexItem data-test-subj={`user-action-${id}-avatar`} grow={false}>
-          {(fullName && fullName.length > 0) || (username && username.length > 0) ? (
-            <UserActionAvatar name={fullName && fullName.length > 0 ? fullName : username ?? ''} />
-          ) : (
-            <EuiLoadingSpinner className="userAction_loadingAvatar" />
-          )}
-        </EuiFlexItem>
-        <EuiFlexItem data-test-subj={`user-action-${id}`}>
-          {isEditable && markdown}
-          {!isEditable && (
-            <MyEuiPanel
-              className="userAction__panel"
-              data-test-subj={`user-action-panel`}
-              paddingSize="none"
-              showoutline={id === idToOutline ? 'true' : 'false'}
-            >
-              <UserActionTitle
-                createdAt={createdAt}
-                disabled={disabled}
-                fullName={fullName}
-                id={id}
-                isLoading={isLoading}
-                labelEditAction={labelEditAction}
-                labelQuoteAction={labelQuoteAction}
-                labelTitle={labelTitle ?? <></>}
-                linkId={linkId}
-                onEdit={onEdit}
-                onQuote={onQuote}
-                outlineComment={outlineComment}
-                updatedAt={updatedAt}
-                username={username}
-              />
-              {markdown}
-            </MyEuiPanel>
-          )}
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiFlexItem>
-    {showTopFooter && (
-      <PushedContainer data-test-subj="show-top-footer">
-        <PushedInfoContainer>
-          <EuiText size="xs" color="subdued">
-            {i18n.ALREADY_PUSHED_TO_SERVICE(`${caseConnectorName}`)}
-          </EuiText>
-        </PushedInfoContainer>
-        <EuiHorizontalRule />
-        {showBottomFooter && (
-          <PushedInfoContainer data-test-subj="show-bottom-footer">
-            <EuiText size="xs" color="subdued">
-              {i18n.REQUIRED_UPDATE_TO_SERVICE(`${caseConnectorName}`)}
-            </EuiText>
-          </PushedInfoContainer>
-        )}
-      </PushedContainer>
-    )}
-  </UserActionItemContainer>
-);
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.test.tsx
index 6cf827ea55f1f..f1f7d40009045 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.test.tsx
@@ -17,8 +17,9 @@ const onChangeEditable = jest.fn();
 const onSaveContent = jest.fn();
 
 const timelineId = '1e10f150-949b-11ea-b63c-2bc51864784c';
+const timelineMarkdown = `[timeline](http://localhost:5601/app/security/timelines?timeline=(id:'${timelineId}',isOpen:!t))`;
 const defaultProps = {
-  content: `A link to a timeline [timeline](http://localhost:5601/app/security/timelines?timeline=(id:'${timelineId}',isOpen:!t))`,
+  content: `A link to a timeline ${timelineMarkdown}`,
   id: 'markdown-id',
   isEditable: false,
   onChangeEditable,
@@ -40,7 +41,11 @@ describe('UserActionMarkdown ', () => {
         </Router>
       </TestProviders>
     );
-    wrapper.find(`[data-test-subj="markdown-timeline-link"]`).first().simulate('click');
+
+    wrapper
+      .find(`[data-test-subj="markdown-timeline-link-${timelineId}"]`)
+      .first()
+      .simulate('click');
 
     expect(queryTimelineByIdSpy).toBeCalledWith({
       apolloClient: mockUseApolloClient(),
@@ -59,8 +64,19 @@ describe('UserActionMarkdown ', () => {
         </Router>
       </TestProviders>
     );
-    wrapper.find(`[data-test-subj="preview-tab"]`).first().simulate('click');
-    wrapper.find(`[data-test-subj="markdown-timeline-link"]`).first().simulate('click');
+
+    // Preview button of Markdown editor
+    wrapper
+      .find(
+        `[data-test-subj="user-action-markdown-form"] .euiMarkdownEditorToolbar .euiButtonEmpty`
+      )
+      .first()
+      .simulate('click');
+
+    wrapper
+      .find(`[data-test-subj="markdown-timeline-link-${timelineId}"]`)
+      .first()
+      .simulate('click');
     expect(queryTimelineByIdSpy).toBeCalledWith({
       apolloClient: mockUseApolloClient(),
       graphEventId: '',
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
index ac2ad179ec60c..45e46b2d7d2db 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
@@ -4,18 +4,24 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiFlexGroup, EuiFlexItem, EuiButtonEmpty, EuiButton } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+  EuiButton,
+  EuiMarkdownFormat,
+} from '@elastic/eui';
 import React, { useCallback } from 'react';
 import styled from 'styled-components';
 
 import * as i18n from '../case_view/translations';
-import { Markdown } from '../../../common/components/markdown';
-import { Form, useForm, UseField, useFormData } from '../../../shared_imports';
+import { Form, useForm, UseField } from '../../../shared_imports';
 import { schema, Content } from './schema';
-import { InsertTimelinePopover } from '../../../timelines/components/timeline/insert_timeline_popover';
-import { useInsertTimeline } from '../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline';
-import { MarkdownEditorForm } from '../../../common/components//markdown_editor/form';
-import { useTimelineClick } from '../utils/use_timeline_click';
+import {
+  MarkdownEditorForm,
+  parsingPlugins,
+  processingPlugins,
+} from '../../../common/components/markdown_editor/eui_form';
 
 const ContentWrapper = styled.div`
   padding: ${({ theme }) => `${theme.eui.euiSizeM} ${theme.eui.euiSizeL}`};
@@ -43,24 +49,12 @@ export const UserActionMarkdown = ({
   });
 
   const fieldName = 'content';
-  const { submit, setFieldValue } = form;
-  const [{ content: contentFormValue }] = useFormData({ form, watch: [fieldName] });
-
-  const onContentChange = useCallback((newValue) => setFieldValue(fieldName, newValue), [
-    setFieldValue,
-  ]);
-
-  const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline(
-    contentFormValue,
-    onContentChange
-  );
+  const { submit } = form;
 
   const handleCancelAction = useCallback(() => {
     onChangeEditable(id);
   }, [id, onChangeEditable]);
 
-  const handleTimelineClick = useTimelineClick();
-
   const handleSaveAction = useCallback(async () => {
     const { isValid, data } = await submit();
     if (isValid) {
@@ -105,29 +99,24 @@ export const UserActionMarkdown = ({
         path={fieldName}
         component={MarkdownEditorForm}
         componentProps={{
+          'aria-label': 'Cases markdown editor',
+          value: content,
+          id,
           bottomRightContent: renderButtons({
             cancelAction: handleCancelAction,
             saveAction: handleSaveAction,
           }),
-          onClickTimeline: handleTimelineClick,
-          onCursorPositionUpdate: handleCursorChange,
-          topRightContent: (
-            <InsertTimelinePopover
-              hideUntitled={true}
-              isDisabled={false}
-              onTimelineChange={handleOnTimelineChange}
-            />
-          ),
         }}
       />
     </Form>
   ) : (
-    <ContentWrapper>
-      <Markdown
-        onClickTimeline={handleTimelineClick}
-        raw={content}
-        data-test-subj="user-action-markdown"
-      />
+    <ContentWrapper data-test-subj="user-action-markdown">
+      <EuiMarkdownFormat
+        parsingPluginList={parsingPlugins}
+        processingPluginList={processingPlugins}
+      >
+        {content}
+      </EuiMarkdownFormat>
     </ContentWrapper>
   );
 };
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_move_to_reference.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_move_to_reference.test.tsx
new file mode 100644
index 0000000000000..5bb0f50ce25e5
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_move_to_reference.test.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount, ReactWrapper } from 'enzyme';
+import { UserActionMoveToReference } from './user_action_move_to_reference';
+
+const outlineComment = jest.fn();
+const props = {
+  id: 'move-to-ref-id',
+  outlineComment,
+};
+
+describe('UserActionMoveToReference ', () => {
+  let wrapper: ReactWrapper;
+
+  beforeAll(() => {
+    wrapper = mount(<UserActionMoveToReference {...props} />);
+  });
+
+  it('it renders', async () => {
+    expect(
+      wrapper.find(`[data-test-subj="move-to-link-${props.id}"]`).first().exists()
+    ).toBeTruthy();
+  });
+
+  it('calls outlineComment correctly', async () => {
+    wrapper.find(`[data-test-subj="move-to-link-${props.id}"]`).first().simulate('click');
+    expect(outlineComment).toHaveBeenCalledWith(props.id);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_move_to_reference.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_move_to_reference.tsx
new file mode 100644
index 0000000000000..39d016dd69520
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_move_to_reference.tsx
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useCallback } from 'react';
+import { EuiToolTip, EuiButtonIcon } from '@elastic/eui';
+
+import * as i18n from './translations';
+
+interface UserActionMoveToReferenceProps {
+  id: string;
+  outlineComment: (id: string) => void;
+}
+
+const UserActionMoveToReferenceComponent = ({
+  id,
+  outlineComment,
+}: UserActionMoveToReferenceProps) => {
+  const handleMoveToLink = useCallback(() => {
+    outlineComment(id);
+  }, [id, outlineComment]);
+
+  return (
+    <EuiToolTip position="top" content={<p>{i18n.MOVE_TO_ORIGINAL_COMMENT}</p>}>
+      <EuiButtonIcon
+        aria-label={i18n.MOVE_TO_ORIGINAL_COMMENT}
+        data-test-subj={`move-to-link-${id}`}
+        onClick={handleMoveToLink}
+        iconType="arrowUp"
+      />
+    </EuiToolTip>
+  );
+};
+
+export const UserActionMoveToReference = memo(UserActionMoveToReferenceComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_property_actions.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_property_actions.test.tsx
new file mode 100644
index 0000000000000..bd5da8aca7d4f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_property_actions.test.tsx
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount, ReactWrapper } from 'enzyme';
+import { UserActionPropertyActions } from './user_action_property_actions';
+
+const props = {
+  id: 'property-actions-id',
+  editLabel: 'edit',
+  quoteLabel: 'quote',
+  disabled: false,
+  isLoading: false,
+  onEdit: jest.fn(),
+  onQuote: jest.fn(),
+};
+
+describe('UserActionPropertyActions ', () => {
+  let wrapper: ReactWrapper;
+
+  beforeAll(() => {
+    wrapper = mount(<UserActionPropertyActions {...props} />);
+  });
+
+  it('it renders', async () => {
+    expect(
+      wrapper.find('[data-test-subj="user-action-title-loading"]').first().exists()
+    ).toBeFalsy();
+
+    expect(wrapper.find('[data-test-subj="property-actions"]').first().exists()).toBeTruthy();
+  });
+
+  it('it shows the edit and quote buttons', async () => {
+    wrapper.find('[data-test-subj="property-actions-ellipses"]').first().simulate('click');
+    wrapper.find('[data-test-subj="property-actions-pencil"]').exists();
+    wrapper.find('[data-test-subj="property-actions-quote"]').exists();
+  });
+
+  it('it shows the spinner when loading', async () => {
+    wrapper = mount(<UserActionPropertyActions {...props} isLoading={true} />);
+    expect(
+      wrapper.find('[data-test-subj="user-action-title-loading"]').first().exists()
+    ).toBeTruthy();
+
+    expect(wrapper.find('[data-test-subj="property-actions"]').first().exists()).toBeFalsy();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_property_actions.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_property_actions.tsx
new file mode 100644
index 0000000000000..454880e93a27f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_property_actions.tsx
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useMemo, useCallback } from 'react';
+import { EuiLoadingSpinner } from '@elastic/eui';
+
+import { PropertyActions } from '../property_actions';
+
+interface UserActionPropertyActionsProps {
+  id: string;
+  editLabel: string;
+  quoteLabel: string;
+  disabled: boolean;
+  isLoading: boolean;
+  onEdit: (id: string) => void;
+  onQuote: (id: string) => void;
+}
+
+const UserActionPropertyActionsComponent = ({
+  id,
+  editLabel,
+  quoteLabel,
+  disabled,
+  isLoading,
+  onEdit,
+  onQuote,
+}: UserActionPropertyActionsProps) => {
+  const onEditClick = useCallback(() => onEdit(id), [id, onEdit]);
+  const onQuoteClick = useCallback(() => onQuote(id), [id, onQuote]);
+
+  const propertyActions = useMemo(() => {
+    return [
+      {
+        disabled,
+        iconType: 'pencil',
+        label: editLabel,
+        onClick: onEditClick,
+      },
+      {
+        disabled,
+        iconType: 'quote',
+        label: quoteLabel,
+        onClick: onQuoteClick,
+      },
+    ];
+  }, [disabled, editLabel, quoteLabel, onEditClick, onQuoteClick]);
+  return (
+    <>
+      {isLoading && <EuiLoadingSpinner data-test-subj="user-action-title-loading" />}
+      {!isLoading && <PropertyActions propertyActions={propertyActions} />}
+    </>
+  );
+};
+
+export const UserActionPropertyActions = memo(UserActionPropertyActionsComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_timestamp.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_timestamp.test.tsx
new file mode 100644
index 0000000000000..a65806520c854
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_timestamp.test.tsx
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount, ReactWrapper } from 'enzyme';
+import { TestProviders } from '../../../common/mock';
+import { UserActionTimestamp } from './user_action_timestamp';
+
+jest.mock('@kbn/i18n/react', () => {
+  const originalModule = jest.requireActual('@kbn/i18n/react');
+  const FormattedRelative = jest.fn();
+  FormattedRelative.mockImplementationOnce(() => '2 days ago');
+  FormattedRelative.mockImplementation(() => '20 hours ago');
+
+  return {
+    ...originalModule,
+    FormattedRelative,
+  };
+});
+
+const props = {
+  createdAt: '2020-09-06T14:40:59.889Z',
+  updatedAt: '2020-09-07T14:40:59.889Z',
+};
+
+describe('UserActionTimestamp ', () => {
+  let wrapper: ReactWrapper;
+
+  beforeAll(() => {
+    wrapper = mount(<UserActionTimestamp {...props} />, { wrappingComponent: TestProviders });
+  });
+
+  it('it renders', async () => {
+    expect(
+      wrapper.find('[data-test-subj="user-action-title-creation-relative-time"]').first().exists()
+    ).toBeTruthy();
+    expect(
+      wrapper.find('[data-test-subj="user-action-title-edited-relative-time"]').first().exists()
+    ).toBeTruthy();
+  });
+
+  it('it shows only the created time when the updated time is missing', async () => {
+    const newWrapper = mount(<UserActionTimestamp createdAt="2020-09-06T14:40:59.889Z" />, {
+      wrappingComponent: TestProviders,
+    });
+
+    expect(
+      newWrapper
+        .find('[data-test-subj="user-action-title-creation-relative-time"]')
+        .first()
+        .exists()
+    ).toBeTruthy();
+    expect(
+      newWrapper.find('[data-test-subj="user-action-title-edited-relative-time"]').first().exists()
+    ).toBeFalsy();
+  });
+
+  it('it shows the timestamp correctly', async () => {
+    const createdText = wrapper
+      .find('[data-test-subj="user-action-title-creation-relative-time"]')
+      .first()
+      .text();
+
+    const updatedText = wrapper
+      .find('[data-test-subj="user-action-title-edited-relative-time"]')
+      .first()
+      .text();
+
+    expect(`${createdText} (${updatedText})`).toBe('2 days ago (20 hours ago)');
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_timestamp.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_timestamp.tsx
new file mode 100644
index 0000000000000..72dc5de9cdb3b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_timestamp.tsx
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo } from 'react';
+import { EuiTextColor } from '@elastic/eui';
+import { FormattedRelative } from '@kbn/i18n/react';
+
+import { LocalizedDateTooltip } from '../../../common/components/localized_date_tooltip';
+import * as i18n from './translations';
+
+interface UserActionAvatarProps {
+  createdAt: string;
+  updatedAt?: string | null;
+}
+
+const UserActionTimestampComponent = ({ createdAt, updatedAt }: UserActionAvatarProps) => {
+  return (
+    <>
+      <LocalizedDateTooltip date={new Date(createdAt)}>
+        <FormattedRelative
+          data-test-subj="user-action-title-creation-relative-time"
+          value={createdAt}
+        />
+      </LocalizedDateTooltip>
+      {updatedAt && (
+        <EuiTextColor color="subdued">
+          {/* be careful of the extra space at the beginning of the parenthesis */}
+          {' ('}
+          {i18n.EDITED_FIELD}{' '}
+          <LocalizedDateTooltip date={new Date(updatedAt)}>
+            <FormattedRelative
+              data-test-subj="user-action-title-edited-relative-time"
+              value={updatedAt}
+            />
+          </LocalizedDateTooltip>
+          {')'}
+        </EuiTextColor>
+      )}
+    </>
+  );
+};
+
+export const UserActionTimestamp = memo(UserActionTimestampComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_title.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_title.test.tsx
deleted file mode 100644
index 0bb02ce69a544..0000000000000
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_title.test.tsx
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { mount } from 'enzyme';
-import copy from 'copy-to-clipboard';
-import { Router, routeData, mockHistory } from '../__mock__/router';
-import { caseUserActions as basicUserActions } from '../../containers/mock';
-import { UserActionTitle } from './user_action_title';
-import { TestProviders } from '../../../common/mock';
-
-const outlineComment = jest.fn();
-const onEdit = jest.fn();
-const onQuote = jest.fn();
-
-jest.mock('copy-to-clipboard');
-const defaultProps = {
-  createdAt: basicUserActions[0].actionAt,
-  disabled: false,
-  fullName: basicUserActions[0].actionBy.fullName,
-  id: basicUserActions[0].actionId,
-  isLoading: false,
-  labelEditAction: 'labelEditAction',
-  labelQuoteAction: 'labelQuoteAction',
-  labelTitle: <>{'cool'}</>,
-  linkId: basicUserActions[0].commentId,
-  onEdit,
-  onQuote,
-  outlineComment,
-  updatedAt: basicUserActions[0].actionAt,
-  username: basicUserActions[0].actionBy.username,
-};
-
-describe('UserActionTitle ', () => {
-  beforeEach(() => {
-    jest.resetAllMocks();
-    jest.spyOn(routeData, 'useParams').mockReturnValue({ commentId: '123' });
-  });
-
-  it('Calls copy when copy link is clicked', async () => {
-    const wrapper = mount(
-      <TestProviders>
-        <Router history={mockHistory}>
-          <UserActionTitle {...defaultProps} />
-        </Router>
-      </TestProviders>
-    );
-    wrapper.find(`[data-test-subj="copy-link"]`).first().simulate('click');
-    expect(copy).toBeCalledTimes(1);
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_title.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_title.tsx
deleted file mode 100644
index 9477299e563a8..0000000000000
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_title.tsx
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  EuiLoadingSpinner,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiText,
-  EuiButtonIcon,
-  EuiToolTip,
-} from '@elastic/eui';
-import { FormattedRelative } from '@kbn/i18n/react';
-import copy from 'copy-to-clipboard';
-import { isEmpty } from 'lodash/fp';
-import React, { useMemo, useCallback } from 'react';
-import styled from 'styled-components';
-import { useParams } from 'react-router-dom';
-
-import { LocalizedDateTooltip } from '../../../common/components/localized_date_tooltip';
-import { useGetUrlSearch } from '../../../common/components/navigation/use_get_url_search';
-import { navTabs } from '../../../app/home/home_navigations';
-import { PropertyActions } from '../property_actions';
-import { SecurityPageName } from '../../../app/types';
-import * as i18n from './translations';
-
-const MySpinner = styled(EuiLoadingSpinner)`
-  .euiLoadingSpinner {
-    margin-top: 1px; // yes it matters!
-  }
-`;
-
-interface UserActionTitleProps {
-  createdAt: string;
-  disabled: boolean;
-  id: string;
-  isLoading: boolean;
-  labelEditAction?: string;
-  labelQuoteAction?: string;
-  labelTitle: JSX.Element;
-  linkId?: string | null;
-  fullName?: string | null;
-  updatedAt?: string | null;
-  username?: string | null;
-  onEdit?: (id: string) => void;
-  onQuote?: (id: string) => void;
-  outlineComment?: (id: string) => void;
-}
-
-export const UserActionTitle = ({
-  createdAt,
-  disabled,
-  fullName,
-  id,
-  isLoading,
-  labelEditAction,
-  labelQuoteAction,
-  labelTitle,
-  linkId,
-  onEdit,
-  onQuote,
-  outlineComment,
-  updatedAt,
-  username = i18n.UNKNOWN,
-}: UserActionTitleProps) => {
-  const { detailName: caseId } = useParams<{ detailName: string }>();
-  const urlSearch = useGetUrlSearch(navTabs.case);
-  const propertyActions = useMemo(() => {
-    return [
-      ...(labelEditAction != null && onEdit != null
-        ? [
-            {
-              disabled,
-              iconType: 'pencil',
-              label: labelEditAction,
-              onClick: () => onEdit(id),
-            },
-          ]
-        : []),
-      ...(labelQuoteAction != null && onQuote != null
-        ? [
-            {
-              disabled,
-              iconType: 'quote',
-              label: labelQuoteAction,
-              onClick: () => onQuote(id),
-            },
-          ]
-        : []),
-    ];
-  }, [disabled, id, labelEditAction, onEdit, labelQuoteAction, onQuote]);
-
-  const handleAnchorLink = useCallback(() => {
-    copy(
-      `${window.location.origin}${window.location.pathname}#${SecurityPageName.case}/${caseId}/${id}${urlSearch}`
-    );
-  }, [caseId, id, urlSearch]);
-
-  const handleMoveToLink = useCallback(() => {
-    if (outlineComment != null && linkId != null) {
-      outlineComment(linkId);
-    }
-  }, [linkId, outlineComment]);
-  return (
-    <EuiText size="s" className="userAction__title" data-test-subj={`user-action-title`}>
-      <EuiFlexGroup
-        alignItems="baseline"
-        gutterSize="none"
-        justifyContent="spaceBetween"
-        component="span"
-      >
-        <EuiFlexItem grow={false}>
-          <EuiFlexGroup alignItems="baseline" gutterSize="xs" component="span">
-            <EuiFlexItem grow={false}>
-              <EuiToolTip position="top" content={<p>{fullName ?? username}</p>}>
-                <strong>{username}</strong>
-              </EuiToolTip>
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>{labelTitle}</EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <LocalizedDateTooltip date={new Date(createdAt)}>
-                <FormattedRelative
-                  data-test-subj="user-action-title-creation-relative-time"
-                  value={createdAt}
-                />
-              </LocalizedDateTooltip>
-            </EuiFlexItem>
-            {updatedAt != null && (
-              <EuiFlexItem>
-                <EuiText size="s" color="subdued">
-                  {'('}
-                  {i18n.EDITED_FIELD}{' '}
-                  <LocalizedDateTooltip date={new Date(updatedAt)}>
-                    <FormattedRelative
-                      data-test-subj="user-action-title-edited-relative-time"
-                      value={updatedAt}
-                    />
-                  </LocalizedDateTooltip>
-                  {')'}
-                </EuiText>
-              </EuiFlexItem>
-            )}
-          </EuiFlexGroup>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiFlexGroup alignItems="baseline" gutterSize="none">
-            {!isEmpty(linkId) && (
-              <EuiFlexItem grow={false}>
-                <EuiToolTip position="top" content={<p>{i18n.MOVE_TO_ORIGINAL_COMMENT}</p>}>
-                  <EuiButtonIcon
-                    aria-label={i18n.MOVE_TO_ORIGINAL_COMMENT}
-                    data-test-subj={`move-to-link`}
-                    onClick={handleMoveToLink}
-                    iconType="arrowUp"
-                  />
-                </EuiToolTip>
-              </EuiFlexItem>
-            )}
-            <EuiFlexItem grow={false}>
-              <EuiToolTip position="top" content={<p>{i18n.COPY_REFERENCE_LINK}</p>}>
-                <EuiButtonIcon
-                  aria-label={i18n.COPY_REFERENCE_LINK}
-                  data-test-subj={`copy-link`}
-                  onClick={handleAnchorLink}
-                  iconType="link"
-                  id={`${id}-permLink`}
-                />
-              </EuiToolTip>
-            </EuiFlexItem>
-            {propertyActions.length > 0 && (
-              <EuiFlexItem grow={false}>
-                {isLoading && <MySpinner data-test-subj="user-action-title-loading" />}
-                {!isLoading && <PropertyActions propertyActions={propertyActions} />}
-              </EuiFlexItem>
-            )}
-          </EuiFlexGroup>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiText>
-  );
-};
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username.test.tsx
new file mode 100644
index 0000000000000..008eb18aef074
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username.test.tsx
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount, ReactWrapper } from 'enzyme';
+import { UserActionUsername } from './user_action_username';
+
+const props = {
+  username: 'elastic',
+  fullName: 'Elastic',
+};
+
+describe('UserActionUsername ', () => {
+  let wrapper: ReactWrapper;
+
+  beforeAll(() => {
+    wrapper = mount(<UserActionUsername {...props} />);
+  });
+
+  it('it renders', async () => {
+    expect(
+      wrapper.find('[data-test-subj="user-action-username-tooltip"]').first().exists()
+    ).toBeTruthy();
+  });
+
+  it('it shows the username', async () => {
+    expect(wrapper.find('[data-test-subj="user-action-username-tooltip"]').text()).toBe('elastic');
+  });
+
+  test('it shows the fullname when hovering the username', () => {
+    // Use fake timers so we don't have to wait for the EuiToolTip timeout
+    jest.useFakeTimers();
+
+    wrapper.find('[data-test-subj="user-action-username-tooltip"]').first().simulate('mouseOver');
+
+    // Run the timers so the EuiTooltip will be visible
+    jest.runAllTimers();
+
+    wrapper.update();
+    expect(wrapper.find('.euiToolTipPopover').text()).toBe('Elastic');
+
+    // Clearing all mocks will also reset fake timers.
+    jest.clearAllMocks();
+  });
+
+  test('it shows the username when hovering the username and the fullname is missing', () => {
+    // Use fake timers so we don't have to wait for the EuiToolTip timeout
+    jest.useFakeTimers();
+
+    const newWrapper = mount(<UserActionUsername username="elastic" />);
+    newWrapper
+      .find('[data-test-subj="user-action-username-tooltip"]')
+      .first()
+      .simulate('mouseOver');
+
+    // Run the timers so the EuiTooltip will be visible
+    jest.runAllTimers();
+
+    newWrapper.update();
+    expect(newWrapper.find('.euiToolTipPopover').text()).toBe('elastic');
+
+    // Clearing all mocks will also reset fake timers.
+    jest.clearAllMocks();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username.tsx
new file mode 100644
index 0000000000000..dbc153ddbe577
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username.tsx
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo } from 'react';
+import { EuiToolTip } from '@elastic/eui';
+import { isEmpty } from 'lodash/fp';
+
+interface UserActionUsernameProps {
+  username: string;
+  fullName?: string;
+}
+
+const UserActionUsernameComponent = ({ username, fullName }: UserActionUsernameProps) => {
+  return (
+    <EuiToolTip
+      position="top"
+      content={<p>{isEmpty(fullName) ? username : fullName}</p>}
+      data-test-subj="user-action-username-tooltip"
+    >
+      <strong>{username}</strong>
+    </EuiToolTip>
+  );
+};
+
+export const UserActionUsername = memo(UserActionUsernameComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username_with_avatar.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username_with_avatar.test.tsx
new file mode 100644
index 0000000000000..f8403738c24ea
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username_with_avatar.test.tsx
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount, ReactWrapper } from 'enzyme';
+import { UserActionUsernameWithAvatar } from './user_action_username_with_avatar';
+
+const props = {
+  username: 'elastic',
+  fullName: 'Elastic',
+};
+
+describe('UserActionUsernameWithAvatar ', () => {
+  let wrapper: ReactWrapper;
+
+  beforeAll(() => {
+    wrapper = mount(<UserActionUsernameWithAvatar {...props} />);
+  });
+
+  it('it renders', async () => {
+    expect(
+      wrapper.find('[data-test-subj="user-action-username-with-avatar"]').first().exists()
+    ).toBeTruthy();
+    expect(
+      wrapper.find('[data-test-subj="user-action-username-avatar"]').first().exists()
+    ).toBeTruthy();
+  });
+
+  it('it shows the avatar', async () => {
+    expect(wrapper.find('[data-test-subj="user-action-username-avatar"]').first().text()).toBe('E');
+  });
+
+  it('it shows the avatar without fullName', async () => {
+    const newWrapper = mount(<UserActionUsernameWithAvatar username="elastic" />);
+    expect(newWrapper.find('[data-test-subj="user-action-username-avatar"]').first().text()).toBe(
+      'e'
+    );
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username_with_avatar.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username_with_avatar.tsx
new file mode 100644
index 0000000000000..e2326a3580e6f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_username_with_avatar.tsx
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo } from 'react';
+import { EuiFlexGroup, EuiFlexItem, EuiAvatar } from '@elastic/eui';
+import { isEmpty } from 'lodash/fp';
+
+import { UserActionUsername } from './user_action_username';
+
+interface UserActionUsernameWithAvatarProps {
+  username: string;
+  fullName?: string;
+}
+
+const UserActionUsernameWithAvatarComponent = ({
+  username,
+  fullName,
+}: UserActionUsernameWithAvatarProps) => {
+  return (
+    <EuiFlexGroup
+      responsive={false}
+      alignItems="center"
+      gutterSize="s"
+      data-test-subj="user-action-username-with-avatar"
+    >
+      <EuiFlexItem grow={false}>
+        <EuiAvatar
+          size="s"
+          name={isEmpty(fullName) ? username : fullName ?? ''}
+          data-test-subj="user-action-username-avatar"
+        />
+      </EuiFlexItem>
+      <EuiFlexItem grow={false}>
+        <UserActionUsername username={username} fullName={fullName} />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+export const UserActionUsernameWithAvatar = memo(UserActionUsernameWithAvatarComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/translations.ts b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/translations.ts
index b1ab509417fe5..980ec89f524bc 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/translations.ts
@@ -16,7 +16,7 @@ export const ALERTS_DOCUMENT_TYPE = i18n.translate(
 export const TOTAL_COUNT_OF_ALERTS = i18n.translate(
   'xpack.securitySolution.alertsView.totalCountOfAlerts',
   {
-    defaultMessage: 'external alerts match the search criteria',
+    defaultMessage: 'external alerts',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
index 8068d51a80153..074e6faf80c7d 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
@@ -9,7 +9,7 @@ import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
 import { BrowserFields } from '../../containers/source';
-import { DetailItem } from '../../../../common/search_strategy/timeline';
+import { TimelineEventsDetailsItem } from '../../../../common/search_strategy/timeline';
 import { ColumnHeaderOptions } from '../../../timelines/store/timeline/model';
 import { OnUpdateColumns } from '../../../timelines/components/timeline/events';
 import { EventFieldsBrowser } from './event_fields_browser';
@@ -28,7 +28,7 @@ CollapseLink.displayName = 'CollapseLink';
 interface Props {
   browserFields: BrowserFields;
   columnHeaders: ColumnHeaderOptions[];
-  data: DetailItem[];
+  data: TimelineEventsDetailsItem[];
   id: string;
   view: View;
   onEventToggled: () => void;
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_fields_browser.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_fields_browser.tsx
index 9737a09c89f49..79250ae9bec52 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_fields_browser.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_fields_browser.tsx
@@ -10,7 +10,7 @@ import React, { useMemo } from 'react';
 
 import { ColumnHeaderOptions } from '../../../timelines/store/timeline/model';
 import { BrowserFields, getAllFieldsByName } from '../../containers/source';
-import { DetailItem } from '../../../../common/search_strategy/timeline';
+import { TimelineEventsDetailsItem } from '../../../../common/search_strategy/timeline';
 import { OnUpdateColumns } from '../../../timelines/components/timeline/events';
 
 import { getColumns } from './columns';
@@ -19,7 +19,7 @@ import { search } from './helpers';
 interface Props {
   browserFields: BrowserFields;
   columnHeaders: ColumnHeaderOptions[];
-  data: DetailItem[];
+  data: TimelineEventsDetailsItem[];
   eventId: string;
   onUpdateColumns: OnUpdateColumns;
   timelineId: string;
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/stateful_event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/stateful_event_details.tsx
index f4028c988acb8..bb74935d5703e 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/stateful_event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/stateful_event_details.tsx
@@ -7,7 +7,7 @@
 import React, { useCallback, useState } from 'react';
 
 import { BrowserFields } from '../../containers/source';
-import { DetailItem } from '../../../../common/search_strategy/timeline';
+import { TimelineEventsDetailsItem } from '../../../../common/search_strategy/timeline';
 import { ColumnHeaderOptions } from '../../../timelines/store/timeline/model';
 import { OnUpdateColumns } from '../../../timelines/components/timeline/events';
 
@@ -16,7 +16,7 @@ import { EventDetails, View } from './event_details';
 interface Props {
   browserFields: BrowserFields;
   columnHeaders: ColumnHeaderOptions[];
-  data: DetailItem[];
+  data: TimelineEventsDetailsItem[];
   id: string;
   onEventToggled: () => void;
   onUpdateColumns: OnUpdateColumns;
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
index 833688ae57993..037655f594241 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
@@ -5,7 +5,6 @@
  */
 
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 import useResizeObserver from 'use-resize-observer/polyfilled';
 
 import '../../mock/match_media';
@@ -26,6 +25,11 @@ import { TimelineId } from '../../../../common/types/timeline';
 import { KqlMode } from '../../../timelines/store/timeline/model';
 import { SortDirection } from '../../../timelines/components/timeline/body/sort';
 import { AlertsTableFilterGroup } from '../../../detections/components/alerts_table/alerts_filter_group';
+import { useTimelineEvents } from '../../../timelines/containers';
+
+jest.mock('../../../timelines/containers', () => ({
+  useTimelineEvents: jest.fn(),
+}));
 
 jest.mock('../../components/url_state/normalize_time_range.ts');
 
@@ -83,20 +87,19 @@ describe('EventsViewer', () => {
   const mount = useMountAppended();
 
   beforeEach(() => {
+    (useTimelineEvents as jest.Mock).mockReturnValue([false, mockEventViewerResponse]);
     mockUseFetchIndexPatterns.mockImplementation(() => [{ ...defaultMocks }]);
   });
 
   test('it renders the "Showing..." subtitle with the expected event count', async () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-          <StatefulEventsViewer
-            defaultModel={eventsDefaultModel}
-            end={to}
-            id={'test-stateful-events-viewer'}
-            start={from}
-          />
-        </MockedProvider>
+        <StatefulEventsViewer
+          defaultModel={eventsDefaultModel}
+          end={to}
+          id={'test-stateful-events-viewer'}
+          start={from}
+        />
       </TestProviders>
     );
 
@@ -114,14 +117,12 @@ describe('EventsViewer', () => {
 
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-          <StatefulEventsViewer
-            defaultModel={eventsDefaultModel}
-            end={to}
-            id={'test-stateful-events-viewer'}
-            start={from}
-          />
-        </MockedProvider>
+        <StatefulEventsViewer
+          defaultModel={eventsDefaultModel}
+          end={to}
+          id={'test-stateful-events-viewer'}
+          start={from}
+        />
       </TestProviders>
     );
 
@@ -139,14 +140,12 @@ describe('EventsViewer', () => {
 
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-          <StatefulEventsViewer
-            defaultModel={eventsDefaultModel}
-            end={to}
-            id={'test-stateful-events-viewer'}
-            start={''}
-          />
-        </MockedProvider>
+        <StatefulEventsViewer
+          defaultModel={eventsDefaultModel}
+          end={to}
+          id={'test-stateful-events-viewer'}
+          start={''}
+        />
       </TestProviders>
     );
 
@@ -164,14 +163,12 @@ describe('EventsViewer', () => {
 
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-          <StatefulEventsViewer
-            defaultModel={eventsDefaultModel}
-            end={''}
-            id={'test-stateful-events-viewer'}
-            start={from}
-          />
-        </MockedProvider>
+        <StatefulEventsViewer
+          defaultModel={eventsDefaultModel}
+          end={''}
+          id={'test-stateful-events-viewer'}
+          start={from}
+        />
       </TestProviders>
     );
 
@@ -187,14 +184,12 @@ describe('EventsViewer', () => {
   test('it renders the Fields Browser as a settings gear', async () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-          <StatefulEventsViewer
-            defaultModel={eventsDefaultModel}
-            end={to}
-            id={'test-stateful-events-viewer'}
-            start={from}
-          />
-        </MockedProvider>
+        <StatefulEventsViewer
+          defaultModel={eventsDefaultModel}
+          end={to}
+          id={'test-stateful-events-viewer'}
+          start={from}
+        />
       </TestProviders>
     );
 
@@ -208,21 +203,19 @@ describe('EventsViewer', () => {
   test('it renders the footer containing the Load More button', async () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-          <StatefulEventsViewer
-            defaultModel={eventsDefaultModel}
-            end={to}
-            id={'test-stateful-events-viewer'}
-            start={from}
-          />
-        </MockedProvider>
+        <StatefulEventsViewer
+          defaultModel={eventsDefaultModel}
+          end={to}
+          id={'test-stateful-events-viewer'}
+          start={from}
+        />
       </TestProviders>
     );
 
     await waitFor(() => {
       wrapper.update();
 
-      expect(wrapper.find(`[data-test-subj="TimelineMoreButton"]`).first().exists()).toBe(true);
+      expect(wrapper.find(`[data-test-subj="timeline-pagination"]`).first().exists()).toBe(true);
     });
   });
 
@@ -230,14 +223,12 @@ describe('EventsViewer', () => {
     test(`it renders the ${header.id} default EventsViewer column header`, async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <StatefulEventsViewer
-              defaultModel={eventsDefaultModel}
-              end={to}
-              id={'test-stateful-events-viewer'}
-              start={from}
-            />
-          </MockedProvider>
+          <StatefulEventsViewer
+            defaultModel={eventsDefaultModel}
+            end={to}
+            id={'test-stateful-events-viewer'}
+            start={from}
+          />
         </TestProviders>
       );
 
@@ -257,13 +248,11 @@ describe('EventsViewer', () => {
     test('it renders the provided headerFilterGroup', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer
-              {...eventsViewerDefaultProps}
-              graphEventId={undefined}
-              headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
-            />
-          </MockedProvider>
+          <EventsViewer
+            {...eventsViewerDefaultProps}
+            graphEventId={undefined}
+            headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+          />
         </TestProviders>
       );
 
@@ -277,13 +266,11 @@ describe('EventsViewer', () => {
     test('it has a visible HeaderFilterGroupWrapper when Resolver is NOT showing, because graphEventId is undefined', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer
-              {...eventsViewerDefaultProps}
-              graphEventId={undefined}
-              headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
-            />
-          </MockedProvider>
+          <EventsViewer
+            {...eventsViewerDefaultProps}
+            graphEventId={undefined}
+            headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+          />
         </TestProviders>
       );
 
@@ -299,13 +286,11 @@ describe('EventsViewer', () => {
     test('it has a visible HeaderFilterGroupWrapper when Resolver is NOT showing, because graphEventId is an empty string', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer
-              {...eventsViewerDefaultProps}
-              graphEventId=""
-              headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
-            />
-          </MockedProvider>
+          <EventsViewer
+            {...eventsViewerDefaultProps}
+            graphEventId=""
+            headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+          />
         </TestProviders>
       );
 
@@ -321,13 +306,11 @@ describe('EventsViewer', () => {
     test('it does NOT have a visible HeaderFilterGroupWrapper when Resolver is showing, because graphEventId is a valid id', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer
-              {...eventsViewerDefaultProps}
-              graphEventId="a valid id"
-              headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
-            />
-          </MockedProvider>
+          <EventsViewer
+            {...eventsViewerDefaultProps}
+            graphEventId="a valid id"
+            headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+          />
         </TestProviders>
       );
 
@@ -343,13 +326,11 @@ describe('EventsViewer', () => {
     test('it (still) renders an invisible headerFilterGroup (to maintain state while hidden) when Resolver is showing, because graphEventId is a valid id', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer
-              {...eventsViewerDefaultProps}
-              graphEventId="a valid id"
-              headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
-            />
-          </MockedProvider>
+          <EventsViewer
+            {...eventsViewerDefaultProps}
+            graphEventId="a valid id"
+            headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+          />
         </TestProviders>
       );
 
@@ -365,9 +346,7 @@ describe('EventsViewer', () => {
     test('it renders the provided utilityBar when Resolver is NOT showing, because graphEventId is undefined', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer {...eventsViewerDefaultProps} graphEventId={undefined} />
-          </MockedProvider>
+          <EventsViewer {...eventsViewerDefaultProps} graphEventId={undefined} />
         </TestProviders>
       );
 
@@ -381,9 +360,7 @@ describe('EventsViewer', () => {
     test('it renders the provided utilityBar when Resolver is NOT showing, because graphEventId is an empty string', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer {...eventsViewerDefaultProps} graphEventId="" />
-          </MockedProvider>
+          <EventsViewer {...eventsViewerDefaultProps} graphEventId="" />
         </TestProviders>
       );
 
@@ -397,9 +374,7 @@ describe('EventsViewer', () => {
     test('it does NOT render the provided utilityBar when Resolver is showing, because graphEventId is a valid id', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer {...eventsViewerDefaultProps} graphEventId="a valid id" />
-          </MockedProvider>
+          <EventsViewer {...eventsViewerDefaultProps} graphEventId="a valid id" />
         </TestProviders>
       );
 
@@ -415,9 +390,7 @@ describe('EventsViewer', () => {
     test('it renders the inspect button when Resolver is NOT showing, because graphEventId is undefined', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer {...eventsViewerDefaultProps} graphEventId={undefined} />
-          </MockedProvider>
+          <EventsViewer {...eventsViewerDefaultProps} graphEventId={undefined} />
         </TestProviders>
       );
 
@@ -431,9 +404,7 @@ describe('EventsViewer', () => {
     test('it renders the inspect button when Resolver is NOT showing, because graphEventId is an empty string', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer {...eventsViewerDefaultProps} graphEventId="" />
-          </MockedProvider>
+          <EventsViewer {...eventsViewerDefaultProps} graphEventId="" />
         </TestProviders>
       );
 
@@ -447,9 +418,7 @@ describe('EventsViewer', () => {
     test('it does NOT render the inspect button when Resolver is showing, because graphEventId is a valid id', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer {...eventsViewerDefaultProps} graphEventId="a valid id" />
-          </MockedProvider>
+          <EventsViewer {...eventsViewerDefaultProps} graphEventId="a valid id" />
         </TestProviders>
       );
 
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
index 3d193856a8ae4..2998bd031d674 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
@@ -10,9 +10,9 @@ import React, { useEffect, useMemo, useState } from 'react';
 import styled from 'styled-components';
 import deepEqual from 'fast-deep-equal';
 
+import { Direction } from '../../../../common/search_strategy';
 import { BrowserFields, DocValueFields } from '../../containers/source';
-import { TimelineQuery } from '../../../timelines/containers';
-import { Direction } from '../../../graphql/types';
+import { useTimelineEvents } from '../../../timelines/containers';
 import { useKibana } from '../../lib/kibana';
 import { ColumnHeaderOptions, KqlMode } from '../../../timelines/store/timeline/model';
 import { HeaderSection } from '../header_section';
@@ -196,14 +196,51 @@ const EventsViewerComponent: React.FC<Props> = ({
       ),
     [columnsHeader, queryFields]
   );
+
   const sortField = useMemo(
     () => ({
-      sortFieldId: sort.columnId,
+      field: sort.columnId,
       direction: sort.sortDirection as Direction,
     }),
     [sort.columnId, sort.sortDirection]
   );
 
+  const [
+    loading,
+    { events, updatedAt, inspect, loadPage, pageInfo, refetch, totalCount = 0 },
+  ] = useTimelineEvents({
+    docValueFields,
+    fields,
+    filterQuery: combinedQueries!.filterQuery,
+    id,
+    indexPattern,
+    limit: itemsPerPage,
+    sort: sortField,
+    startDate: start,
+    endDate: end,
+    skip: !canQueryTimeline,
+  });
+
+  const totalCountMinusDeleted = useMemo(
+    () => (totalCount > 0 ? totalCount - deletedEventIds.length : 0),
+    [deletedEventIds.length, totalCount]
+  );
+
+  const subtitle = useMemo(
+    () =>
+      `${i18n.SHOWING}: ${totalCountMinusDeleted.toLocaleString()} ${unit(totalCountMinusDeleted)}`,
+    [totalCountMinusDeleted, unit]
+  );
+
+  const nonDeletedEvents = useMemo(() => events.filter((e) => !deletedEventIds.includes(e._id)), [
+    deletedEventIds,
+    events,
+  ]);
+
+  useEffect(() => {
+    setIsQueryLoading(loading);
+  }, [loading]);
+
   return (
     <StyledEuiPanel
       data-test-subj="events-viewer-panel"
@@ -211,104 +248,68 @@ const EventsViewerComponent: React.FC<Props> = ({
     >
       {canQueryTimeline ? (
         <EventDetailsWidthProvider>
-          <TimelineQuery
-            docValueFields={docValueFields}
-            fields={fields}
-            filterQuery={combinedQueries!.filterQuery}
-            id={id}
-            indexPattern={indexPattern}
-            limit={itemsPerPage}
-            sortField={sortField}
-            sourceId="default"
-            startDate={start}
-            endDate={end}
-            queryDeduplication="events_viewer"
-          >
-            {({
-              events,
-              getUpdatedAt,
-              inspect,
-              loading,
-              loadMore,
-              pageInfo,
-              refetch,
-              totalCount = 0,
-            }) => {
-              setIsQueryLoading(loading);
-              const totalCountMinusDeleted =
-                totalCount > 0 ? totalCount - deletedEventIds.length : 0;
-
-              const subtitle = `${i18n.SHOWING}: ${totalCountMinusDeleted.toLocaleString()} ${unit(
-                totalCountMinusDeleted
-              )}`;
-
-              return (
-                <>
-                  <HeaderSection
-                    id={!resolverIsShowing(graphEventId) ? id : undefined}
-                    height={headerFilterGroup ? COMPACT_HEADER_HEIGHT : EVENTS_VIEWER_HEADER_HEIGHT}
-                    subtitle={utilityBar ? undefined : subtitle}
-                    title={inspect ? justTitle : titleWithExitFullScreen}
-                  >
-                    {headerFilterGroup && (
-                      <HeaderFilterGroupWrapper
-                        data-test-subj="header-filter-group-wrapper"
-                        show={!resolverIsShowing(graphEventId)}
-                      >
-                        {headerFilterGroup}
-                      </HeaderFilterGroupWrapper>
-                    )}
-                  </HeaderSection>
-                  {utilityBar && !resolverIsShowing(graphEventId) && (
-                    <UtilityBar>{utilityBar?.(refetch, totalCountMinusDeleted)}</UtilityBar>
-                  )}
-                  <EventsContainerLoading data-test-subj={`events-container-loading-${loading}`}>
-                    <TimelineRefetch
-                      id={id}
-                      inputId="global"
-                      inspect={inspect}
-                      loading={loading}
-                      refetch={refetch}
-                    />
+          <>
+            <HeaderSection
+              id={!resolverIsShowing(graphEventId) ? id : undefined}
+              height={headerFilterGroup ? COMPACT_HEADER_HEIGHT : EVENTS_VIEWER_HEADER_HEIGHT}
+              subtitle={utilityBar ? undefined : subtitle}
+              title={inspect ? justTitle : titleWithExitFullScreen}
+            >
+              {headerFilterGroup && (
+                <HeaderFilterGroupWrapper
+                  data-test-subj="header-filter-group-wrapper"
+                  show={!resolverIsShowing(graphEventId)}
+                >
+                  {headerFilterGroup}
+                </HeaderFilterGroupWrapper>
+              )}
+            </HeaderSection>
+            {utilityBar && !resolverIsShowing(graphEventId) && (
+              <UtilityBar>{utilityBar?.(refetch, totalCountMinusDeleted)}</UtilityBar>
+            )}
+            <EventsContainerLoading data-test-subj={`events-container-loading-${loading}`}>
+              <TimelineRefetch
+                id={id}
+                inputId="global"
+                inspect={inspect}
+                loading={loading}
+                refetch={refetch}
+              />
 
-                    <StatefulBody
-                      browserFields={browserFields}
-                      data={events.filter((e) => !deletedEventIds.includes(e._id))}
-                      docValueFields={docValueFields}
-                      id={id}
-                      isEventViewer={true}
-                      refetch={refetch}
-                      sort={sort}
-                      toggleColumn={toggleColumn}
-                    />
+              <StatefulBody
+                browserFields={browserFields}
+                data={nonDeletedEvents}
+                docValueFields={docValueFields}
+                id={id}
+                isEventViewer={true}
+                refetch={refetch}
+                sort={sort}
+                toggleColumn={toggleColumn}
+              />
 
-                    {
-                      /** Hide the footer if Resolver is showing. */
-                      !graphEventId && (
-                        <Footer
-                          data-test-subj="events-viewer-footer"
-                          getUpdatedAt={getUpdatedAt}
-                          hasNextPage={getOr(false, 'hasNextPage', pageInfo)!}
-                          height={footerHeight}
-                          id={id}
-                          isLive={isLive}
-                          isLoading={loading}
-                          itemsCount={events.length}
-                          itemsPerPage={itemsPerPage}
-                          itemsPerPageOptions={itemsPerPageOptions}
-                          onChangeItemsPerPage={onChangeItemsPerPage}
-                          onLoadMore={loadMore}
-                          nextCursor={getOr(null, 'endCursor.value', pageInfo)!}
-                          serverSideEventCount={totalCountMinusDeleted}
-                          tieBreaker={getOr(null, 'endCursor.tiebreaker', pageInfo)}
-                        />
-                      )
-                    }
-                  </EventsContainerLoading>
-                </>
-              );
-            }}
-          </TimelineQuery>
+              {
+                /** Hide the footer if Resolver is showing. */
+                !graphEventId && (
+                  <Footer
+                    activePage={getOr(0, 'activePage', pageInfo)}
+                    data-test-subj="events-viewer-footer"
+                    updatedAt={updatedAt}
+                    height={footerHeight}
+                    id={id}
+                    isLive={isLive}
+                    isLoading={loading}
+                    itemsCount={nonDeletedEvents.length}
+                    itemsPerPage={itemsPerPage}
+                    itemsPerPageOptions={itemsPerPageOptions}
+                    onChangeItemsPerPage={onChangeItemsPerPage}
+                    onChangePage={loadPage}
+                    serverSideEventCount={totalCountMinusDeleted}
+                    totalPages={getOr(0, 'totalPages', pageInfo)}
+                  />
+                )
+              }
+            </EventsContainerLoading>
+          </>
         </EventDetailsWidthProvider>
       ) : null}
     </StyledEuiPanel>
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
index 4509d01e82e25..8c61281422c2a 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
@@ -5,7 +5,6 @@
  */
 
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 import useResizeObserver from 'use-resize-observer/polyfilled';
 
 import '../../mock/match_media';
@@ -19,6 +18,11 @@ import { StatefulEventsViewer } from '.';
 import { useFetchIndexPatterns } from '../../../detections/containers/detection_engine/rules/fetch_index_patterns';
 import { mockBrowserFields } from '../../containers/source/mock';
 import { eventsDefaultModel } from './default_model';
+import { useTimelineEvents } from '../../../timelines/containers';
+
+jest.mock('../../../timelines/containers', () => ({
+  useTimelineEvents: jest.fn(),
+}));
 
 jest.mock('../../components/url_state/normalize_time_range.ts');
 
@@ -41,17 +45,17 @@ const to = '2019-08-26T22:10:56.791Z';
 describe('StatefulEventsViewer', () => {
   const mount = useMountAppended();
 
+  (useTimelineEvents as jest.Mock).mockReturnValue([false, mockEventViewerResponse]);
+
   test('it renders the events viewer', async () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-          <StatefulEventsViewer
-            defaultModel={eventsDefaultModel}
-            end={to}
-            id={'test-stateful-events-viewer'}
-            start={from}
-          />
-        </MockedProvider>
+        <StatefulEventsViewer
+          defaultModel={eventsDefaultModel}
+          end={to}
+          id={'test-stateful-events-viewer'}
+          start={from}
+        />
       </TestProviders>
     );
 
@@ -66,14 +70,12 @@ describe('StatefulEventsViewer', () => {
   test('it renders InspectButtonContainer', async () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-          <StatefulEventsViewer
-            defaultModel={eventsDefaultModel}
-            end={to}
-            id={'test-stateful-events-viewer'}
-            start={from}
-          />
-        </MockedProvider>
+        <StatefulEventsViewer
+          defaultModel={eventsDefaultModel}
+          end={to}
+          id={'test-stateful-events-viewer'}
+          start={from}
+        />
       </TestProviders>
     );
 
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/mock.ts b/x-pack/plugins/security_solution/public/common/components/events_viewer/mock.ts
index 6266e84051901..f6fb01be4371f 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/mock.ts
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/mock.ts
@@ -4,65 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { noop } from 'lodash/fp';
-import { timelineQuery } from '../../../timelines/containers/index.gql_query';
-
-export const mockEventViewerResponse = [
-  {
-    request: {
-      query: timelineQuery,
-      fetchPolicy: 'network-only',
-      notifyOnNetworkStatusChange: true,
-      variables: {
-        fieldRequested: [
-          '@timestamp',
-          'message',
-          'host.name',
-          'event.module',
-          'event.dataset',
-          'event.action',
-          'user.name',
-          'source.ip',
-          'destination.ip',
-        ],
-        filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
-        sourceId: 'default',
-        timerange: {
-          interval: '12h',
-          from: '2019-08-26T22:10:56.791Z',
-          to: '2019-08-27T22:10:56.794Z',
-        },
-        pagination: { limit: 25, cursor: null, tiebreaker: null },
-        sortField: { sortFieldId: '@timestamp', direction: 'desc' },
-        defaultIndex: ['filebeat-*', 'auditbeat-*', 'packetbeat-*'],
-        docValueFields: [
-          { field: '@timestamp', format: 'date_time' },
-          { field: 'event.end', format: 'date_time' },
-        ],
-        inspect: false,
-        queryDeduplication: 'events_viewer',
-      },
-    },
-    result: {
-      loading: false,
-      fetchMore: noop,
-      refetch: noop,
-      data: {
-        source: {
-          id: 'default',
-          Timeline: {
-            totalCount: 12,
-            pageInfo: {
-              endCursor: null,
-              hasNextPage: true,
-              __typename: 'PageInfo',
-            },
-            edges: [],
-            __typename: 'TimelineData',
-          },
-          __typename: 'Source',
-        },
-      },
-    },
+export const mockEventViewerResponse = {
+  totalCount: 12,
+  pageInfo: {
+    activePage: 0,
+    totalPages: 10,
   },
-];
+  events: [],
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.test.tsx
index cef92ce2a7817..691a7d99d9345 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.test.tsx
@@ -18,7 +18,8 @@ import { stubIndexPattern } from 'src/plugins/data/common/index_patterns/index_p
 import { useAddOrUpdateException } from '../use_add_exception';
 import { useFetchOrCreateRuleExceptionList } from '../use_fetch_or_create_rule_exception_list';
 import { useSignalIndex } from '../../../../detections/containers/detection_engine/alerts/use_signal_index';
-import { TimelineNonEcsData, Ecs } from '../../../../graphql/types';
+import { Ecs } from '../../../../../common/ecs';
+import { TimelineNonEcsData } from '../../../../../common/search_strategy/timeline';
 import * as builder from '../builder';
 import * as helpers from '../helpers';
 import { getExceptionListItemSchemaMock } from '../../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
index bcbad2dfee9f0..721e53732c093 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
@@ -29,7 +29,8 @@ import {
 import * as i18nCommon from '../../../translations';
 import * as i18n from './translations';
 import * as sharedI18n from '../translations';
-import { TimelineNonEcsData, Ecs } from '../../../../graphql/types';
+import { Ecs } from '../../../../../common/ecs';
+import { TimelineNonEcsData } from '../../../../../common/search_strategy/timeline';
 import { useAppToasts } from '../../../hooks/use_app_toasts';
 import { useKibana } from '../../../lib/kibana';
 import { ExceptionBuilderComponent } from '../builder';
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
index 18d2130dd3811..3c3c71a2b33e7 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
@@ -38,7 +38,7 @@ import {
 } from '../../../shared_imports';
 import { IIndexPattern } from '../../../../../../../src/plugins/data/common';
 import { validate } from '../../../../common/validate';
-import { TimelineNonEcsData } from '../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../common/search_strategy/timeline';
 import { WithCopyToClipboard } from '../../lib/clipboard/with_copy_to_clipboard';
 
 /**
diff --git a/x-pack/plugins/security_solution/public/common/components/last_event_time/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/last_event_time/index.test.tsx
index 2f0060c91668b..9473ba67a1c4f 100644
--- a/x-pack/plugins/security_solution/public/common/components/last_event_time/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/last_event_time/index.test.tsx
@@ -11,29 +11,30 @@ import { LastEventIndexKey } from '../../../graphql/types';
 import { mockLastEventTimeQuery } from '../../containers/events/last_event_time/mock';
 
 import { useMountAppended } from '../../utils/use_mount_appended';
-import { useLastEventTimeQuery } from '../../containers/events/last_event_time';
+import { useTimelineLastEventTime } from '../../containers/events/last_event_time';
 import { TestProviders } from '../../mock';
 
 import { LastEventTime } from '.';
 
-const mockUseLastEventTimeQuery: jest.Mock = useLastEventTimeQuery as jest.Mock;
 jest.mock('../../containers/events/last_event_time', () => ({
-  useLastEventTimeQuery: jest.fn(),
+  useTimelineLastEventTime: jest.fn(),
 }));
 
 describe('Last Event Time Stat', () => {
   const mount = useMountAppended();
 
   beforeEach(() => {
-    mockUseLastEventTimeQuery.mockReset();
+    (useTimelineLastEventTime as jest.Mock).mockReset();
   });
 
   test('Loading', async () => {
-    mockUseLastEventTimeQuery.mockImplementation(() => ({
-      loading: true,
-      lastSeen: null,
-      errorMessage: null,
-    }));
+    (useTimelineLastEventTime as jest.Mock).mockReturnValue([
+      true,
+      {
+        lastSeen: null,
+        errorMessage: null,
+      },
+    ]);
     const wrapper = mount(
       <TestProviders>
         <LastEventTime indexKey={LastEventIndexKey.hosts} />
@@ -44,11 +45,13 @@ describe('Last Event Time Stat', () => {
     );
   });
   test('Last seen', async () => {
-    mockUseLastEventTimeQuery.mockImplementation(() => ({
-      loading: false,
-      lastSeen: mockLastEventTimeQuery[0].result.data!.source.LastEventTime.lastSeen,
-      errorMessage: mockLastEventTimeQuery[0].result.data!.source.LastEventTime.errorMessage,
-    }));
+    (useTimelineLastEventTime as jest.Mock).mockReturnValue([
+      false,
+      {
+        lastSeen: mockLastEventTimeQuery[0].result.data!.source.LastEventTime.lastSeen,
+        errorMessage: mockLastEventTimeQuery[0].result.data!.source.LastEventTime.errorMessage,
+      },
+    ]);
     const wrapper = mount(
       <TestProviders>
         <LastEventTime indexKey={LastEventIndexKey.hosts} />
@@ -57,11 +60,13 @@ describe('Last Event Time Stat', () => {
     expect(wrapper.html()).toBe('Last event: <span class="euiToolTipAnchor">12 minutes ago</span>');
   });
   test('Bad date time string', async () => {
-    mockUseLastEventTimeQuery.mockImplementation(() => ({
-      loading: false,
-      lastSeen: 'something-invalid',
-      errorMessage: mockLastEventTimeQuery[0].result.data!.source.LastEventTime.errorMessage,
-    }));
+    (useTimelineLastEventTime as jest.Mock).mockReturnValue([
+      false,
+      {
+        lastSeen: 'something-invalid',
+        errorMessage: mockLastEventTimeQuery[0].result.data!.source.LastEventTime.errorMessage,
+      },
+    ]);
     const wrapper = mount(
       <TestProviders>
         <LastEventTime indexKey={LastEventIndexKey.hosts} />
@@ -71,11 +76,13 @@ describe('Last Event Time Stat', () => {
     expect(wrapper.html()).toBe('something-invalid');
   });
   test('Null time string', async () => {
-    mockUseLastEventTimeQuery.mockImplementation(() => ({
-      loading: false,
-      lastSeen: null,
-      errorMessage: mockLastEventTimeQuery[0].result.data!.source.LastEventTime.errorMessage,
-    }));
+    (useTimelineLastEventTime as jest.Mock).mockReturnValue([
+      false,
+      {
+        lastSeen: null,
+        errorMessage: mockLastEventTimeQuery[0].result.data!.source.LastEventTime.errorMessage,
+      },
+    ]);
     const wrapper = mount(
       <TestProviders>
         <LastEventTime indexKey={LastEventIndexKey.hosts} />
diff --git a/x-pack/plugins/security_solution/public/common/components/last_event_time/index.tsx b/x-pack/plugins/security_solution/public/common/components/last_event_time/index.tsx
index 35a891c21aa8a..e9e8e7a03017c 100644
--- a/x-pack/plugins/security_solution/public/common/components/last_event_time/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/last_event_time/index.tsx
@@ -9,7 +9,7 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import React, { memo } from 'react';
 
 import { LastEventIndexKey } from '../../../graphql/types';
-import { useLastEventTimeQuery } from '../../containers/events/last_event_time';
+import { useTimelineLastEventTime } from '../../containers/events/last_event_time';
 import { getEmptyTagValue } from '../empty_value';
 import { FormattedRelativePreferenceDate } from '../formatted_date';
 
@@ -20,11 +20,13 @@ export interface LastEventTimeProps {
 }
 
 export const LastEventTime = memo<LastEventTimeProps>(({ hostName, indexKey, ip }) => {
-  const { loading, lastSeen, errorMessage } = useLastEventTimeQuery(
+  const [loading, { lastSeen, errorMessage }] = useTimelineLastEventTime({
     indexKey,
-    { hostName, ip },
-    'default'
-  );
+    details: {
+      hostName,
+      ip,
+    },
+  });
 
   if (errorMessage != null) {
     return (
diff --git a/x-pack/plugins/security_solution/public/common/components/link_to/index.ts b/x-pack/plugins/security_solution/public/common/components/link_to/index.ts
index 403c8d838fa44..89fcc67bcd15f 100644
--- a/x-pack/plugins/security_solution/public/common/components/link_to/index.ts
+++ b/x-pack/plugins/security_solution/public/common/components/link_to/index.ts
@@ -16,25 +16,40 @@ export { getDetectionEngineUrl } from './redirect_to_detection_engine';
 export { getAppOverviewUrl } from './redirect_to_overview';
 export { getHostDetailsUrl, getHostsUrl } from './redirect_to_hosts';
 export { getNetworkUrl, getNetworkDetailsUrl } from './redirect_to_network';
-export { getTimelinesUrl, getTimelineTabsUrl } from './redirect_to_timelines';
+export { getTimelinesUrl, getTimelineTabsUrl, getTimelineUrl } from './redirect_to_timelines';
 export {
   getCaseDetailsUrl,
   getCaseUrl,
   getCreateCaseUrl,
   getConfigureCasesUrl,
+  getCaseDetailsUrlWithCommentId,
 } from './redirect_to_case';
 
+interface FormatUrlOptions {
+  absolute: boolean;
+  skipSearch: boolean;
+}
+
+type FormatUrl = (path: string, options?: Partial<FormatUrlOptions>) => string;
+
 export const useFormatUrl = (page: SecurityPageName) => {
   const { getUrlForApp } = useKibana().services.application;
   const search = useGetUrlSearch(navTabs[page]);
-  const formatUrl = useCallback(
-    (path: string) => {
+  const formatUrl = useCallback<FormatUrl>(
+    (path: string, { absolute = false, skipSearch = false } = {}) => {
       const pathArr = path.split('?');
       const formattedPath = `${pathArr[0]}${
-        isEmpty(pathArr[1]) ? search : `${pathArr[1]}${isEmpty(search) ? '' : `&${search}`}`
+        !skipSearch
+          ? isEmpty(pathArr[1])
+            ? search
+            : `?${pathArr[1]}${isEmpty(search) ? '' : `&${search}`}`
+          : isEmpty(pathArr[1])
+          ? ''
+          : `?${pathArr[1]}`
       }`;
       return getUrlForApp(`${APP_ID}:${page}`, {
         path: formattedPath,
+        absolute,
       });
     },
     [getUrlForApp, page, search]
diff --git a/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_case.tsx b/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_case.tsx
index 7005460999fc7..3ef00635844f6 100644
--- a/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_case.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_case.tsx
@@ -11,6 +11,17 @@ export const getCaseUrl = (search: string | null) => `${appendSearch(search ?? u
 export const getCaseDetailsUrl = ({ id, search }: { id: string; search?: string | null }) =>
   `/${encodeURIComponent(id)}${appendSearch(search ?? undefined)}`;
 
+export const getCaseDetailsUrlWithCommentId = ({
+  id,
+  commentId,
+  search,
+}: {
+  id: string;
+  commentId: string;
+  search?: string | null;
+}) =>
+  `/${encodeURIComponent(id)}/${encodeURIComponent(commentId)}${appendSearch(search ?? undefined)}`;
+
 export const getCreateCaseUrl = (search?: string | null) =>
   `/create${appendSearch(search ?? undefined)}`;
 
diff --git a/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_timelines.tsx b/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_timelines.tsx
index 75a2fa1efa414..58b9f940ceaa6 100644
--- a/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_timelines.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_timelines.tsx
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isEmpty } from 'lodash/fp';
 import { TimelineTypeLiteral } from '../../../../common/types/timeline';
 import { appendSearch } from './helpers';
 
@@ -11,3 +12,8 @@ export const getTimelinesUrl = (search?: string) => `${appendSearch(search)}`;
 
 export const getTimelineTabsUrl = (tabName: TimelineTypeLiteral, search?: string) =>
   `/${tabName}${appendSearch(search)}`;
+
+export const getTimelineUrl = (id: string, graphEventId?: string) =>
+  `?timeline=(id:'${id}',isOpen:!t${
+    isEmpty(graphEventId) ? ')' : `,graphEventId:'${graphEventId}')`
+  }`;
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/eui_form.tsx b/x-pack/plugins/security_solution/public/common/components/markdown_editor/eui_form.tsx
new file mode 100644
index 0000000000000..481ed7892a8be
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/eui_form.tsx
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, useCallback } from 'react';
+import styled from 'styled-components';
+import {
+  EuiMarkdownEditor,
+  EuiMarkdownEditorProps,
+  EuiFormRow,
+  EuiFlexItem,
+  EuiFlexGroup,
+  getDefaultEuiMarkdownParsingPlugins,
+  getDefaultEuiMarkdownProcessingPlugins,
+} from '@elastic/eui';
+import { FieldHook, getFieldValidityAndErrorMessage } from '../../../shared_imports';
+
+import * as timelineMarkdownPlugin from './plugins/timeline';
+
+type MarkdownEditorFormProps = EuiMarkdownEditorProps & {
+  id: string;
+  field: FieldHook;
+  dataTestSubj: string;
+  idAria: string;
+  isDisabled?: boolean;
+  bottomRightContent?: React.ReactNode;
+};
+
+const BottomContentWrapper = styled(EuiFlexGroup)`
+  ${({ theme }) => `
+    padding: ${theme.eui.ruleMargins.marginSmall} 0;
+  `}
+`;
+
+export const parsingPlugins = getDefaultEuiMarkdownParsingPlugins();
+parsingPlugins.push(timelineMarkdownPlugin.parser);
+
+export const processingPlugins = getDefaultEuiMarkdownProcessingPlugins();
+processingPlugins[1][1].components.timeline = timelineMarkdownPlugin.renderer;
+
+export const MarkdownEditorForm: React.FC<MarkdownEditorFormProps> = ({
+  id,
+  field,
+  dataTestSubj,
+  idAria,
+  bottomRightContent,
+}) => {
+  const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
+  const [markdownErrorMessages, setMarkdownErrorMessages] = useState([]);
+  const onParse = useCallback((err, { messages }) => {
+    setMarkdownErrorMessages(err ? [err] : messages);
+  }, []);
+
+  return (
+    <EuiFormRow
+      data-test-subj={dataTestSubj}
+      describedByIds={idAria ? [idAria] : undefined}
+      error={errorMessage}
+      fullWidth
+      helpText={field.helpText}
+      isInvalid={isInvalid}
+      label={field.label}
+      labelAppend={field.labelAppend}
+    >
+      <>
+        <EuiMarkdownEditor
+          aria-label={idAria}
+          editorId={id}
+          onChange={field.setValue}
+          value={field.value as string}
+          uiPlugins={[timelineMarkdownPlugin.plugin]}
+          parsingPluginList={parsingPlugins}
+          processingPluginList={processingPlugins}
+          onParse={onParse}
+          errors={markdownErrorMessages}
+        />
+        {bottomRightContent && (
+          <BottomContentWrapper justifyContent={'flexEnd'}>
+            <EuiFlexItem grow={false}>{bottomRightContent}</EuiFlexItem>
+          </BottomContentWrapper>
+        )}
+      </>
+    </EuiFormRow>
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/form.tsx b/x-pack/plugins/security_solution/public/common/components/markdown_editor/form.tsx
deleted file mode 100644
index 2cc3fe05a2215..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/form.tsx
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { EuiFormRow } from '@elastic/eui';
-import React, { useCallback } from 'react';
-
-import { FieldHook, getFieldValidityAndErrorMessage } from '../../../shared_imports';
-import { CursorPosition, MarkdownEditor } from '.';
-
-interface IMarkdownEditorForm {
-  bottomRightContent?: React.ReactNode;
-  dataTestSubj: string;
-  field: FieldHook;
-  idAria: string;
-  isDisabled: boolean;
-  onClickTimeline?: (timelineId: string, graphEventId?: string) => void;
-  onCursorPositionUpdate?: (cursorPosition: CursorPosition) => void;
-  placeholder?: string;
-  topRightContent?: React.ReactNode;
-}
-export const MarkdownEditorForm = ({
-  bottomRightContent,
-  dataTestSubj,
-  field,
-  idAria,
-  isDisabled = false,
-  onClickTimeline,
-  onCursorPositionUpdate,
-  placeholder,
-  topRightContent,
-}: IMarkdownEditorForm) => {
-  const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
-
-  const handleContentChange = useCallback(
-    (newContent: string) => {
-      field.setValue(newContent);
-    },
-    [field]
-  );
-
-  return (
-    <EuiFormRow
-      data-test-subj={dataTestSubj}
-      describedByIds={idAria ? [idAria] : undefined}
-      error={errorMessage}
-      fullWidth
-      helpText={field.helpText}
-      isInvalid={isInvalid}
-      label={field.label}
-      labelAppend={field.labelAppend}
-    >
-      <MarkdownEditor
-        bottomRightContent={bottomRightContent}
-        content={field.value as string}
-        isDisabled={isDisabled}
-        onChange={handleContentChange}
-        onClickTimeline={onClickTimeline}
-        onCursorPositionUpdate={onCursorPositionUpdate}
-        placeholder={placeholder}
-        topRightContent={topRightContent}
-      />
-    </EuiFormRow>
-  );
-};
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/markdown_editor/index.test.tsx
deleted file mode 100644
index b5e5b01189418..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/index.test.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { mount } from 'enzyme';
-import React from 'react';
-
-import { MarkdownEditor } from '.';
-import { TestProviders } from '../../mock';
-
-describe('Markdown Editor', () => {
-  const onChange = jest.fn();
-  const onCursorPositionUpdate = jest.fn();
-  const defaultProps = {
-    content: 'hello world',
-    onChange,
-    onCursorPositionUpdate,
-  };
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-  test('it calls onChange with correct value', () => {
-    const wrapper = mount(
-      <TestProviders>
-        <MarkdownEditor {...defaultProps} />
-      </TestProviders>
-    );
-    const newValue = 'a new string';
-    wrapper
-      .find(`[data-test-subj="textAreaInput"]`)
-      .first()
-      .simulate('change', { target: { value: newValue } });
-    expect(onChange).toBeCalledWith(newValue);
-  });
-  test('it calls onCursorPositionUpdate with correct args', () => {
-    const wrapper = mount(
-      <TestProviders>
-        <MarkdownEditor {...defaultProps} />
-      </TestProviders>
-    );
-    wrapper.find(`[data-test-subj="textAreaInput"]`).first().simulate('blur');
-    expect(onCursorPositionUpdate).toBeCalledWith({
-      start: 0,
-      end: 0,
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/index.tsx b/x-pack/plugins/security_solution/public/common/components/markdown_editor/index.tsx
index d4ad4a11b60a3..9f4141dbcae7d 100644
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/index.tsx
@@ -4,167 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiLink,
-  EuiPanel,
-  EuiTabbedContent,
-  EuiTextArea,
-} from '@elastic/eui';
-import React, { useMemo, useCallback, ChangeEvent } from 'react';
-import styled, { css } from 'styled-components';
-
-import { Markdown } from '../markdown';
-import * as i18n from './translations';
-import { MARKDOWN_HELP_LINK } from './constants';
-
-const TextArea = styled(EuiTextArea)`
-  width: 100%;
-`;
-
-const Container = styled(EuiPanel)`
-  ${({ theme }) => css`
-    padding: 0;
-    background: ${theme.eui.euiColorLightestShade};
-    position: relative;
-    .markdown-tabs-header {
-      position: absolute;
-      top: ${theme.eui.euiSizeS};
-      right: ${theme.eui.euiSizeS};
-      z-index: ${theme.eui.euiZContentMenu};
-    }
-    .euiTab {
-      padding: 10px;
-    }
-    .markdown-tabs {
-      width: 100%;
-    }
-    .markdown-tabs-footer {
-      height: 41px;
-      padding: 0 ${theme.eui.euiSizeM};
-      .euiLink {
-        font-size: ${theme.eui.euiSizeM};
-      }
-    }
-    .euiFormRow__labelWrapper {
-      position: absolute;
-      top: -${theme.eui.euiSizeL};
-    }
-    .euiFormErrorText {
-      padding: 0 ${theme.eui.euiSizeM};
-    }
-  `}
-`;
-
-const MarkdownContainer = styled(EuiPanel)`
-  min-height: 150px;
-  overflow: auto;
-`;
-
-export interface CursorPosition {
-  start: number;
-  end: number;
-}
-
-/** An input for entering a new case description  */
-export const MarkdownEditor = React.memo<{
-  bottomRightContent?: React.ReactNode;
-  topRightContent?: React.ReactNode;
-  content: string;
-  isDisabled?: boolean;
-  onChange: (description: string) => void;
-  onClickTimeline?: (timelineId: string, graphEventId?: string) => void;
-  onCursorPositionUpdate?: (cursorPosition: CursorPosition) => void;
-  placeholder?: string;
-}>(
-  ({
-    bottomRightContent,
-    topRightContent,
-    content,
-    isDisabled = false,
-    onChange,
-    onClickTimeline,
-    placeholder,
-    onCursorPositionUpdate,
-  }) => {
-    const handleOnChange = useCallback(
-      (evt: ChangeEvent<HTMLTextAreaElement>) => {
-        onChange(evt.target.value);
-      },
-      [onChange]
-    );
-
-    const setCursorPosition = useCallback(
-      (e: React.ChangeEvent<HTMLTextAreaElement>) => {
-        if (onCursorPositionUpdate) {
-          onCursorPositionUpdate({
-            start: e!.target!.selectionStart ?? 0,
-            end: e!.target!.selectionEnd ?? 0,
-          });
-        }
-      },
-      [onCursorPositionUpdate]
-    );
-
-    const tabs = useMemo(
-      () => [
-        {
-          id: 'comment',
-          name: i18n.MARKDOWN,
-          content: (
-            <TextArea
-              data-test-subj="textAreaInput"
-              onChange={handleOnChange}
-              onBlur={setCursorPosition}
-              aria-label={`markdown-editor-comment`}
-              fullWidth={true}
-              disabled={isDisabled}
-              placeholder={placeholder ?? ''}
-              spellCheck={false}
-              value={content}
-            />
-          ),
-        },
-        {
-          id: 'preview',
-          name: i18n.PREVIEW,
-          'data-test-subj': 'preview-tab',
-          content: (
-            <MarkdownContainer data-test-subj="markdown-container" paddingSize="s">
-              <Markdown raw={content} onClickTimeline={onClickTimeline} />
-            </MarkdownContainer>
-          ),
-        },
-      ],
-      [content, handleOnChange, isDisabled, onClickTimeline, placeholder, setCursorPosition]
-    );
-    return (
-      <Container>
-        {topRightContent && <div className={`markdown-tabs-header`}>{topRightContent}</div>}
-        <EuiTabbedContent
-          className={`markdown-tabs`}
-          data-test-subj={`markdown-tabs`}
-          size="s"
-          tabs={tabs}
-          initialSelectedTab={tabs[0]}
-        />
-        <EuiFlexGroup
-          className={`markdown-tabs-footer`}
-          alignItems="center"
-          gutterSize="none"
-          justifyContent="spaceBetween"
-        >
-          <EuiFlexItem grow={false}>
-            <EuiLink href={MARKDOWN_HELP_LINK} external target="_blank">
-              {i18n.MARKDOWN_SYNTAX_HELP}
-            </EuiLink>
-          </EuiFlexItem>
-          {bottomRightContent && <EuiFlexItem grow={false}>{bottomRightContent}</EuiFlexItem>}
-        </EuiFlexGroup>
-      </Container>
-    );
-  }
-);
-
-MarkdownEditor.displayName = 'MarkdownEditor';
+export * from './types';
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/constants.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/constants.ts
new file mode 100644
index 0000000000000..917000a8ba21c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/constants.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const ID = 'timeline';
+export const PREFIX = `[`;
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/index.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/index.ts
new file mode 100644
index 0000000000000..701889013ee53
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { plugin } from './plugin';
+import { TimelineParser } from './parser';
+import { TimelineMarkDownRenderer } from './processor';
+
+export { plugin, TimelineParser as parser, TimelineMarkDownRenderer as renderer };
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/parser.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/parser.ts
new file mode 100644
index 0000000000000..d322a2c9e1929
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/parser.ts
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Plugin } from '@elastic/eui/node_modules/unified';
+import { RemarkTokenizer } from '@elastic/eui';
+import { parse } from 'query-string';
+import { decodeRisonUrlState } from '../../../url_state/helpers';
+import { ID, PREFIX } from './constants';
+import * as i18n from './translations';
+
+export const TimelineParser: Plugin = function () {
+  const Parser = this.Parser;
+  const tokenizers = Parser.prototype.inlineTokenizers;
+  const methods = Parser.prototype.inlineMethods;
+
+  const parseTimeline: RemarkTokenizer = function (eat, value, silent) {
+    let index = 0;
+    const nextChar = value[index];
+
+    if (nextChar !== '[') {
+      return false;
+    }
+
+    if (silent) {
+      return true;
+    }
+
+    function readArg(open: string, close: string) {
+      if (value[index] !== open) {
+        throw new Error(i18n.NO_PARENTHESES);
+      }
+
+      index++;
+
+      let body = '';
+      let openBrackets = 0;
+
+      for (; index < value.length; index++) {
+        const char = value[index];
+
+        if (char === close && openBrackets === 0) {
+          index++;
+          return body;
+        } else if (char === close) {
+          openBrackets--;
+        } else if (char === open) {
+          openBrackets++;
+        }
+
+        body += char;
+      }
+
+      return '';
+    }
+
+    const timelineTitle = readArg('[', ']');
+    const timelineUrl = readArg('(', ')');
+    const now = eat.now();
+
+    if (!timelineTitle) {
+      this.file.info(i18n.NO_TIMELINE_NAME_FOUND, {
+        line: now.line,
+        column: now.column,
+      });
+      return false;
+    }
+
+    try {
+      const timelineSearch = timelineUrl.split('?');
+      const parseTimelineUrlSearch = parse(timelineSearch[1]) as { timeline: string };
+      const { id: timelineId = '', graphEventId = '' } = decodeRisonUrlState(
+        parseTimelineUrlSearch.timeline ?? ''
+      ) ?? { id: null, graphEventId: '' };
+
+      if (!timelineId) {
+        this.file.info(i18n.NO_TIMELINE_ID_FOUND, {
+          line: now.line,
+          column: now.column + timelineUrl.indexOf('id'),
+        });
+        return false;
+      }
+
+      return eat(`[${timelineTitle}](${timelineUrl})`)({
+        type: ID,
+        id: timelineId,
+        title: timelineTitle,
+        graphEventId,
+      });
+    } catch {
+      this.file.info(i18n.TIMELINE_URL_IS_NOT_VALID(timelineUrl), {
+        line: now.line,
+        column: now.column,
+      });
+    }
+
+    return false;
+  };
+
+  const tokenizeTimeline: RemarkTokenizer = function tokenizeTimeline(eat, value, silent) {
+    if (
+      value.startsWith(PREFIX) === false ||
+      (value.startsWith(PREFIX) === true && !value.includes('timelines?timeline=(id'))
+    ) {
+      return false;
+    }
+
+    return parseTimeline.call(this, eat, value, silent);
+  };
+
+  tokenizeTimeline.locator = (value: string, fromIndex: number) => {
+    return value.indexOf(PREFIX, fromIndex);
+  };
+
+  tokenizers.timeline = tokenizeTimeline;
+  methods.splice(methods.indexOf('url'), 0, ID);
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/plugin.tsx b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/plugin.tsx
new file mode 100644
index 0000000000000..8d2488b269d76
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/plugin.tsx
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useCallback, memo } from 'react';
+import {
+  EuiSelectableOption,
+  EuiModalBody,
+  EuiMarkdownEditorUiPlugin,
+  EuiCodeBlock,
+} from '@elastic/eui';
+
+import { TimelineType } from '../../../../../../common/types/timeline';
+import { SelectableTimeline } from '../../../../../timelines/components/timeline/selectable_timeline';
+import { OpenTimelineResult } from '../../../../../timelines/components/open_timeline/types';
+import { getTimelineUrl, useFormatUrl } from '../../../link_to';
+
+import { ID } from './constants';
+import * as i18n from './translations';
+import { SecurityPageName } from '../../../../../app/types';
+
+interface TimelineEditorProps {
+  onClosePopover: () => void;
+  onInsert: (markdown: string, config: { block: boolean }) => void;
+}
+
+const TimelineEditorComponent: React.FC<TimelineEditorProps> = ({ onClosePopover, onInsert }) => {
+  const { formatUrl } = useFormatUrl(SecurityPageName.timelines);
+
+  const handleGetSelectableOptions = useCallback(
+    ({ timelines }: { timelines: OpenTimelineResult[] }) => [
+      ...timelines.map(
+        (t: OpenTimelineResult, index: number) =>
+          ({
+            description: t.description,
+            favorite: t.favorite,
+            label: t.title,
+            id: t.savedObjectId,
+            key: `${t.title}-${index}`,
+            title: t.title,
+            checked: undefined,
+          } as EuiSelectableOption)
+      ),
+    ],
+    []
+  );
+
+  return (
+    <EuiModalBody>
+      <SelectableTimeline
+        hideUntitled={true}
+        getSelectableOptions={handleGetSelectableOptions}
+        onTimelineChange={(timelineTitle, timelineId, graphEventId) => {
+          const url = formatUrl(getTimelineUrl(timelineId ?? '', graphEventId), {
+            absolute: true,
+            skipSearch: true,
+          });
+          onInsert(`[${timelineTitle}](${url})`, {
+            block: false,
+          });
+        }}
+        onClosePopover={onClosePopover}
+        timelineType={TimelineType.default}
+      />
+    </EuiModalBody>
+  );
+};
+
+const TimelineEditor = memo(TimelineEditorComponent);
+
+export const plugin: EuiMarkdownEditorUiPlugin = {
+  name: ID,
+  button: {
+    label: i18n.INSERT_TIMELINE,
+    iconType: 'timeline',
+  },
+  helpText: (
+    <EuiCodeBlock language="md" paddingSize="s" fontSize="l">
+      {'[title](url)'}
+    </EuiCodeBlock>
+  ),
+  editor: function editor({ node, onSave, onCancel }) {
+    return <TimelineEditor onClosePopover={onCancel} onInsert={onSave} />;
+  },
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/processor.tsx b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/processor.tsx
new file mode 100644
index 0000000000000..fb72b4368c8ea
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/processor.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useCallback, memo } from 'react';
+import { EuiToolTip, EuiLink, EuiMarkdownAstNodePosition } from '@elastic/eui';
+
+import { useTimelineClick } from '../../../../utils/timeline/use_timeline_click';
+import { TimelineProps } from './types';
+import * as i18n from './translations';
+
+export const TimelineMarkDownRendererComponent: React.FC<
+  TimelineProps & {
+    position: EuiMarkdownAstNodePosition;
+  }
+> = ({ id, title, graphEventId }) => {
+  const handleTimelineClick = useTimelineClick();
+  const onClickTimeline = useCallback(() => handleTimelineClick(id ?? '', graphEventId), [
+    id,
+    graphEventId,
+    handleTimelineClick,
+  ]);
+  return (
+    <EuiToolTip content={i18n.TIMELINE_ID(id ?? '')}>
+      <EuiLink onClick={onClickTimeline} data-test-subj={`markdown-timeline-link-${id}`}>
+        {title}
+      </EuiLink>
+    </EuiToolTip>
+  );
+};
+
+export const TimelineMarkDownRenderer = memo(TimelineMarkDownRendererComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/translations.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/translations.ts
new file mode 100644
index 0000000000000..5a23b2a742157
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/translations.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const INSERT_TIMELINE = i18n.translate(
+  'xpack.securitySolution.markdownEditor.plugins.timeline.insertTimelineButtonLabel',
+  {
+    defaultMessage: 'Insert timeline link',
+  }
+);
+
+export const TIMELINE_ID = (timelineId: string) =>
+  i18n.translate('xpack.securitySolution.markdownEditor.plugins.timeline.toolTip.timelineId', {
+    defaultMessage: 'Timeline id: { timelineId }',
+    values: {
+      timelineId,
+    },
+  });
+
+export const NO_TIMELINE_NAME_FOUND = i18n.translate(
+  'xpack.securitySolution.markdownEditor.plugins.timeline.noTimelineNameFoundErrorMsg',
+  {
+    defaultMessage: 'No timeline name found',
+  }
+);
+
+export const NO_TIMELINE_ID_FOUND = i18n.translate(
+  'xpack.securitySolution.markdownEditor.plugins.timeline.noTimelineIdFoundErrorMsg',
+  {
+    defaultMessage: 'No timeline id found',
+  }
+);
+
+export const TIMELINE_URL_IS_NOT_VALID = (timelineUrl: string) =>
+  i18n.translate(
+    'xpack.securitySolution.markdownEditor.plugins.timeline.toolTip.timelineUrlIsNotValidErrorMsg',
+    {
+      defaultMessage: 'Timeline URL is not valid => {timelineUrl}',
+      values: {
+        timelineUrl,
+      },
+    }
+  );
+
+export const NO_PARENTHESES = i18n.translate(
+  'xpack.securitySolution.markdownEditor.plugins.timeline.noParenthesesErrorMsg',
+  {
+    defaultMessage: 'Expected left parentheses',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/types.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/types.ts
new file mode 100644
index 0000000000000..8b9111fc9fc7d
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/timeline/types.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ID } from './constants';
+
+export interface TimelineConfiguration {
+  id: string | null;
+  title: string;
+  graphEventId?: string;
+  [key: string]: string | null | undefined;
+}
+
+export interface TimelineProps extends TimelineConfiguration {
+  type: typeof ID;
+}
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/types.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/types.ts
new file mode 100644
index 0000000000000..030def21ac36f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/types.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface CursorPosition {
+  start: number;
+  end: number;
+}
diff --git a/x-pack/plugins/security_solution/public/common/components/paginated_table/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/paginated_table/__snapshots__/index.test.tsx.snap
index 9724e36f045e4..af022fc3d525d 100644
--- a/x-pack/plugins/security_solution/public/common/components/paginated_table/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/paginated_table/__snapshots__/index.test.tsx.snap
@@ -122,6 +122,7 @@ exports[`Paginated Table Component rendering it renders the default load more ta
         },
         "euiCardSpacing": "16px",
         "euiCheckBoxSize": "16px",
+        "euiCheckboxBorderRadius": "4px",
         "euiCodeBlockAdditionColor": "#54b399",
         "euiCodeBlockAttributeColor": "inherit",
         "euiCodeBlockBackgroundColor": "#25262e",
@@ -267,6 +268,7 @@ exports[`Paginated Table Component rendering it renders the default load more ta
         "euiFormBorderColor": "rgba(255, 255, 255, 0.09999999999999998)",
         "euiFormBorderDisabledColor": "rgba(255, 255, 255, 0.09999999999999998)",
         "euiFormBorderOpaqueColor": "#ffffff",
+        "euiFormControlBorderRadius": 0,
         "euiFormControlBoxShadow": "0 1px 1px -1px rgba(0, 0, 0, 0.19999999999999996) 0 3px 2px -2px rgba(0, 0, 0, 0.19999999999999996)",
         "euiFormControlCompressedBorderRadius": "2px",
         "euiFormControlCompressedHeight": "32px",
diff --git a/x-pack/plugins/security_solution/public/common/containers/events/last_event_time/index.ts b/x-pack/plugins/security_solution/public/common/containers/events/last_event_time/index.ts
index 00b78c3a96550..d70762615818b 100644
--- a/x-pack/plugins/security_solution/public/common/containers/events/last_event_time/index.ts
+++ b/x-pack/plugins/security_solution/public/common/containers/events/last_event_time/index.ts
@@ -4,92 +4,145 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { get } from 'lodash/fp';
-import React, { useEffect, useState } from 'react';
+import deepEqual from 'fast-deep-equal';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
 
 import { DEFAULT_INDEX_KEY } from '../../../../../common/constants';
+import { inputsModel } from '../../../../common/store';
+import { useKibana } from '../../../../common/lib/kibana';
 import {
-  GetLastEventTimeQuery,
-  LastEventIndexKey,
+  TimelineEventsQueries,
+  TimelineEventsLastEventTimeRequestOptions,
+  TimelineEventsLastEventTimeStrategyResponse,
   LastTimeDetails,
-} from '../../../../graphql/types';
-import { inputsModel } from '../../../store';
-import { QueryTemplateProps } from '../../query_template';
-import { useUiSetting$ } from '../../../lib/kibana';
-
-import { LastEventTimeGqlQuery } from './last_event_time.gql_query';
-import { useApolloClient } from '../../../utils/apollo_context';
+  LastEventIndexKey,
+} from '../../../../../common/search_strategy/timeline';
+import { AbortError } from '../../../../../../../../src/plugins/data/common';
 import { useWithSource } from '../../source';
+import * as i18n from './translations';
 
-export interface LastEventTimeArgs {
-  id: string;
-  errorMessage: string;
-  lastSeen: Date;
-  loading: boolean;
+// const ID = 'timelineEventsLastEventTimeQuery';
+
+export interface UseTimelineLastEventTimeArgs {
+  lastSeen: string | null;
   refetch: inputsModel.Refetch;
+  errorMessage?: string;
 }
 
-export interface OwnProps extends QueryTemplateProps {
-  children: (args: LastEventTimeArgs) => React.ReactNode;
+interface UseTimelineLastEventTimeProps {
   indexKey: LastEventIndexKey;
+  details: LastTimeDetails;
 }
 
-export function useLastEventTimeQuery(
-  indexKey: LastEventIndexKey,
-  details: LastTimeDetails,
-  sourceId: string
-) {
-  const [loading, updateLoading] = useState(false);
-  const [lastSeen, updateLastSeen] = useState<number | null>(null);
-  const [errorMessage, updateErrorMessage] = useState<string | null>(null);
-  const [currentIndexKey, updateCurrentIndexKey] = useState<LastEventIndexKey | null>(null);
-  const [defaultIndex] = useUiSetting$<string[]>(DEFAULT_INDEX_KEY);
-  const apolloClient = useApolloClient();
-  const { docValueFields } = useWithSource(sourceId);
+export const useTimelineLastEventTime = ({
+  indexKey,
+  details,
+}: UseTimelineLastEventTimeProps): [boolean, UseTimelineLastEventTimeArgs] => {
+  const { data, notifications, uiSettings } = useKibana().services;
+  const { docValueFields } = useWithSource('default');
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [TimelineLastEventTimeRequest, setTimelineLastEventTimeRequest] = useState<
+    TimelineEventsLastEventTimeRequestOptions
+  >({
+    defaultIndex,
+    factoryQueryType: TimelineEventsQueries.lastEventTime,
+    docValueFields,
+    indexKey,
+    details,
+  });
+
+  const [TimelineLastEventTimeResponse, setTimelineLastEventTimeResponse] = useState<
+    UseTimelineLastEventTimeArgs
+  >({
+    lastSeen: null,
+    refetch: refetch.current,
+    errorMessage: undefined,
+  });
 
-  async function fetchLastEventTime(signal: AbortSignal) {
-    updateLoading(true);
-    if (apolloClient) {
-      apolloClient
-        .query<GetLastEventTimeQuery.Query, GetLastEventTimeQuery.Variables>({
-          query: LastEventTimeGqlQuery,
-          fetchPolicy: 'cache-first',
-          variables: {
-            docValueFields,
-            sourceId,
-            indexKey,
-            details,
-            defaultIndex,
-          },
-          context: {
-            fetchOptions: {
-              signal,
+  const timelineLastEventTimeSearch = useCallback(
+    (request: TimelineEventsLastEventTimeRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<
+            TimelineEventsLastEventTimeRequestOptions,
+            TimelineEventsLastEventTimeStrategyResponse
+          >(request, {
+            strategy: 'securitySolutionTimelineSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setTimelineLastEventTimeResponse((prevResponse) => ({
+                    ...prevResponse,
+                    errorMessage: undefined,
+                    lastSeen: response.lastSeen,
+                    refetch: refetch.current,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_LAST_EVENT_TIME);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_LAST_EVENT_TIME,
+                  text: msg.message,
+                });
+                setTimelineLastEventTimeResponse((prevResponse) => ({
+                  ...prevResponse,
+                  errorMessage: msg.message,
+                }));
+              }
             },
-          },
-        })
-        .then(
-          (result) => {
-            updateLoading(false);
-            updateLastSeen(get('data.source.LastEventTime.lastSeen', result));
-            updateErrorMessage(null);
-            updateCurrentIndexKey(currentIndexKey);
-          },
-          (error) => {
-            updateLoading(false);
-            updateLastSeen(null);
-            updateErrorMessage(error.message);
-          }
-        );
-    }
-  }
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
   useEffect(() => {
-    const abortCtrl = new AbortController();
-    const signal = abortCtrl.signal;
-    fetchLastEventTime(signal);
-    return () => abortCtrl.abort();
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [apolloClient, indexKey, details.hostName, details.ip]);
+    setTimelineLastEventTimeRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        indexKey,
+        details,
+      };
+      if (!deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, details, indexKey]);
 
-  return { lastSeen, loading, errorMessage };
-}
+  useEffect(() => {
+    timelineLastEventTimeSearch(TimelineLastEventTimeRequest);
+  }, [TimelineLastEventTimeRequest, timelineLastEventTimeSearch]);
+
+  return [loading, TimelineLastEventTimeResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/common/containers/events/last_event_time/translations.ts b/x-pack/plugins/security_solution/public/common/containers/events/last_event_time/translations.ts
new file mode 100644
index 0000000000000..1e3cf0d081384
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/containers/events/last_event_time/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_LAST_EVENT_TIME = i18n.translate(
+  'xpack.securitySolution.lastEventTime.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on last event time search`,
+  }
+);
+
+export const FAIL_LAST_EVENT_TIME = i18n.translate(
+  'xpack.securitySolution.lastEventTime.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on last event time`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_ecs.ts b/x-pack/plugins/security_solution/public/common/mock/mock_ecs.ts
index c897da69caba0..168906c6f6193 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_ecs.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_ecs.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Ecs } from '../../graphql/types';
+import { Ecs } from '../../../common/ecs';
 
 export const mockEcsData: Ecs[] = [
   {
@@ -438,11 +438,7 @@ export const mockEcsData: Ecs[] = [
     _id: '14',
     timestamp: '2019-03-07T05:06:51.000Z',
     event: {
-      action: null,
-      severity: null,
       module: ['zeek'],
-      category: null,
-      id: null,
       dataset: ['zeek.connection'],
     },
     host: {
@@ -462,12 +458,9 @@ export const mockEcsData: Ecs[] = [
       region_name: ['New York'],
       country_iso_code: ['US'],
     },
-    suricata: null,
     network: {
       transport: ['tcp'],
     },
-    http: null,
-    url: null,
     zeek: {
       session_id: ['C8DRTq362Fios6hw16'],
       connection: {
@@ -477,22 +470,13 @@ export const mockEcsData: Ecs[] = [
         state: ['REJ'],
         history: ['Sr'],
       },
-      notice: null,
-      dns: null,
-      http: null,
-      files: null,
-      ssl: null,
     },
   },
   {
     _id: '15',
     timestamp: '2019-03-07T00:51:28.000Z',
     event: {
-      action: null,
-      severity: null,
       module: ['zeek'],
-      category: null,
-      id: null,
       dataset: ['zeek.dns'],
     },
     host: {
@@ -512,43 +496,25 @@ export const mockEcsData: Ecs[] = [
       region_name: ['New York'],
       country_iso_code: ['US'],
     },
-    suricata: null,
     network: {
       transport: ['udp'],
     },
-    http: null,
-    url: null,
     zeek: {
       session_id: ['CyIrMA1L1JtLqdIuol'],
-      connection: null,
-      notice: null,
       dns: {
         AA: [false],
-        qclass_name: null,
         RD: [false],
-        qtype_name: null,
-        rejected: null,
-        qtype: null,
-        query: null,
         trans_id: [65252],
-        qclass: null,
         RA: [false],
         TC: [false],
       },
-      http: null,
-      files: null,
-      ssl: null,
     },
   },
   {
     _id: '16',
     timestamp: '2019-03-05T07:00:20.000Z',
     event: {
-      action: null,
-      severity: null,
       module: ['zeek'],
-      category: null,
-      id: null,
       dataset: ['zeek.http'],
     },
     host: {
@@ -568,32 +534,22 @@ export const mockEcsData: Ecs[] = [
       region_name: ['New York'],
       country_iso_code: ['US'],
     },
-    suricata: null,
-    network: null,
     http: {
       version: ['1.1'],
       request: {
-        method: null,
         body: {
           bytes: [0],
-          content: null,
         },
-        referrer: null,
       },
       response: {
         status_code: [302],
         body: {
           bytes: [154],
-          content: null,
         },
       },
     },
-    url: null,
     zeek: {
       session_id: ['CZLkpC22NquQJOpkwe'],
-      connection: null,
-      notice: null,
-      dns: null,
       http: {
         resp_mime_types: ['text/html'],
         trans_depth: ['3'],
@@ -601,19 +557,13 @@ export const mockEcsData: Ecs[] = [
         resp_fuids: ['FzeujEPP7GTHmYPsc'],
         tags: [],
       },
-      files: null,
-      ssl: null,
     },
   },
   {
     _id: '17',
     timestamp: '2019-02-28T22:36:28.000Z',
     event: {
-      action: null,
-      severity: null,
       module: ['zeek'],
-      category: null,
-      id: null,
       dataset: ['zeek.notice'],
     },
     host: {
@@ -623,17 +573,8 @@ export const mockEcsData: Ecs[] = [
     },
     source: {
       ip: ['8.42.77.171'],
-      port: null,
-    },
-    destination: null,
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
+    },
     zeek: {
-      session_id: null,
-      connection: null,
       notice: {
         suppress_for: [3600],
         msg: ['8.42.77.171 scanned at least 15 unique ports of host 207.154.238.205 in 0m0s'],
@@ -643,27 +584,18 @@ export const mockEcsData: Ecs[] = [
         dropped: [false],
         peer_descr: ['bro'],
       },
-      dns: null,
-      http: null,
-      files: null,
-      ssl: null,
     },
   },
   {
     _id: '18',
     timestamp: '2019-02-22T21:12:13.000Z',
     event: {
-      action: null,
-      severity: null,
       module: ['zeek'],
-      category: null,
-      id: null,
       dataset: ['zeek.ssl'],
     },
     host: {
       id: ['2ce8b1e7d69e4a1d9c6bcddc473da9d9'],
       name: ['zeek-sensor-amsterdam'],
-      ip: null,
     },
     source: {
       ip: ['188.166.66.184'],
@@ -677,17 +609,8 @@ export const mockEcsData: Ecs[] = [
       region_name: ['England'],
       country_iso_code: ['GB'],
     },
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
     zeek: {
       session_id: ['CmTxzt2OVXZLkGDaRe'],
-      connection: null,
-      notice: null,
-      dns: null,
-      http: null,
-      files: null,
       ssl: {
         cipher: ['TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'],
         established: [false],
@@ -700,11 +623,7 @@ export const mockEcsData: Ecs[] = [
     _id: '19',
     timestamp: '2019-03-03T04:26:38.000Z',
     event: {
-      action: null,
-      severity: null,
       module: ['zeek'],
-      category: null,
-      id: null,
       dataset: ['zeek.files'],
     },
     host: {
@@ -712,19 +631,8 @@ export const mockEcsData: Ecs[] = [
       name: ['suricata-zeek-singapore'],
       ip: ['206.189.35.240', '10.15.0.5', 'fe80::98c7:eff:fe29:4455'],
     },
-    source: null,
-    destination: null,
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
     zeek: {
       session_id: ['Cu0n232QMyvNtzb75j'],
-      connection: null,
-      notice: null,
-      dns: null,
-      http: null,
       files: {
         session_ids: ['Cu0n232QMyvNtzb75j'],
         timedout: [false],
@@ -745,7 +653,6 @@ export const mockEcsData: Ecs[] = [
         missing_bytes: [0],
         md5: ['f7653f1951693021daa9e6be61226e32'],
       },
-      ssl: null,
     },
   },
   {
@@ -753,24 +660,14 @@ export const mockEcsData: Ecs[] = [
     timestamp: '2019-03-13T05:42:11.815Z',
     event: {
       action: ['executed'],
-      severity: null,
       module: ['auditd'],
       category: ['audit-rule'],
-      id: null,
-      dataset: null,
     },
     host: {
       id: ['f896741c3b3b44bdb8e351a4ab6d2d7c'],
       name: ['zeek-sanfran'],
       ip: ['134.209.63.134', '10.46.0.5', 'fe80::a0d9:16ff:fecf:e70b'],
     },
-    source: null,
-    destination: null,
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
     user: {
       name: ['alice'],
     },
@@ -783,24 +680,19 @@ export const mockEcsData: Ecs[] = [
       title: ['gpgconf --list-dirs agent-socket'],
       working_directory: ['/'],
     },
-    zeek: null,
   },
   {
     _id: '21',
     timestamp: '2019-03-14T22:30:25.527Z',
     event: {
       action: ['logged-in'],
-      severity: null,
       module: ['auditd'],
       category: ['user-login'],
-      id: null,
-      dataset: null,
     },
     auditd: {
       result: ['success'],
       session: ['14'],
       data: {
-        acct: null,
         terminal: ['/dev/pts/0'],
         op: ['login'],
       },
@@ -815,8 +707,6 @@ export const mockEcsData: Ecs[] = [
           type: ['user-session'],
         },
         how: ['/usr/sbin/sshd'],
-        message_type: null,
-        sequence: null,
       },
     },
     host: {
@@ -826,38 +716,22 @@ export const mockEcsData: Ecs[] = [
     },
     source: {
       ip: ['8.42.77.171'],
-      port: null,
-    },
-    destination: null,
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
+    },
     user: {
       name: ['root'],
     },
     process: {
       pid: [17471],
-      name: null,
-      ppid: null,
-      args: null,
       executable: ['/usr/sbin/sshd'],
-      title: null,
-      working_directory: null,
     },
-    zeek: null,
   },
   {
     _id: '22',
     timestamp: '2019-03-13T03:35:21.614Z',
     event: {
       action: ['disposed-credentials'],
-      severity: null,
       module: ['auditd'],
       category: ['user-login'],
-      id: null,
-      dataset: null,
     },
     auditd: {
       result: ['success'],
@@ -878,8 +752,6 @@ export const mockEcsData: Ecs[] = [
           type: ['user-session'],
         },
         how: ['/usr/sbin/sshd'],
-        message_type: null,
-        sequence: null,
       },
     },
     host: {
@@ -887,37 +759,21 @@ export const mockEcsData: Ecs[] = [
       name: ['suricata-bangalore'],
       ip: ['139.59.11.147', '10.47.0.5', 'fe80::ec0b:1bff:fe29:80bd'],
     },
-    source: null,
-    destination: null,
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
     user: {
       name: ['root'],
     },
     process: {
       pid: [21202],
-      name: null,
-      ppid: null,
-      args: null,
       executable: ['/usr/sbin/sshd'],
-      title: null,
-      working_directory: null,
     },
-    zeek: null,
   },
   {
     _id: '23',
     timestamp: '2019-03-13T03:35:21.614Z',
     event: {
       action: ['ended-session'],
-      severity: null,
       module: ['auditd'],
       category: ['user-login'],
-      id: null,
-      dataset: null,
     },
     auditd: {
       result: ['success'],
@@ -938,8 +794,6 @@ export const mockEcsData: Ecs[] = [
           type: ['user-session'],
         },
         how: ['/usr/sbin/sshd'],
-        message_type: null,
-        sequence: null,
       },
     },
     host: {
@@ -947,37 +801,21 @@ export const mockEcsData: Ecs[] = [
       name: ['suricata-bangalore'],
       ip: ['139.59.11.147', '10.47.0.5', 'fe80::ec0b:1bff:fe29:80bd'],
     },
-    source: null,
-    destination: null,
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
     user: {
       name: ['root'],
     },
     process: {
       pid: [21202],
-      name: null,
-      ppid: null,
-      args: null,
       executable: ['/usr/sbin/sshd'],
-      title: null,
-      working_directory: null,
     },
-    zeek: null,
   },
   {
     _id: '24',
     timestamp: '2019-03-18T23:17:01.645Z',
     event: {
       action: ['acquired-credentials'],
-      severity: null,
       module: ['auditd'],
       category: ['user-login'],
-      id: null,
-      dataset: null,
     },
     auditd: {
       result: ['success'],
@@ -994,12 +832,9 @@ export const mockEcsData: Ecs[] = [
         },
         object: {
           primary: ['cron'],
-          secondary: null,
           type: ['user-session'],
         },
         how: ['/usr/sbin/cron'],
-        message_type: null,
-        sequence: null,
       },
     },
     host: {
@@ -1007,37 +842,21 @@ export const mockEcsData: Ecs[] = [
       name: ['zeek-london'],
       ip: ['46.101.3.136', '10.16.0.5', 'fe80::4066:42ff:fe19:b3b9'],
     },
-    source: null,
-    destination: null,
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
     user: {
       name: ['root'],
     },
     process: {
       pid: [9592],
-      name: null,
-      ppid: null,
-      args: null,
       executable: ['/usr/sbin/cron'],
-      title: null,
-      working_directory: null,
     },
-    zeek: null,
   },
   {
     _id: '25',
     timestamp: '2019-03-19T01:17:01.336Z',
     event: {
       action: ['started-session'],
-      severity: null,
       module: ['auditd'],
       category: ['user-login'],
-      id: null,
-      dataset: null,
     },
     auditd: {
       result: ['success'],
@@ -1054,58 +873,36 @@ export const mockEcsData: Ecs[] = [
         },
         object: {
           primary: ['cron'],
-          secondary: null,
           type: ['user-session'],
         },
         how: ['[/usr/sbin/cron'],
-        message_type: null,
-        sequence: null,
       },
     },
     host: {
       id: ['aa7ca589f1b8220002f2fc61c64cfbf1'],
       name: ['siem-kibana'],
-      ip: null,
-    },
-    source: null,
-    destination: null,
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
+    },
     user: {
       name: ['root'],
     },
     process: {
       pid: [725],
-      name: null,
-      ppid: null,
-      args: null,
       executable: ['/usr/sbin/cron'],
-      title: null,
-      working_directory: null,
     },
-    zeek: null,
   },
   {
     _id: '26',
     timestamp: '2019-03-13T03:34:08.890Z',
     event: {
       action: ['was-authorized'],
-      severity: null,
       module: ['auditd'],
       category: ['user-login'],
-      id: null,
-      dataset: null,
     },
     auditd: {
       result: ['success'],
       session: ['338'],
       data: {
-        acct: null,
         terminal: ['/dev/pts/0'],
-        op: null,
       },
       summary: {
         actor: {
@@ -1114,12 +911,9 @@ export const mockEcsData: Ecs[] = [
         },
         object: {
           primary: ['/dev/pts/0'],
-          secondary: null,
           type: ['user-session'],
         },
         how: ['/sbin/pam_tally2'],
-        message_type: null,
-        sequence: null,
       },
     },
     host: {
@@ -1127,42 +921,25 @@ export const mockEcsData: Ecs[] = [
       name: ['suricata-bangalore'],
       ip: ['139.59.11.147', '10.47.0.5', 'fe80::ec0b:1bff:fe29:80bd'],
     },
-    source: null,
-    destination: null,
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
     user: {
       name: ['alice'],
     },
     process: {
       pid: [21170],
-      name: null,
-      ppid: null,
-      args: null,
       executable: ['/sbin/pam_tally2'],
-      title: null,
-      working_directory: null,
     },
-    zeek: null,
   },
   {
     _id: '27',
     timestamp: '2019-03-22T19:13:11.026Z',
     event: {
       action: ['connected-to'],
-      severity: null,
       module: ['auditd'],
       category: ['audit-rule'],
-      id: null,
-      dataset: null,
     },
     auditd: {
       result: ['success'],
       session: ['246'],
-      data: null,
       summary: {
         actor: {
           primary: ['alice'],
@@ -1174,8 +951,6 @@ export const mockEcsData: Ecs[] = [
           type: ['socket'],
         },
         how: ['/usr/bin/wget'],
-        message_type: null,
-        sequence: null,
       },
     },
     host: {
@@ -1183,16 +958,10 @@ export const mockEcsData: Ecs[] = [
       name: ['zeek-london'],
       ip: ['46.101.3.136', '10.16.0.5', 'fe80::4066:42ff:fe19:b3b9'],
     },
-    source: null,
     destination: {
       ip: ['93.184.216.34'],
       port: [80],
     },
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
     user: {
       name: ['alice'],
     },
@@ -1200,28 +969,21 @@ export const mockEcsData: Ecs[] = [
       pid: [1490],
       name: ['wget'],
       ppid: [1476],
-      args: null,
       executable: ['/usr/bin/wget'],
       title: ['wget www.example.com'],
-      working_directory: null,
     },
-    zeek: null,
   },
   {
     _id: '28',
     timestamp: '2019-03-26T22:12:18.609Z',
     event: {
       action: ['opened-file'],
-      severity: null,
       module: ['auditd'],
       category: ['audit-rule'],
-      id: null,
-      dataset: null,
     },
     auditd: {
       result: ['success'],
       session: ['unset'],
-      data: null,
       summary: {
         actor: {
           primary: ['unset'],
@@ -1229,19 +991,13 @@ export const mockEcsData: Ecs[] = [
         },
         object: {
           primary: ['/proc/15990/attr/current'],
-          secondary: null,
           type: ['file'],
         },
         how: ['/lib/systemd/systemd-journald'],
-        message_type: null,
-        sequence: null,
       },
     },
     file: {
       path: ['/proc/15990/attr/current'],
-      target_path: null,
-      extension: null,
-      type: null,
       device: ['00:00'],
       inode: ['27672309'],
       uid: ['0'],
@@ -1249,22 +1005,13 @@ export const mockEcsData: Ecs[] = [
       gid: ['0'],
       group: ['root'],
       mode: ['0666'],
-      size: null,
-      mtime: null,
-      ctime: null,
     },
     host: {
       id: ['7c21f5ed03b04d0299569d221fe18bbc'],
       name: ['zeek-london'],
       ip: ['46.101.3.136', '10.16.0.5', 'fe80::4066:42ff:fe19:b3b9'],
     },
-    source: null,
-    destination: null,
-    geo: null,
-    suricata: null,
-    network: null,
-    http: null,
-    url: null,
+
     user: {
       name: ['root'],
     },
@@ -1272,12 +1019,10 @@ export const mockEcsData: Ecs[] = [
       pid: [27244],
       name: ['systemd-journal'],
       ppid: [1],
-      args: null,
       executable: ['/lib/systemd/systemd-journald'],
       title: ['/lib/systemd/systemd-journald'],
       working_directory: ['/'],
     },
-    zeek: null,
   },
 ];
 
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_endgame_ecs_data.ts b/x-pack/plugins/security_solution/public/common/mock/mock_endgame_ecs_data.ts
index 9b2cd14499db4..4c03a5457eb3f 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_endgame_ecs_data.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_endgame_ecs_data.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Ecs } from '../../graphql/types';
+import { Ecs } from '../../../common/ecs';
 
 export const mockEndgameDnsRequest: Ecs = {
   _id: 'S8jPcG0BOpWiDweSou3g',
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_timeline_data.ts b/x-pack/plugins/security_solution/public/common/mock/mock_timeline_data.ts
index 9974842bff474..322dccdac973e 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_timeline_data.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_timeline_data.ts
@@ -4,7 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Ecs, TimelineItem } from '../../graphql/types';
+import { Ecs } from '../../../common/ecs';
+import { TimelineItem } from '../../../common/search_strategy/timeline';
 
 export const mockTimelineData: TimelineItem[] = [
   {
@@ -425,11 +426,7 @@ export const mockTimelineData: TimelineItem[] = [
       _id: '14',
       timestamp: '2019-03-07T05:06:51.000Z',
       event: {
-        action: null,
-        severity: null,
         module: ['zeek'],
-        category: null,
-        id: null,
         dataset: ['zeek.connection'],
       },
       host: {
@@ -440,10 +437,7 @@ export const mockTimelineData: TimelineItem[] = [
       source: { ip: ['185.176.26.101'], port: [44059] },
       destination: { ip: ['207.154.238.205'], port: [11568] },
       geo: { region_name: ['New York'], country_iso_code: ['US'] },
-      suricata: null,
       network: { transport: ['tcp'] },
-      http: null,
-      url: null,
       zeek: {
         session_id: ['C8DRTq362Fios6hw16'],
         connection: {
@@ -453,11 +447,6 @@ export const mockTimelineData: TimelineItem[] = [
           state: ['REJ'],
           history: ['Sr'],
         },
-        notice: null,
-        dns: null,
-        http: null,
-        files: null,
-        ssl: null,
       },
     },
   },
@@ -473,11 +462,7 @@ export const mockTimelineData: TimelineItem[] = [
       _id: '15',
       timestamp: '2019-03-07T00:51:28.000Z',
       event: {
-        action: null,
-        severity: null,
         module: ['zeek'],
-        category: null,
-        id: null,
         dataset: ['zeek.dns'],
       },
       host: {
@@ -488,30 +473,16 @@ export const mockTimelineData: TimelineItem[] = [
       source: { ip: ['206.189.35.240'], port: [57475] },
       destination: { ip: ['67.207.67.3'], port: [53] },
       geo: { region_name: ['New York'], country_iso_code: ['US'] },
-      suricata: null,
       network: { transport: ['udp'] },
-      http: null,
-      url: null,
       zeek: {
         session_id: ['CyIrMA1L1JtLqdIuol'],
-        connection: null,
-        notice: null,
         dns: {
           AA: [false],
-          qclass_name: null,
           RD: [false],
-          qtype_name: null,
-          rejected: null,
-          qtype: null,
-          query: null,
           trans_id: [65252],
-          qclass: null,
           RA: [false],
           TC: [false],
         },
-        http: null,
-        files: null,
-        ssl: null,
       },
     },
   },
@@ -527,11 +498,7 @@ export const mockTimelineData: TimelineItem[] = [
       _id: '16',
       timestamp: '2019-03-05T07:00:20.000Z',
       event: {
-        action: null,
-        severity: null,
         module: ['zeek'],
-        category: null,
-        id: null,
         dataset: ['zeek.http'],
       },
       host: {
@@ -542,19 +509,14 @@ export const mockTimelineData: TimelineItem[] = [
       source: { ip: ['206.189.35.240'], port: [36220] },
       destination: { ip: ['192.241.164.26'], port: [80] },
       geo: { region_name: ['New York'], country_iso_code: ['US'] },
-      suricata: null,
-      network: null,
       http: {
         version: ['1.1'],
-        request: { method: null, body: { bytes: [0], content: null }, referrer: null },
-        response: { status_code: [302], body: { bytes: [154], content: null } },
+        request: { body: { bytes: [0] } },
+        response: { status_code: [302], body: { bytes: [154] } },
       },
-      url: null,
       zeek: {
         session_id: ['CZLkpC22NquQJOpkwe'],
-        connection: null,
-        notice: null,
-        dns: null,
+
         http: {
           resp_mime_types: ['text/html'],
           trans_depth: ['3'],
@@ -562,8 +524,6 @@ export const mockTimelineData: TimelineItem[] = [
           resp_fuids: ['FzeujEPP7GTHmYPsc'],
           tags: [],
         },
-        files: null,
-        ssl: null,
       },
     },
   },
@@ -578,11 +538,7 @@ export const mockTimelineData: TimelineItem[] = [
       _id: '17',
       timestamp: '2019-02-28T22:36:28.000Z',
       event: {
-        action: null,
-        severity: null,
         module: ['zeek'],
-        category: null,
-        id: null,
         dataset: ['zeek.notice'],
       },
       host: {
@@ -590,16 +546,8 @@ export const mockTimelineData: TimelineItem[] = [
         name: ['zeek-franfurt'],
         ip: ['207.154.238.205', '10.19.0.5', 'fe80::d82b:9aff:fe0d:1e12'],
       },
-      source: { ip: ['8.42.77.171'], port: null },
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
+      source: { ip: ['8.42.77.171'] },
       zeek: {
-        session_id: null,
-        connection: null,
         notice: {
           suppress_for: [3600],
           msg: ['8.42.77.171 scanned at least 15 unique ports of host 207.154.238.205 in 0m0s'],
@@ -609,10 +557,6 @@ export const mockTimelineData: TimelineItem[] = [
           dropped: [false],
           peer_descr: ['bro'],
         },
-        dns: null,
-        http: null,
-        files: null,
-        ssl: null,
       },
     },
   },
@@ -628,28 +572,15 @@ export const mockTimelineData: TimelineItem[] = [
       _id: '18',
       timestamp: '2019-02-22T21:12:13.000Z',
       event: {
-        action: null,
-        severity: null,
         module: ['zeek'],
-        category: null,
-        id: null,
         dataset: ['zeek.ssl'],
       },
-      host: { id: ['2ce8b1e7d69e4a1d9c6bcddc473da9d9'], name: ['zeek-sensor-amsterdam'], ip: null },
+      host: { id: ['2ce8b1e7d69e4a1d9c6bcddc473da9d9'], name: ['zeek-sensor-amsterdam'] },
       source: { ip: ['188.166.66.184'], port: [34514] },
       destination: { ip: ['91.189.95.15'], port: [443] },
       geo: { region_name: ['England'], country_iso_code: ['GB'] },
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
       zeek: {
         session_id: ['CmTxzt2OVXZLkGDaRe'],
-        connection: null,
-        notice: null,
-        dns: null,
-        http: null,
-        files: null,
         ssl: {
           cipher: ['TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'],
           established: [false],
@@ -669,11 +600,7 @@ export const mockTimelineData: TimelineItem[] = [
       _id: '19',
       timestamp: '2019-03-03T04:26:38.000Z',
       event: {
-        action: null,
-        severity: null,
         module: ['zeek'],
-        category: null,
-        id: null,
         dataset: ['zeek.files'],
       },
       host: {
@@ -681,19 +608,8 @@ export const mockTimelineData: TimelineItem[] = [
         name: ['suricata-zeek-singapore'],
         ip: ['206.189.35.240', '10.15.0.5', 'fe80::98c7:eff:fe29:4455'],
       },
-      source: null,
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
       zeek: {
         session_id: ['Cu0n232QMyvNtzb75j'],
-        connection: null,
-        notice: null,
-        dns: null,
-        http: null,
         files: {
           session_ids: ['Cu0n232QMyvNtzb75j'],
           timedout: [false],
@@ -714,7 +630,6 @@ export const mockTimelineData: TimelineItem[] = [
           missing_bytes: [0],
           md5: ['f7653f1951693021daa9e6be61226e32'],
         },
-        ssl: null,
       },
     },
   },
@@ -730,24 +645,14 @@ export const mockTimelineData: TimelineItem[] = [
       timestamp: '2019-03-13T05:42:11.815Z',
       event: {
         action: ['executed'],
-        severity: null,
         module: ['auditd'],
         category: ['audit-rule'],
-        id: null,
-        dataset: null,
       },
       host: {
         id: ['f896741c3b3b44bdb8e351a4ab6d2d7c'],
         name: ['zeek-sanfran'],
         ip: ['134.209.63.134', '10.46.0.5', 'fe80::a0d9:16ff:fecf:e70b'],
       },
-      source: null,
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
       user: { name: ['alice'] },
       process: {
         pid: [5402],
@@ -758,7 +663,6 @@ export const mockTimelineData: TimelineItem[] = [
         title: ['gpgconf --list-dirs agent-socket'],
         working_directory: ['/'],
       },
-      zeek: null,
     },
   },
   {
@@ -775,22 +679,17 @@ export const mockTimelineData: TimelineItem[] = [
       timestamp: '2019-03-14T22:30:25.527Z',
       event: {
         action: ['logged-in'],
-        severity: null,
         module: ['auditd'],
         category: ['user-login'],
-        id: null,
-        dataset: null,
       },
       auditd: {
         result: ['success'],
         session: ['14'],
-        data: { acct: null, terminal: ['/dev/pts/0'], op: ['login'] },
+        data: { terminal: ['/dev/pts/0'], op: ['login'] },
         summary: {
           actor: { primary: ['alice'], secondary: ['alice'] },
           object: { primary: ['/dev/pts/0'], secondary: ['8.42.77.171'], type: ['user-session'] },
           how: ['/usr/sbin/sshd'],
-          message_type: null,
-          sequence: null,
         },
       },
       host: {
@@ -798,24 +697,12 @@ export const mockTimelineData: TimelineItem[] = [
         name: ['zeek-london'],
         ip: ['46.101.3.136', '10.16.0.5', 'fe80::4066:42ff:fe19:b3b9'],
       },
-      source: { ip: ['8.42.77.171'], port: null },
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
+      source: { ip: ['8.42.77.171'] },
       user: { name: ['root'] },
       process: {
         pid: [17471],
-        name: null,
-        ppid: null,
-        args: null,
         executable: ['/usr/sbin/sshd'],
-        title: null,
-        working_directory: null,
       },
-      zeek: null,
     },
   },
   {
@@ -831,11 +718,8 @@ export const mockTimelineData: TimelineItem[] = [
       timestamp: '2019-03-13T03:35:21.614Z',
       event: {
         action: ['disposed-credentials'],
-        severity: null,
         module: ['auditd'],
         category: ['user-login'],
-        id: null,
-        dataset: null,
       },
       auditd: {
         result: ['success'],
@@ -845,8 +729,6 @@ export const mockTimelineData: TimelineItem[] = [
           actor: { primary: ['alice'], secondary: ['alice'] },
           object: { primary: ['ssh'], secondary: ['8.42.77.171'], type: ['user-session'] },
           how: ['/usr/sbin/sshd'],
-          message_type: null,
-          sequence: null,
         },
       },
       host: {
@@ -854,24 +736,11 @@ export const mockTimelineData: TimelineItem[] = [
         name: ['suricata-bangalore'],
         ip: ['139.59.11.147', '10.47.0.5', 'fe80::ec0b:1bff:fe29:80bd'],
       },
-      source: null,
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
       user: { name: ['root'] },
       process: {
         pid: [21202],
-        name: null,
-        ppid: null,
-        args: null,
         executable: ['/usr/sbin/sshd'],
-        title: null,
-        working_directory: null,
       },
-      zeek: null,
     },
   },
   {
@@ -887,11 +756,8 @@ export const mockTimelineData: TimelineItem[] = [
       timestamp: '2019-03-13T03:35:21.614Z',
       event: {
         action: ['ended-session'],
-        severity: null,
         module: ['auditd'],
         category: ['user-login'],
-        id: null,
-        dataset: null,
       },
       auditd: {
         result: ['success'],
@@ -901,8 +767,6 @@ export const mockTimelineData: TimelineItem[] = [
           actor: { primary: ['alice'], secondary: ['alice'] },
           object: { primary: ['ssh'], secondary: ['8.42.77.171'], type: ['user-session'] },
           how: ['/usr/sbin/sshd'],
-          message_type: null,
-          sequence: null,
         },
       },
       host: {
@@ -910,24 +774,11 @@ export const mockTimelineData: TimelineItem[] = [
         name: ['suricata-bangalore'],
         ip: ['139.59.11.147', '10.47.0.5', 'fe80::ec0b:1bff:fe29:80bd'],
       },
-      source: null,
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
       user: { name: ['root'] },
       process: {
         pid: [21202],
-        name: null,
-        ppid: null,
-        args: null,
         executable: ['/usr/sbin/sshd'],
-        title: null,
-        working_directory: null,
       },
-      zeek: null,
     },
   },
   {
@@ -943,11 +794,8 @@ export const mockTimelineData: TimelineItem[] = [
       timestamp: '2019-03-18T23:17:01.645Z',
       event: {
         action: ['acquired-credentials'],
-        severity: null,
         module: ['auditd'],
         category: ['user-login'],
-        id: null,
-        dataset: null,
       },
       auditd: {
         result: ['success'],
@@ -955,10 +803,8 @@ export const mockTimelineData: TimelineItem[] = [
         data: { acct: ['root'], terminal: ['cron'], op: ['PAM:setcred'] },
         summary: {
           actor: { primary: ['unset'], secondary: ['root'] },
-          object: { primary: ['cron'], secondary: null, type: ['user-session'] },
+          object: { primary: ['cron'], type: ['user-session'] },
           how: ['/usr/sbin/cron'],
-          message_type: null,
-          sequence: null,
         },
       },
       host: {
@@ -966,24 +812,11 @@ export const mockTimelineData: TimelineItem[] = [
         name: ['zeek-london'],
         ip: ['46.101.3.136', '10.16.0.5', 'fe80::4066:42ff:fe19:b3b9'],
       },
-      source: null,
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
       user: { name: ['root'] },
       process: {
         pid: [9592],
-        name: null,
-        ppid: null,
-        args: null,
         executable: ['/usr/sbin/cron'],
-        title: null,
-        working_directory: null,
       },
-      zeek: null,
     },
   },
   {
@@ -999,11 +832,8 @@ export const mockTimelineData: TimelineItem[] = [
       timestamp: '2019-03-19T01:17:01.336Z',
       event: {
         action: ['started-session'],
-        severity: null,
         module: ['auditd'],
         category: ['user-login'],
-        id: null,
-        dataset: null,
       },
       auditd: {
         result: ['success'],
@@ -1011,31 +841,16 @@ export const mockTimelineData: TimelineItem[] = [
         data: { acct: ['root'], terminal: ['cron'], op: ['PAM:session_open'] },
         summary: {
           actor: { primary: ['root'], secondary: ['root'] },
-          object: { primary: ['cron'], secondary: null, type: ['user-session'] },
+          object: { primary: ['cron'], type: ['user-session'] },
           how: ['/usr/sbin/cron'],
-          message_type: null,
-          sequence: null,
         },
       },
-      host: { id: ['aa7ca589f1b8220002f2fc61c64cfbf1'], name: ['siem-kibana'], ip: null },
-      source: null,
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
+      host: { id: ['aa7ca589f1b8220002f2fc61c64cfbf1'], name: ['siem-kibana'] },
       user: { name: ['root'] },
       process: {
         pid: [725],
-        name: null,
-        ppid: null,
-        args: null,
         executable: ['/usr/sbin/cron'],
-        title: null,
-        working_directory: null,
       },
-      zeek: null,
     },
   },
   {
@@ -1051,22 +866,17 @@ export const mockTimelineData: TimelineItem[] = [
       timestamp: '2019-03-13T03:34:08.890Z',
       event: {
         action: ['was-authorized'],
-        severity: null,
         module: ['auditd'],
         category: ['user-login'],
-        id: null,
-        dataset: null,
       },
       auditd: {
         result: ['success'],
         session: ['338'],
-        data: { acct: null, terminal: ['/dev/pts/0'], op: null },
+        data: { terminal: ['/dev/pts/0'] },
         summary: {
           actor: { primary: ['root'], secondary: ['alice'] },
-          object: { primary: ['/dev/pts/0'], secondary: null, type: ['user-session'] },
+          object: { primary: ['/dev/pts/0'], type: ['user-session'] },
           how: ['/sbin/pam_tally2'],
-          message_type: null,
-          sequence: null,
         },
       },
       host: {
@@ -1074,24 +884,11 @@ export const mockTimelineData: TimelineItem[] = [
         name: ['suricata-bangalore'],
         ip: ['139.59.11.147', '10.47.0.5', 'fe80::ec0b:1bff:fe29:80bd'],
       },
-      source: null,
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
       user: { name: ['alice'] },
       process: {
         pid: [21170],
-        name: null,
-        ppid: null,
-        args: null,
         executable: ['/sbin/pam_tally2'],
-        title: null,
-        working_directory: null,
       },
-      zeek: null,
     },
   },
   {
@@ -1109,22 +906,16 @@ export const mockTimelineData: TimelineItem[] = [
       timestamp: '2019-03-22T19:13:11.026Z',
       event: {
         action: ['connected-to'],
-        severity: null,
         module: ['auditd'],
         category: ['audit-rule'],
-        id: null,
-        dataset: null,
       },
       auditd: {
         result: ['success'],
         session: ['246'],
-        data: null,
         summary: {
           actor: { primary: ['alice'], secondary: ['alice'] },
           object: { primary: ['192.168.216.34'], secondary: ['80'], type: ['socket'] },
           how: ['/usr/bin/wget'],
-          message_type: null,
-          sequence: null,
         },
       },
       host: {
@@ -1132,24 +923,15 @@ export const mockTimelineData: TimelineItem[] = [
         name: ['zeek-london'],
         ip: ['46.101.3.136', '10.16.0.5', 'fe80::4066:42ff:fe19:b3b9'],
       },
-      source: null,
       destination: { ip: ['192.168.216.34'], port: [80] },
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
       user: { name: ['alice'] },
       process: {
         pid: [1490],
         name: ['wget'],
         ppid: [1476],
-        args: null,
         executable: ['/usr/bin/wget'],
         title: ['wget www.example.com'],
-        working_directory: null,
       },
-      zeek: null,
     },
   },
   {
@@ -1166,29 +948,20 @@ export const mockTimelineData: TimelineItem[] = [
       timestamp: '2019-03-26T22:12:18.609Z',
       event: {
         action: ['opened-file'],
-        severity: null,
         module: ['auditd'],
         category: ['audit-rule'],
-        id: null,
-        dataset: null,
       },
       auditd: {
         result: ['success'],
         session: ['242'],
-        data: null,
         summary: {
           actor: { primary: ['unset'], secondary: ['root'] },
-          object: { primary: ['/proc/15990/attr/current'], secondary: null, type: ['file'] },
+          object: { primary: ['/proc/15990/attr/current'], type: ['file'] },
           how: ['/lib/systemd/systemd-journald'],
-          message_type: null,
-          sequence: null,
         },
       },
       file: {
         path: ['/proc/15990/attr/current'],
-        target_path: null,
-        extension: null,
-        type: null,
         device: ['00:00'],
         inode: ['27672309'],
         uid: ['0'],
@@ -1196,33 +969,22 @@ export const mockTimelineData: TimelineItem[] = [
         gid: ['0'],
         group: ['root'],
         mode: ['0666'],
-        size: null,
-        mtime: null,
-        ctime: null,
       },
       host: {
         id: ['7c21f5ed03b04d0299569d221fe18bbc'],
         name: ['zeek-london'],
         ip: ['46.101.3.136', '10.16.0.5', 'fe80::4066:42ff:fe19:b3b9'],
       },
-      source: null,
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      url: null,
+
       user: { name: ['root'] },
       process: {
         pid: [27244],
         name: ['systemd-journal'],
         ppid: [1],
-        args: null,
         executable: ['/lib/systemd/systemd-journald'],
         title: ['/lib/systemd/systemd-journald'],
         working_directory: ['/'],
       },
-      zeek: null,
     },
   },
   {
@@ -1236,61 +998,27 @@ export const mockTimelineData: TimelineItem[] = [
     ],
     ecs: {
       _id: '29',
-      system: null,
       event: {
         action: ['user_login'],
-        category: null,
-        created: null,
         dataset: ['login'],
-        duration: null,
-        end: null,
-        hash: null,
-        id: null,
         kind: ['event'],
         module: ['system'],
-        original: null,
         outcome: ['failure'],
-        risk_score: null,
-        risk_score_norm: null,
-        severity: null,
-        start: null,
-        timezone: null,
-        type: null,
-      },
-      auditd: null,
-      file: null,
+      },
       host: {
         id: ['7c21f5ed03b04d0299569d221fe18bbc'],
         name: ['zeek-london'],
         ip: ['46.101.3.136', '10.16.0.5', 'fe80::4066:42ff:fe19:b3b9'],
       },
       source: {
-        bytes: null,
         ip: ['128.199.212.120'],
-        packets: null,
-        port: null,
-        geo: null,
-      },
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      tls: null,
-      url: null,
+      },
       user: {
         name: ['Braden'],
       },
       process: {
         pid: [6278],
-        name: null,
-        ppid: null,
-        args: null,
-        executable: null,
-        title: null,
-        working_directory: null,
-      },
-      zeek: null,
+      },
     },
   },
   {
@@ -1304,61 +1032,27 @@ export const mockTimelineData: TimelineItem[] = [
     ],
     ecs: {
       _id: '30',
-      system: null,
       event: {
         action: ['process_started'],
-        category: null,
-        created: null,
         dataset: ['login'],
-        duration: null,
-        end: null,
-        hash: null,
-        id: null,
         kind: ['event'],
         module: ['system'],
-        original: null,
         outcome: ['failure'],
-        risk_score: null,
-        risk_score_norm: null,
-        severity: null,
-        start: null,
-        timezone: null,
-        type: null,
-      },
-      auditd: null,
-      file: null,
+      },
       host: {
         id: ['7c21f5ed03b04d0299569d221fe18bbc'],
         name: ['zeek-london'],
         ip: ['46.101.3.136', '10.16.0.5', 'fe80::4066:42ff:fe19:b3b9'],
       },
       source: {
-        bytes: null,
         ip: ['128.199.212.120'],
-        packets: null,
-        port: null,
-        geo: null,
-      },
-      destination: null,
-      geo: null,
-      suricata: null,
-      network: null,
-      http: null,
-      tls: null,
-      url: null,
+      },
       user: {
         name: ['Evan'],
       },
       process: {
         pid: [6278],
-        name: null,
-        ppid: null,
-        args: null,
-        executable: null,
-        title: null,
-        working_directory: null,
-      },
-      zeek: null,
+      },
     },
   },
   {
diff --git a/x-pack/plugins/security_solution/public/common/mock/netflow.ts b/x-pack/plugins/security_solution/public/common/mock/netflow.ts
index 4dad794533374..1c384ef9a4f63 100644
--- a/x-pack/plugins/security_solution/public/common/mock/netflow.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/netflow.ts
@@ -5,7 +5,7 @@
  */
 
 import { ONE_MILLISECOND_AS_NANOSECONDS } from '../../timelines/components/formatted_duration/helpers';
-import { Ecs } from '../../graphql/types';
+import { Ecs } from '../../../common/ecs';
 
 /** Returns mock data for testing the Netflow component */
 export const getMockNetflowData = (): Ecs => ({
diff --git a/x-pack/plugins/security_solution/public/cases/components/utils/use_timeline_click.tsx b/x-pack/plugins/security_solution/public/common/utils/timeline/use_timeline_click.tsx
similarity index 100%
rename from x-pack/plugins/security_solution/public/cases/components/utils/use_timeline_click.tsx
rename to x-pack/plugins/security_solution/public/common/utils/timeline/use_timeline_click.tsx
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
index 3f95fd36b6010..678aaf06e50e4 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
@@ -17,7 +17,7 @@ import {
   mockTimelineDetailsApollo,
 } from '../../../common/mock/';
 import { CreateTimeline, UpdateTimelineLoading } from './types';
-import { Ecs } from '../../../graphql/types';
+import { Ecs } from '../../../../common/ecs';
 import { TimelineId, TimelineType, TimelineStatus } from '../../../../common/types/timeline';
 
 jest.mock('apollo-client');
@@ -336,6 +336,7 @@ describe('alert actions', () => {
           signal: {
             rule: {
               ...mockEcsDataWithAlert.signal?.rule!,
+              // @ts-expect-error
               timeline_id: null,
             },
           },
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
index 972a8aa4b0871..640726bb2e7c8 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
@@ -11,19 +11,15 @@ import { get, getOr, isEmpty, find } from 'lodash/fp';
 import moment from 'moment';
 import { i18n } from '@kbn/i18n';
 
-import { TimelineId } from '../../../../common/types/timeline';
+import { TimelineId, TimelineStatus, TimelineType } from '../../../../common/types/timeline';
 import { updateAlertStatus } from '../../containers/detection_engine/alerts/api';
 import { SendAlertToTimelineActionProps, UpdateAlertStatusActionProps } from './types';
+import { Ecs } from '../../../../common/ecs';
+import { GetOneTimeline, TimelineResult, GetTimelineDetailsQuery } from '../../../graphql/types';
 import {
   TimelineNonEcsData,
-  GetOneTimeline,
-  TimelineResult,
-  Ecs,
-  TimelineStatus,
-  TimelineType,
-  GetTimelineDetailsQuery,
-  DetailItem,
-} from '../../../graphql/types';
+  TimelineEventsDetailsItem,
+} from '../../../../common/search_strategy/timeline';
 import { oneTimelineQuery } from '../../../timelines/containers/one/index.gql_query';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 import {
@@ -122,7 +118,7 @@ export const getThresholdAggregationDataProvider = (
   ecsData: Ecs,
   nonEcsData: TimelineNonEcsData[]
 ): DataProvider[] => {
-  const aggregationField = ecsData.signal?.rule?.threshold.field;
+  const aggregationField = ecsData.signal?.rule?.threshold?.field!;
   const aggregationValue =
     get(aggregationField, ecsData) ?? find(['field', aggregationField], nonEcsData)?.value;
   const dataProviderValue = Array.isArray(aggregationValue)
@@ -139,7 +135,7 @@ export const getThresholdAggregationDataProvider = (
     {
       and: [],
       id: `send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${TimelineId.active}-${aggregationFieldId}-${dataProviderValue}`,
-      name: ecsData.signal?.rule?.threshold.field,
+      name: aggregationField,
       enabled: true,
       excluded: false,
       kqlQuery: '',
@@ -189,7 +185,11 @@ export const sendAlertToTimelineAction = async ({
         }),
       ]);
       const resultingTimeline: TimelineResult = getOr({}, 'data.getOneTimeline', responseTimeline);
-      const eventData: DetailItem[] = getOr([], 'data.source.TimelineDetails.data', eventDataResp);
+      const eventData: TimelineEventsDetailsItem[] = getOr(
+        [],
+        'data.source.TimelineDetails.data',
+        eventDataResp
+      );
       if (!isEmpty(resultingTimeline)) {
         const timelineTemplate: TimelineResult = omitTypenameInTimeline(resultingTimeline);
         openAlertInBasicTimeline = false;
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/alerts_utility_bar/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/alerts_utility_bar/index.tsx
index bdad380f59ae9..30fcdc21d61e8 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/alerts_utility_bar/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/alerts_utility_bar/index.tsx
@@ -24,7 +24,7 @@ import {
 } from '../../../../common/components/utility_bar';
 import * as i18n from './translations';
 import { useUiSetting$ } from '../../../../common/lib/kibana';
-import { TimelineNonEcsData } from '../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../common/search_strategy/timeline';
 import { UpdateAlertsStatus } from '../types';
 import { FILTER_CLOSED, FILTER_IN_PROGRESS, FILTER_OPEN } from '../alerts_filter_group';
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
index cbf0e08fef5cd..4559e44b8c3c5 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
@@ -27,7 +27,8 @@ import { DEFAULT_ICON_BUTTON_WIDTH } from '../../../../timelines/components/time
 import { FILTER_OPEN, FILTER_CLOSED, FILTER_IN_PROGRESS } from '../alerts_filter_group';
 import { updateAlertStatusAction } from '../actions';
 import { SetEventsDeletedProps, SetEventsLoadingProps } from '../types';
-import { Ecs, TimelineNonEcsData } from '../../../../graphql/types';
+import { Ecs } from '../../../../../common/ecs';
+import { TimelineNonEcsData } from '../../../../../common/search_strategy/timeline';
 import {
   AddExceptionModal as AddExceptionModalComponent,
   AddExceptionModalBaseProps,
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
index f4080de5b4ba1..4ab5fa5e6012f 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
@@ -8,7 +8,8 @@ import React, { useCallback } from 'react';
 import { useDispatch } from 'react-redux';
 
 import { TimelineId } from '../../../../../common/types/timeline';
-import { TimelineNonEcsData, Ecs } from '../../../../../public/graphql/types';
+import { Ecs } from '../../../../../common/ecs';
+import { TimelineNonEcsData } from '../../../../../common/search_strategy/timeline';
 import { timelineActions } from '../../../../timelines/store/timeline';
 import { useApolloClient } from '../../../../common/utils/apollo_context';
 import { sendAlertToTimelineAction } from '../actions';
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
index b4da0267d2ea5..50ac344eb2a2f 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
@@ -48,7 +48,7 @@ export const LOADING_ALERTS = i18n.translate(
 export const TOTAL_COUNT_OF_ALERTS = i18n.translate(
   'xpack.securitySolution.detectionEngine.alerts.totalCountOfAlertsTitle',
   {
-    defaultMessage: 'alerts match the search criteria',
+    defaultMessage: 'alerts',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
index f8b3cd6af8b8a..3dfdfe4c17e04 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
@@ -7,7 +7,9 @@
 import ApolloClient from 'apollo-client';
 
 import { Status } from '../../../../common/detection_engine/schemas/common/schemas';
-import { Ecs, NoteResult, TimelineNonEcsData } from '../../../graphql/types';
+import { Ecs } from '../../../../common/ecs';
+import { TimelineNonEcsData } from '../../../../common/search_strategy/timeline';
+import { NoteResult } from '../../../graphql/types';
 import { TimelineModel } from '../../../timelines/store/timeline/model';
 import { inputsModel } from '../../../common/store';
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
index d2c84883fa99b..66f95f5ce15d2 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
@@ -36,7 +36,7 @@ import { schema } from './schema';
 import * as I18n from './translations';
 import { StepContentWrapper } from '../step_content_wrapper';
 import { NextStep } from '../next_step';
-import { MarkdownEditorForm } from '../../../../common/components/markdown_editor/form';
+import { MarkdownEditorForm } from '../../../../common/components/markdown_editor/eui_form';
 import { SeverityField } from '../severity_mapping';
 import { RiskScoreField } from '../risk_score_mapping';
 import { useFetchIndexPatterns } from '../../../containers/detection_engine/rules';
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/index.tsx b/x-pack/plugins/security_solution/public/hosts/containers/hosts/index.tsx
index 958d62dfe9b6a..11b853e0ebeb0 100644
--- a/x-pack/plugins/security_solution/public/hosts/containers/hosts/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/containers/hosts/index.tsx
@@ -87,17 +87,14 @@ export const useAllHost = ({
       direction,
       field: sortField,
     },
-    // inspect: isInspected,
   });
 
   const wrappedLoadMore = useCallback(
     (newActivePage: number) => {
-      setHostRequest((prevRequest) => {
-        return {
-          ...prevRequest,
-          pagination: generateTablePaginationOptions(newActivePage, limit),
-        };
-      });
+      setHostRequest((prevRequest) => ({
+        ...prevRequest,
+        pagination: generateTablePaginationOptions(newActivePage, limit),
+      }));
     },
     [limit]
   );
diff --git a/x-pack/plugins/security_solution/public/management/common/routing.ts b/x-pack/plugins/security_solution/public/management/common/routing.ts
index 62f360df90192..40320ed794203 100644
--- a/x-pack/plugins/security_solution/public/management/common/routing.ts
+++ b/x-pack/plugins/security_solution/public/management/common/routing.ts
@@ -21,6 +21,7 @@ import {
 import { AdministrationSubTab } from '../types';
 import { appendSearch } from '../../common/components/link_to/helpers';
 import { EndpointIndexUIQueryParams } from '../pages/endpoint_hosts/types';
+import { TrustedAppsUrlParams } from '../pages/trusted_apps/types';
 
 // Taken from: https://github.com/microsoft/TypeScript/issues/12936#issuecomment-559034150
 type ExactKeys<T1, T2> = Exclude<keyof T1, keyof T2> extends never ? T1 : never;
@@ -89,18 +90,16 @@ export const getPolicyDetailPath = (policyId: string, search?: string) => {
   })}${appendSearch(search)}`;
 };
 
-interface ListPaginationParams {
-  page_index: number;
-  page_size: number;
-}
-
-const isDefaultOrMissing = (value: number | undefined, defaultValue: number) => {
+const isDefaultOrMissing = (
+  value: number | string | undefined,
+  defaultValue: number | undefined
+) => {
   return value === undefined || value === defaultValue;
 };
 
 const normalizeListPaginationParams = (
-  params?: Partial<ListPaginationParams>
-): Partial<ListPaginationParams> => {
+  params?: Partial<TrustedAppsUrlParams>
+): Partial<TrustedAppsUrlParams> => {
   if (params) {
     return {
       ...(!isDefaultOrMissing(params.page_index, MANAGEMENT_DEFAULT_PAGE)
@@ -109,13 +108,19 @@ const normalizeListPaginationParams = (
       ...(!isDefaultOrMissing(params.page_size, MANAGEMENT_DEFAULT_PAGE_SIZE)
         ? { page_size: params.page_size }
         : {}),
+      ...(!isDefaultOrMissing(params.show, undefined) ? { show: params.show } : {}),
     };
   } else {
     return {};
   }
 };
 
-const extractFirstParamValue = (query: querystring.ParsedUrlQuery, key: string): string => {
+/**
+ * Given an object with url params, and a given key, return back only the first param value (case multiples were defined)
+ * @param query
+ * @param key
+ */
+export const extractFirstParamValue = (query: querystring.ParsedUrlQuery, key: string): string => {
   const value = query[key];
 
   return Array.isArray(value) ? value[value.length - 1] : value;
@@ -135,12 +140,12 @@ const extractPageSize = (query: querystring.ParsedUrlQuery): number => {
 
 export const extractListPaginationParams = (
   query: querystring.ParsedUrlQuery
-): ListPaginationParams => ({
+): TrustedAppsUrlParams => ({
   page_index: extractPageIndex(query),
   page_size: extractPageSize(query),
 });
 
-export const getTrustedAppsListPath = (params?: Partial<ListPaginationParams>): string => {
+export const getTrustedAppsListPath = (params?: Partial<TrustedAppsUrlParams>): string => {
   const path = generatePath(MANAGEMENT_ROUTING_TRUSTED_APPS_PATH, {
     tabName: AdministrationSubTab.trustedApps,
   });
diff --git a/x-pack/plugins/security_solution/public/management/components/administration_list_page.tsx b/x-pack/plugins/security_solution/public/management/components/administration_list_page.tsx
index 3df525b4d59d6..372916581b35d 100644
--- a/x-pack/plugins/security_solution/public/management/components/administration_list_page.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/administration_list_page.tsx
@@ -5,6 +5,7 @@
  */
 import React, { FC, memo } from 'react';
 import { EuiPanel, EuiSpacer, CommonProps } from '@elastic/eui';
+import styled from 'styled-components';
 import { SecurityPageName } from '../../../common/constants';
 import { WrapperPage } from '../../common/components/wrapper_page';
 import { HeaderPage } from '../../common/components/header_page';
@@ -14,6 +15,13 @@ import { AdministrationSubTab } from '../types';
 import { ENDPOINTS_TAB, TRUSTED_APPS_TAB, BETA_BADGE_LABEL } from '../common/translations';
 import { getEndpointListPath, getTrustedAppsListPath } from '../common/routing';
 
+/** Ensure that all flyouts z-index in Administation area show the flyout header */
+const EuiPanelStyled = styled(EuiPanel)`
+  .euiFlyout {
+    z-index: ${({ theme }) => theme.eui.euiZNavigation + 1};
+  }
+`;
+
 interface AdministrationListPageProps {
   beta: boolean;
   title: React.ReactNode;
@@ -54,7 +62,7 @@ export const AdministrationListPage: FC<AdministrationListPageProps & CommonProp
 
         <EuiSpacer />
 
-        <EuiPanel>{children}</EuiPanel>
+        <EuiPanelStyled>{children}</EuiPanelStyled>
 
         <SpyRoute pageName={SecurityPageName.administration} />
       </WrapperPage>
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts
index c5363a5ae9522..3b05afb975d47 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts
@@ -11,6 +11,7 @@ import {
   HostPolicyResponse,
   HostResultList,
   HostStatus,
+  MetadataQueryStrategyVersions,
 } from '../../../../../common/endpoint/types';
 import { EndpointDocGenerator } from '../../../../../common/endpoint/generate_data';
 import {
@@ -49,6 +50,7 @@ export const mockEndpointResultList: (options?: {
     hosts.push({
       metadata: generator.generateHostMetadata(),
       host_status: HostStatus.ERROR,
+      query_strategy_version: MetadataQueryStrategyVersions.VERSION_2,
     });
   }
   const mock: HostResultList = {
@@ -56,6 +58,7 @@ export const mockEndpointResultList: (options?: {
     total,
     request_page_size: requestPageSize,
     request_page_index: requestPageIndex,
+    query_strategy_version: MetadataQueryStrategyVersions.VERSION_2,
   };
   return mock;
 };
@@ -67,6 +70,7 @@ export const mockEndpointDetailsApiResult = (): HostInfo => {
   return {
     metadata: generator.generateHostMetadata(),
     host_status: HostStatus.ERROR,
+    query_strategy_version: MetadataQueryStrategyVersions.VERSION_2,
   };
 };
 
@@ -103,6 +107,7 @@ const endpointListApiPathHandlerMocks = ({
         request_page_size: 10,
         request_page_index: 0,
         total: endpointsResults?.length || 0,
+        query_strategy_version: MetadataQueryStrategyVersions.VERSION_2,
       };
     },
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
index 2bdf17b806079..bd8344f41fe3a 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
@@ -20,6 +20,7 @@ import {
   HostPolicyResponseActionStatus,
   HostPolicyResponseAppliedAction,
   HostStatus,
+  MetadataQueryStrategyVersions,
 } from '../../../../../common/endpoint/types';
 import { EndpointDocGenerator } from '../../../../../common/endpoint/generate_data';
 import { POLICY_STATUS_TO_HEALTH_COLOR, POLICY_STATUS_TO_TEXT } from './host_constants';
@@ -131,6 +132,7 @@ describe('when on the list page', () => {
               hostListData[index] = {
                 metadata: hostListData[index].metadata,
                 host_status: status,
+                query_strategy_version: MetadataQueryStrategyVersions.VERSION_2,
               };
             }
           );
@@ -301,6 +303,8 @@ describe('when on the list page', () => {
         // eslint-disable-next-line @typescript-eslint/naming-convention
         host_status,
         metadata: { host, ...details },
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        query_strategy_version,
       } = mockEndpointDetailsApiResult();
 
       hostDetails = {
@@ -312,6 +316,7 @@ describe('when on the list page', () => {
             id: '1',
           },
         },
+        query_strategy_version,
       };
 
       agentId = hostDetails.metadata.elastic.agent.id;
@@ -681,6 +686,7 @@ describe('when on the list page', () => {
       hostInfo = {
         host_status: hosts[0].host_status,
         metadata: hosts[0].metadata,
+        query_strategy_version: MetadataQueryStrategyVersions.VERSION_2,
       };
       const packagePolicy = docGenerator.generatePolicyPackagePolicy();
       packagePolicy.id = hosts[0].metadata.Endpoint.policy.applied.id;
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/index.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/index.ts
index 9308c137cfb9c..a3c5911aa3a86 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/index.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/index.ts
@@ -5,14 +5,20 @@
  */
 
 import { HttpStart } from 'kibana/public';
-import { TRUSTED_APPS_LIST_API } from '../../../../../common/endpoint/constants';
+import {
+  TRUSTED_APPS_CREATE_API,
+  TRUSTED_APPS_LIST_API,
+} from '../../../../../common/endpoint/constants';
 import {
   GetTrustedListAppsResponse,
   GetTrustedAppsListRequest,
+  PostTrustedAppCreateRequest,
+  PostTrustedAppCreateResponse,
 } from '../../../../../common/endpoint/types/trusted_apps';
 
 export interface TrustedAppsService {
   getTrustedAppsList(request: GetTrustedAppsListRequest): Promise<GetTrustedListAppsResponse>;
+  createTrustedApp(request: PostTrustedAppCreateRequest): Promise<PostTrustedAppCreateResponse>;
 }
 
 export class TrustedAppsHttpService implements TrustedAppsService {
@@ -23,4 +29,10 @@ export class TrustedAppsHttpService implements TrustedAppsService {
       query: request,
     });
   }
+
+  async createTrustedApp(request: PostTrustedAppCreateRequest) {
+    return this.http.post<PostTrustedAppCreateResponse>(TRUSTED_APPS_CREATE_API, {
+      body: JSON.stringify(request),
+    });
+  }
 }
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/trusted_apps_list_page_state.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/trusted_apps_list_page_state.ts
index 23f4cfd576c56..071557ec1a815 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/trusted_apps_list_page_state.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/trusted_apps_list_page_state.ts
@@ -4,8 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { TrustedApp } from '../../../../../common/endpoint/types/trusted_apps';
+import { NewTrustedApp, TrustedApp } from '../../../../../common/endpoint/types/trusted_apps';
 import { AsyncResourceState } from '.';
+import { TrustedAppsUrlParams } from '../types';
+import { ServerApiError } from '../../../../common/types';
 
 export interface PaginationInfo {
   index: number;
@@ -18,10 +20,34 @@ export interface TrustedAppsListData {
   paginationInfo: PaginationInfo;
 }
 
+/** Store State when an API request has been sent to create a new trusted app entry */
+export interface TrustedAppCreatePending {
+  type: 'pending';
+  data: NewTrustedApp;
+}
+
+/** Store State when creation of a new Trusted APP entry was successful */
+export interface TrustedAppCreateSuccess {
+  type: 'success';
+  data: TrustedApp;
+}
+
+/** Store State when creation of a new Trusted App Entry failed */
+export interface TrustedAppCreateFailure {
+  type: 'failure';
+  data: ServerApiError;
+}
+
 export interface TrustedAppsListPageState {
   listView: {
     currentListResourceState: AsyncResourceState<TrustedAppsListData>;
     currentPaginationInfo: PaginationInfo;
+    show: TrustedAppsUrlParams['show'] | undefined;
   };
+  createView:
+    | undefined
+    | TrustedAppCreatePending
+    | TrustedAppCreateSuccess
+    | TrustedAppCreateFailure;
   active: boolean;
 }
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/type_guards.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/type_guards.ts
new file mode 100644
index 0000000000000..1e8e0bc042b86
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/type_guards.ts
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  TrustedAppCreatePending,
+  TrustedAppsListPageState,
+  TrustedAppCreateFailure,
+  TrustedAppCreateSuccess,
+} from './trusted_apps_list_page_state';
+import {
+  Immutable,
+  NewTrustedApp,
+  WindowsConditionEntry,
+} from '../../../../../common/endpoint/types';
+import { TRUSTED_APPS_SUPPORTED_OS_TYPES } from '../../../../../common/endpoint/constants';
+
+type CreateViewPossibleStates =
+  | TrustedAppsListPageState['createView']
+  | Immutable<TrustedAppsListPageState['createView']>;
+
+export const isTrustedAppCreatePendingState = (
+  data: CreateViewPossibleStates
+): data is TrustedAppCreatePending => {
+  return data?.type === 'pending';
+};
+
+export const isTrustedAppCreateSuccessState = (
+  data: CreateViewPossibleStates
+): data is TrustedAppCreateSuccess => {
+  return data?.type === 'success';
+};
+
+export const isTrustedAppCreateFailureState = (
+  data: CreateViewPossibleStates
+): data is TrustedAppCreateFailure => {
+  return data?.type === 'failure';
+};
+
+export const isWindowsTrustedApp = <T extends NewTrustedApp = NewTrustedApp>(
+  trustedApp: T
+): trustedApp is T & { os: 'windows' } => {
+  return trustedApp.os === 'windows';
+};
+
+export const isWindowsTrustedAppCondition = (condition: {
+  field: string;
+}): condition is WindowsConditionEntry => {
+  return condition.field === 'process.code_signature' || true;
+};
+
+export const isTrustedAppSupportedOs = (os: string): os is NewTrustedApp['os'] =>
+  TRUSTED_APPS_SUPPORTED_OS_TYPES.includes(os);
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/action.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/action.ts
index 2154a0eca462e..3a43ffe58262c 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/action.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/action.ts
@@ -4,7 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AsyncResourceState, TrustedAppsListData } from '../state';
+import {
+  AsyncResourceState,
+  TrustedAppCreateFailure,
+  TrustedAppCreatePending,
+  TrustedAppCreateSuccess,
+  TrustedAppsListData,
+} from '../state';
 
 export interface TrustedAppsListResourceStateChanged {
   type: 'trustedAppsListResourceStateChanged';
@@ -13,4 +19,23 @@ export interface TrustedAppsListResourceStateChanged {
   };
 }
 
-export type TrustedAppsPageAction = TrustedAppsListResourceStateChanged;
+export interface UserClickedSaveNewTrustedAppButton {
+  type: 'userClickedSaveNewTrustedAppButton';
+  payload: TrustedAppCreatePending;
+}
+
+export interface ServerReturnedCreateTrustedAppSuccess {
+  type: 'serverReturnedCreateTrustedAppSuccess';
+  payload: TrustedAppCreateSuccess;
+}
+
+export interface ServerReturnedCreateTrustedAppFailure {
+  type: 'serverReturnedCreateTrustedAppFailure';
+  payload: TrustedAppCreateFailure;
+}
+
+export type TrustedAppsPageAction =
+  | TrustedAppsListResourceStateChanged
+  | UserClickedSaveNewTrustedAppButton
+  | ServerReturnedCreateTrustedAppSuccess
+  | ServerReturnedCreateTrustedAppFailure;
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts
index c5abaae473486..e5f00ee0ccf81 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts
@@ -31,6 +31,7 @@ const createGetTrustedListAppsResponse = (pagination: PaginationInfo, totalItems
 
 const createTrustedAppsServiceMock = (): jest.Mocked<TrustedAppsService> => ({
   getTrustedAppsList: jest.fn(),
+  createTrustedApp: jest.fn(),
 });
 
 const createStoreSetup = (trustedAppsService: TrustedAppsService) => {
@@ -70,6 +71,7 @@ describe('middleware', () => {
       expect(store.getState()).toStrictEqual({
         listView: createLoadingListViewWithPagination(pagination),
         active: true,
+        createView: undefined,
       });
 
       await spyMiddleware.waitForAction('trustedAppsListResourceStateChanged');
@@ -77,6 +79,7 @@ describe('middleware', () => {
       expect(store.getState()).toStrictEqual({
         listView: createLoadedListViewWithPagination(pagination, pagination, 500),
         active: true,
+        createView: undefined,
       });
     });
 
@@ -99,6 +102,7 @@ describe('middleware', () => {
       expect(store.getState()).toStrictEqual({
         listView: createLoadedListViewWithPagination(pagination, pagination, 500),
         active: true,
+        createView: undefined,
       });
     });
 
@@ -118,6 +122,7 @@ describe('middleware', () => {
           createServerApiError('Internal Server Error')
         ),
         active: true,
+        createView: undefined,
       });
 
       const infiniteLoopTest = async () => {
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts
index 31c301b8dbd2b..bf9cacff5caf0 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Immutable } from '../../../../../common/endpoint/types';
+import { Immutable, PostTrustedAppCreateRequest } from '../../../../../common/endpoint/types';
 import { AppAction } from '../../../../common/store/actions';
 import {
   ImmutableMiddleware,
@@ -28,6 +28,8 @@ import {
   getLastLoadedListResourceState,
   getListCurrentPageIndex,
   getListCurrentPageSize,
+  getTrustedAppCreateData,
+  isCreatePending,
   needsRefreshOfListData,
 } from './selectors';
 
@@ -81,6 +83,38 @@ const refreshList = async (
   }
 };
 
+const createTrustedApp = async (
+  store: ImmutableMiddlewareAPI<TrustedAppsListPageState, AppAction>,
+  trustedAppsService: TrustedAppsService
+) => {
+  const { dispatch, getState } = store;
+
+  if (isCreatePending(getState())) {
+    try {
+      const newTrustedApp = getTrustedAppCreateData(getState());
+      const createdTrustedApp = (
+        await trustedAppsService.createTrustedApp(newTrustedApp as PostTrustedAppCreateRequest)
+      ).data;
+      dispatch({
+        type: 'serverReturnedCreateTrustedAppSuccess',
+        payload: {
+          type: 'success',
+          data: createdTrustedApp,
+        },
+      });
+      refreshList(store, trustedAppsService);
+    } catch (error) {
+      dispatch({
+        type: 'serverReturnedCreateTrustedAppFailure',
+        payload: {
+          type: 'failure',
+          data: error.body || error,
+        },
+      });
+    }
+  }
+};
+
 export const createTrustedAppsPageMiddleware = (
   trustedAppsService: TrustedAppsService
 ): ImmutableMiddleware<TrustedAppsListPageState, AppAction> => {
@@ -91,6 +125,10 @@ export const createTrustedAppsPageMiddleware = (
     if (action.type === 'userChangedUrl' && needsRefreshOfListData(store.getState())) {
       await refreshList(store, trustedAppsService);
     }
+
+    if (action.type === 'userClickedSaveNewTrustedAppButton') {
+      createTrustedApp(store, trustedAppsService);
+    }
   };
 };
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.test.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.test.ts
index 34325e0cf1398..76dd4b48e63d2 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.test.ts
@@ -26,6 +26,7 @@ describe('reducer', () => {
           currentPaginationInfo: { index: 5, size: 50 },
         },
         active: true,
+        createView: undefined,
       });
     });
 
@@ -67,7 +68,7 @@ describe('reducer', () => {
 
     it('makes page state inactive and resets list to uninitialised state when navigating away', () => {
       const result = trustedAppsPageReducer(
-        { listView: createLoadedListViewWithPagination(), active: true },
+        { listView: createLoadedListViewWithPagination(), active: true, createView: undefined },
         createUserChangedUrlAction('/endpoints')
       );
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.ts
index 4fdc6f90ef40c..d824a6e95c8d5 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.ts
@@ -11,14 +11,19 @@ import { ImmutableReducer } from '../../../../common/store';
 import { AppLocation, Immutable } from '../../../../../common/endpoint/types';
 import { UserChangedUrl } from '../../../../common/store/routing/action';
 import { AppAction } from '../../../../common/store/actions';
-import { extractListPaginationParams } from '../../../common/routing';
+import { extractFirstParamValue, extractListPaginationParams } from '../../../common/routing';
 import {
   MANAGEMENT_ROUTING_TRUSTED_APPS_PATH,
   MANAGEMENT_DEFAULT_PAGE,
   MANAGEMENT_DEFAULT_PAGE_SIZE,
 } from '../../../common/constants';
 
-import { TrustedAppsListResourceStateChanged } from './action';
+import {
+  ServerReturnedCreateTrustedAppFailure,
+  ServerReturnedCreateTrustedAppSuccess,
+  TrustedAppsListResourceStateChanged,
+  UserClickedSaveNewTrustedAppButton,
+} from './action';
 import { TrustedAppsListPageState } from '../state';
 
 type StateReducer = ImmutableReducer<TrustedAppsListPageState, AppAction>;
@@ -51,7 +56,10 @@ const trustedAppsListResourceStateChanged: CaseReducer<TrustedAppsListResourceSt
 
 const userChangedUrl: CaseReducer<UserChangedUrl> = (state, action) => {
   if (isTrustedAppsPageLocation(action.payload)) {
-    const paginationParams = extractListPaginationParams(parse(action.payload.search.slice(1)));
+    const parsedUrlsParams = parse(action.payload.search.slice(1));
+    const paginationParams = extractListPaginationParams(parsedUrlsParams);
+    const show =
+      extractFirstParamValue(parsedUrlsParams, 'show') === 'create' ? 'create' : undefined;
 
     return {
       ...state,
@@ -61,7 +69,9 @@ const userChangedUrl: CaseReducer<UserChangedUrl> = (state, action) => {
           index: paginationParams.page_index,
           size: paginationParams.page_size,
         },
+        show,
       },
+      createView: show ? state.createView : undefined,
       active: true,
     };
   } else {
@@ -69,6 +79,17 @@ const userChangedUrl: CaseReducer<UserChangedUrl> = (state, action) => {
   }
 };
 
+const trustedAppsCreateResourceChanged: CaseReducer<
+  | UserClickedSaveNewTrustedAppButton
+  | ServerReturnedCreateTrustedAppFailure
+  | ServerReturnedCreateTrustedAppSuccess
+> = (state, action) => {
+  return {
+    ...state,
+    createView: action.payload,
+  };
+};
+
 export const initialTrustedAppsPageState: TrustedAppsListPageState = {
   listView: {
     currentListResourceState: { type: 'UninitialisedResourceState' },
@@ -76,7 +97,9 @@ export const initialTrustedAppsPageState: TrustedAppsListPageState = {
       index: MANAGEMENT_DEFAULT_PAGE,
       size: MANAGEMENT_DEFAULT_PAGE_SIZE,
     },
+    show: undefined,
   },
+  createView: undefined,
   active: false,
 };
 
@@ -90,6 +113,11 @@ export const trustedAppsPageReducer: StateReducer = (
 
     case 'userChangedUrl':
       return userChangedUrl(state, action);
+
+    case 'userClickedSaveNewTrustedAppButton':
+    case 'serverReturnedCreateTrustedAppSuccess':
+    case 'serverReturnedCreateTrustedAppFailure':
+      return trustedAppsCreateResourceChanged(state, action);
   }
 
   return state;
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.test.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.test.ts
index a969e2dee4773..453afa1befa6b 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.test.ts
@@ -30,33 +30,41 @@ import {
 describe('selectors', () => {
   describe('needsRefreshOfListData()', () => {
     it('returns false for outdated resource state and inactive state', () => {
-      expect(needsRefreshOfListData({ listView: createDefaultListView(), active: false })).toBe(
-        false
-      );
+      expect(
+        needsRefreshOfListData({
+          listView: createDefaultListView(),
+          active: false,
+          createView: undefined,
+        })
+      ).toBe(false);
     });
 
     it('returns true for outdated resource state and active state', () => {
-      expect(needsRefreshOfListData({ listView: createDefaultListView(), active: true })).toBe(
-        true
-      );
+      expect(
+        needsRefreshOfListData({
+          listView: createDefaultListView(),
+          active: true,
+          createView: undefined,
+        })
+      ).toBe(true);
     });
 
     it('returns true when current loaded page index is outdated', () => {
       const listView = createLoadedListViewWithPagination({ index: 1, size: 20 });
 
-      expect(needsRefreshOfListData({ listView, active: true })).toBe(true);
+      expect(needsRefreshOfListData({ listView, active: true, createView: undefined })).toBe(true);
     });
 
     it('returns true when current loaded page size is outdated', () => {
       const listView = createLoadedListViewWithPagination({ index: 0, size: 50 });
 
-      expect(needsRefreshOfListData({ listView, active: true })).toBe(true);
+      expect(needsRefreshOfListData({ listView, active: true, createView: undefined })).toBe(true);
     });
 
     it('returns false when current loaded data is up to date', () => {
       const listView = createLoadedListViewWithPagination();
 
-      expect(needsRefreshOfListData({ listView, active: true })).toBe(false);
+      expect(needsRefreshOfListData({ listView, active: true, createView: undefined })).toBe(false);
     });
   });
 
@@ -64,9 +72,9 @@ describe('selectors', () => {
     it('returns current list resource state', () => {
       const listView = createDefaultListView();
 
-      expect(getCurrentListResourceState({ listView, active: false })).toStrictEqual(
-        createUninitialisedResourceState()
-      );
+      expect(
+        getCurrentListResourceState({ listView, active: false, createView: undefined })
+      ).toStrictEqual(createUninitialisedResourceState());
     });
   });
 
@@ -78,17 +86,20 @@ describe('selectors', () => {
           200
         ),
         currentPaginationInfo: createDefaultPaginationInfo(),
+        show: undefined,
       };
 
-      expect(getLastLoadedListResourceState({ listView, active: false })).toStrictEqual(
-        createListLoadedResourceState(createDefaultPaginationInfo(), 200)
-      );
+      expect(
+        getLastLoadedListResourceState({ listView, active: false, createView: undefined })
+      ).toStrictEqual(createListLoadedResourceState(createDefaultPaginationInfo(), 200));
     });
   });
 
   describe('getListItems()', () => {
     it('returns empty list when no valid data loaded', () => {
-      expect(getListItems({ listView: createDefaultListView(), active: false })).toStrictEqual([]);
+      expect(
+        getListItems({ listView: createDefaultListView(), active: false, createView: undefined })
+      ).toStrictEqual([]);
     });
 
     it('returns last loaded list items', () => {
@@ -98,9 +109,10 @@ describe('selectors', () => {
           200
         ),
         currentPaginationInfo: createDefaultPaginationInfo(),
+        show: undefined,
       };
 
-      expect(getListItems({ listView, active: false })).toStrictEqual(
+      expect(getListItems({ listView, active: false, createView: undefined })).toStrictEqual(
         createSampleTrustedApps(createDefaultPaginationInfo())
       );
     });
@@ -108,7 +120,13 @@ describe('selectors', () => {
 
   describe('getListTotalItemsCount()', () => {
     it('returns 0 when no valid data loaded', () => {
-      expect(getListTotalItemsCount({ listView: createDefaultListView(), active: false })).toBe(0);
+      expect(
+        getListTotalItemsCount({
+          listView: createDefaultListView(),
+          active: false,
+          createView: undefined,
+        })
+      ).toBe(0);
     });
 
     it('returns last loaded total items count', () => {
@@ -118,21 +136,34 @@ describe('selectors', () => {
           200
         ),
         currentPaginationInfo: createDefaultPaginationInfo(),
+        show: undefined,
       };
 
-      expect(getListTotalItemsCount({ listView, active: false })).toBe(200);
+      expect(getListTotalItemsCount({ listView, active: false, createView: undefined })).toBe(200);
     });
   });
 
   describe('getListCurrentPageIndex()', () => {
     it('returns page index', () => {
-      expect(getListCurrentPageIndex({ listView: createDefaultListView(), active: false })).toBe(0);
+      expect(
+        getListCurrentPageIndex({
+          listView: createDefaultListView(),
+          active: false,
+          createView: undefined,
+        })
+      ).toBe(0);
     });
   });
 
   describe('getListCurrentPageSize()', () => {
     it('returns page index', () => {
-      expect(getListCurrentPageSize({ listView: createDefaultListView(), active: false })).toBe(20);
+      expect(
+        getListCurrentPageSize({
+          listView: createDefaultListView(),
+          active: false,
+          createView: undefined,
+        })
+      ).toBe(20);
     });
   });
 
@@ -144,24 +175,32 @@ describe('selectors', () => {
           200
         ),
         currentPaginationInfo: createDefaultPaginationInfo(),
+        show: undefined,
       };
 
-      expect(getListErrorMessage({ listView, active: false })).toBeUndefined();
+      expect(
+        getListErrorMessage({ listView, active: false, createView: undefined })
+      ).toBeUndefined();
     });
 
     it('returns message when not in failed state', () => {
       const listView = {
         currentListResourceState: createListFailedResourceState('Internal Server Error'),
         currentPaginationInfo: createDefaultPaginationInfo(),
+        show: undefined,
       };
 
-      expect(getListErrorMessage({ listView, active: false })).toBe('Internal Server Error');
+      expect(getListErrorMessage({ listView, active: false, createView: undefined })).toBe(
+        'Internal Server Error'
+      );
     });
   });
 
   describe('isListLoading()', () => {
     it('returns false when no loading is happening', () => {
-      expect(isListLoading({ listView: createDefaultListView(), active: false })).toBe(false);
+      expect(
+        isListLoading({ listView: createDefaultListView(), active: false, createView: undefined })
+      ).toBe(false);
     });
 
     it('returns true when loading is in progress', () => {
@@ -171,9 +210,10 @@ describe('selectors', () => {
           200
         ),
         currentPaginationInfo: createDefaultPaginationInfo(),
+        show: undefined,
       };
 
-      expect(isListLoading({ listView, active: false })).toBe(true);
+      expect(isListLoading({ listView, active: false, createView: undefined })).toBe(true);
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.ts
index 6fde779ac1cce..f074b21f79f4e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.ts
@@ -4,7 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Immutable, TrustedApp } from '../../../../../common/endpoint/types';
+import { createSelector } from 'reselect';
+import { Immutable, NewTrustedApp, TrustedApp } from '../../../../../common/endpoint/types';
 
 import {
   AsyncResourceState,
@@ -14,9 +15,16 @@ import {
   isOutdatedResourceState,
   LoadedResourceState,
   PaginationInfo,
+  TrustedAppCreateFailure,
   TrustedAppsListData,
   TrustedAppsListPageState,
 } from '../state';
+import { TrustedAppsUrlParams } from '../types';
+import {
+  isTrustedAppCreateFailureState,
+  isTrustedAppCreatePendingState,
+  isTrustedAppCreateSuccessState,
+} from '../state/type_guards';
 
 const pageInfosEqual = (pageInfo1: PaginationInfo, pageInfo2: PaginationInfo): boolean =>
   pageInfo1.index === pageInfo2.index && pageInfo1.size === pageInfo2.size;
@@ -65,6 +73,27 @@ export const getListTotalItemsCount = (state: Immutable<TrustedAppsListPageState
   );
 };
 
+export const getListCurrentShowValue: (
+  state: Immutable<TrustedAppsListPageState>
+) => TrustedAppsListPageState['listView']['show'] = (state) => {
+  return state.listView.show;
+};
+
+export const getListUrlSearchParams: (
+  state: Immutable<TrustedAppsListPageState>
+) => TrustedAppsUrlParams = createSelector(
+  getListCurrentPageIndex,
+  getListCurrentPageSize,
+  getListCurrentShowValue,
+  (pageIndex, pageSize, showValue) => {
+    return {
+      page_index: pageIndex,
+      page_size: pageSize,
+      show: showValue,
+    };
+  }
+);
+
 export const getListErrorMessage = (
   state: Immutable<TrustedAppsListPageState>
 ): string | undefined => {
@@ -74,3 +103,27 @@ export const getListErrorMessage = (
 export const isListLoading = (state: Immutable<TrustedAppsListPageState>): boolean => {
   return isLoadingResourceState(state.listView.currentListResourceState);
 };
+
+export const isCreatePending: (state: Immutable<TrustedAppsListPageState>) => boolean = ({
+  createView,
+}) => {
+  return isTrustedAppCreatePendingState(createView);
+};
+
+export const getTrustedAppCreateData: (
+  state: Immutable<TrustedAppsListPageState>
+) => undefined | Immutable<NewTrustedApp> = ({ createView }) => {
+  return (isTrustedAppCreatePendingState(createView) && createView.data) || undefined;
+};
+
+export const getApiCreateErrors: (
+  state: Immutable<TrustedAppsListPageState>
+) => undefined | TrustedAppCreateFailure['data'] = ({ createView }) => {
+  return (isTrustedAppCreateFailureState(createView) && createView.data) || undefined;
+};
+
+export const wasCreateSuccessful: (state: Immutable<TrustedAppsListPageState>) => boolean = ({
+  createView,
+}) => {
+  return isTrustedAppCreateSuccessState(createView);
+};
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/test_utils/index.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/test_utils/index.ts
index fab059a422a2a..70e4e1e685b01 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/test_utils/index.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/test_utils/index.ts
@@ -21,6 +21,7 @@ import {
 } from '../state';
 
 import { TrustedAppsListResourceStateChanged } from '../store/action';
+import { initialTrustedAppsPageState } from '../store/reducer';
 
 const OS_LIST: Array<TrustedApp['os']> = ['windows', 'macos', 'linux'];
 
@@ -93,6 +94,7 @@ export const createListComplexLoadingResourceState = (
 export const createDefaultPaginationInfo = () => ({ index: 0, size: 20 });
 
 export const createDefaultListView = () => ({
+  ...initialTrustedAppsPageState.listView,
   currentListResourceState: createUninitialisedResourceState(),
   currentPaginationInfo: createDefaultPaginationInfo(),
 });
@@ -101,6 +103,7 @@ export const createLoadingListViewWithPagination = (
   currentPaginationInfo: PaginationInfo,
   previousState: StaleResourceState<TrustedAppsListData> = createUninitialisedResourceState()
 ): TrustedAppsListPageState['listView'] => ({
+  ...initialTrustedAppsPageState.listView,
   currentListResourceState: { type: 'LoadingResourceState', previousState },
   currentPaginationInfo,
 });
@@ -110,6 +113,7 @@ export const createLoadedListViewWithPagination = (
   currentPaginationInfo: PaginationInfo = createDefaultPaginationInfo(),
   totalItemsCount: number = 200
 ): TrustedAppsListPageState['listView'] => ({
+  ...initialTrustedAppsPageState.listView,
   currentListResourceState: createListLoadedResourceState(paginationInfo, totalItemsCount),
   currentPaginationInfo,
 });
@@ -119,6 +123,7 @@ export const createFailedListViewWithPagination = (
   error: ServerApiError,
   lastLoadedState?: LoadedResourceState<TrustedAppsListData>
 ): TrustedAppsListPageState['listView'] => ({
+  ...initialTrustedAppsPageState.listView,
   currentListResourceState: { type: 'FailedResourceState', error, lastLoadedState },
   currentPaginationInfo,
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/types.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/types.ts
new file mode 100644
index 0000000000000..4d59cd7913a0c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/types.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface TrustedAppsUrlParams {
+  page_index: number;
+  page_size: number;
+  show?: 'create';
+}
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/__snapshots__/trusted_apps_page.test.tsx.snap b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/__snapshots__/trusted_apps_page.test.tsx.snap
index d6e9aee108cf6..c8d9b46d5a0d2 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/__snapshots__/trusted_apps_page.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/__snapshots__/trusted_apps_page.test.tsx.snap
@@ -1,23 +1,955 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`TrustedAppsPage rendering 1`] = `
-<AdministrationListPage
-  beta={true}
-  subtitle={
-    <FormattedMessage
-      defaultMessage="View and configure trusted applications"
-      id="xpack.securitySolution.trustedapps.list.pageSubTitle"
-      values={Object {}}
-    />
+Object {
+  "asFragment": [Function],
+  "baseElement": .c0 {
+  padding: 24px;
+}
+
+.c0.siemWrapperPage--restrictWidthDefault,
+.c0.siemWrapperPage--restrictWidthCustom {
+  box-sizing: content-box;
+  margin: 0 auto;
+}
+
+.c0.siemWrapperPage--restrictWidthDefault {
+  max-width: 1000px;
+}
+
+.c0.siemWrapperPage--fullHeight {
+  height: 100%;
+}
+
+.c0.siemWrapperPage--withTimeline {
+  padding-right: 70px;
+}
+
+.c0.siemWrapperPage--noPadding {
+  padding: 0;
+}
+
+.c4 {
+  margin-top: 8px;
+}
+
+.c4 .siemSubtitle__item {
+  color: #6a717d;
+  font-size: 12px;
+  line-height: 1.5;
+}
+
+.c3 {
+  vertical-align: middle;
+}
+
+.c1 {
+  margin-bottom: 24px;
+}
+
+.c2 {
+  display: block;
+}
+
+.c5 .euiFlyout {
+  z-index: 4001;
+}
+
+@media only screen and (min-width:575px) {
+  .c4 .siemSubtitle__item {
+    display: inline-block;
+    margin-right: 16px;
   }
-  title={
-    <FormattedMessage
-      defaultMessage="Trusted Applications"
-      id="xpack.securitySolution.trustedapps.list.pageTitle"
-      values={Object {}}
-    />
+
+  .c4 .siemSubtitle__item:last-child {
+    margin-right: 0;
   }
+}
+
+<body>
+    <div>
+      <div
+        class="c0 siemWrapperPage"
+      >
+        <header
+          class="c1 siemHeaderPage"
+        >
+          <div
+            class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
+          >
+            <div
+              class="euiFlexItem c2"
+            >
+              <h1
+                class="euiTitle euiTitle--large"
+                data-test-subj="header-page-title"
+              >
+                Trusted Applications
+                 
+                <span
+                  class="euiBetaBadge c3"
+                  title="Beta"
+                >
+                  Beta
+                </span>
+              </h1>
+              <div
+                class="c4 siemSubtitle"
+              >
+                <div
+                  class="siemSubtitle__item siemSubtitle__item--node"
+                  data-test-subj="header-panel-subtitle"
+                >
+                  View and configure trusted applications
+                </div>
+              </div>
+            </div>
+            <div
+              class="euiFlexItem euiFlexItem--flexGrowZero c2"
+              data-test-subj="header-page-supplements"
+            >
+              <button
+                class="euiButton euiButton--primary euiButton--fill"
+                data-test-subj="trustedAppsListAddButton"
+                type="button"
+              >
+                <span
+                  class="euiButtonContent euiButton__content"
+                >
+                  <div
+                    class="euiButtonContent__icon"
+                    data-euiicon-type="plusInCircle"
+                  />
+                  <span
+                    class="euiButton__text"
+                  >
+                    Add Trusted Application
+                  </span>
+                </span>
+              </button>
+            </div>
+          </div>
+        </header>
+        <div
+          class="euiTabs"
+          role="tablist"
+        >
+          <button
+            aria-selected="false"
+            class="euiTab"
+            data-test-subj="navigation-endpoints"
+            role="tab"
+            type="button"
+          >
+            <span
+              class="euiTab__content"
+            >
+              Endpoints
+            </span>
+          </button>
+          <button
+            aria-selected="false"
+            class="euiTab"
+            data-test-subj="navigation-trusted_apps"
+            role="tab"
+            type="button"
+          >
+            <span
+              class="euiTab__content"
+            >
+              Trusted applications
+            </span>
+          </button>
+        </div>
+        <div
+          class="euiSpacer euiSpacer--l"
+        />
+        <div
+          class="euiPanel euiPanel--paddingMedium c5"
+        >
+          <div
+            class="euiBasicTable euiBasicTable-loading"
+          >
+            <div>
+              <div
+                class="euiTableHeaderMobile"
+              >
+                <div
+                  class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsBaseline euiFlexGroup--justifyContentSpaceBetween euiFlexGroup--directionRow"
+                >
+                  <div
+                    class="euiFlexItem euiFlexItem--flexGrowZero"
+                  />
+                  <div
+                    class="euiFlexItem euiFlexItem--flexGrowZero"
+                  />
+                </div>
+              </div>
+              <table
+                class="euiTable euiTable--responsive"
+                id="mockId"
+                tabindex="-1"
+              >
+                <caption
+                  class="euiScreenReaderOnly euiTableCaption"
+                />
+                <thead>
+                  <tr>
+                    <th
+                      class="euiTableHeaderCell"
+                      data-test-subj="tableHeaderCell_name_0"
+                      role="columnheader"
+                      scope="col"
+                    >
+                      <div
+                        class="euiTableCellContent"
+                      >
+                        <span
+                          class="euiTableCellContent__text"
+                          title="Name"
+                        >
+                          Name
+                        </span>
+                      </div>
+                    </th>
+                    <th
+                      class="euiTableHeaderCell"
+                      data-test-subj="tableHeaderCell_os_1"
+                      role="columnheader"
+                      scope="col"
+                    >
+                      <div
+                        class="euiTableCellContent"
+                      >
+                        <span
+                          class="euiTableCellContent__text"
+                          title="OS"
+                        >
+                          OS
+                        </span>
+                      </div>
+                    </th>
+                    <th
+                      class="euiTableHeaderCell"
+                      data-test-subj="tableHeaderCell_created_at_2"
+                      role="columnheader"
+                      scope="col"
+                    >
+                      <div
+                        class="euiTableCellContent"
+                      >
+                        <span
+                          class="euiTableCellContent__text"
+                          title="Date Created"
+                        >
+                          Date Created
+                        </span>
+                      </div>
+                    </th>
+                    <th
+                      class="euiTableHeaderCell"
+                      data-test-subj="tableHeaderCell_created_by_3"
+                      role="columnheader"
+                      scope="col"
+                    >
+                      <div
+                        class="euiTableCellContent"
+                      >
+                        <span
+                          class="euiTableCellContent__text"
+                          title="Created By"
+                        >
+                          Created By
+                        </span>
+                      </div>
+                    </th>
+                  </tr>
+                </thead>
+                <tbody>
+                  <tr
+                    class="euiTableRow"
+                  >
+                    <td
+                      class="euiTableRowCell euiTableRowCell--isMobileFullWidth"
+                      colspan="4"
+                    >
+                      <div
+                        class="euiTableCellContent euiTableCellContent--alignCenter"
+                      >
+                        <span
+                          class="euiTableCellContent__text"
+                        >
+                          No items found
+                        </span>
+                      </div>
+                    </td>
+                  </tr>
+                </tbody>
+              </table>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </body>,
+  "container": <div>
+    <div
+      class="sc-fzoyAV jWxvlI siemWrapperPage"
+    >
+      <header
+        class="sc-qWSGh guUwJg siemHeaderPage"
+      >
+        <div
+          class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
+        >
+          <div
+            class="euiFlexItem sc-pAMRk dnbbmF"
+          >
+            <h1
+              class="euiTitle euiTitle--large"
+              data-test-subj="header-page-title"
+            >
+              Trusted Applications
+               
+              <span
+                class="euiBetaBadge sc-puFxT fWhqFT"
+                title="Beta"
+              >
+                Beta
+              </span>
+            </h1>
+            <div
+              class="sc-fzoXzr iMKumH siemSubtitle"
+            >
+              <div
+                class="siemSubtitle__item siemSubtitle__item--node"
+                data-test-subj="header-panel-subtitle"
+              >
+                View and configure trusted applications
+              </div>
+            </div>
+          </div>
+          <div
+            class="euiFlexItem euiFlexItem--flexGrowZero sc-pAMRk dnbbmF"
+            data-test-subj="header-page-supplements"
+          >
+            <button
+              class="euiButton euiButton--primary euiButton--fill"
+              data-test-subj="trustedAppsListAddButton"
+              type="button"
+            >
+              <span
+                class="euiButtonContent euiButton__content"
+              >
+                <div
+                  class="euiButtonContent__icon"
+                  data-euiicon-type="plusInCircle"
+                />
+                <span
+                  class="euiButton__text"
+                >
+                  Add Trusted Application
+                </span>
+              </span>
+            </button>
+          </div>
+        </div>
+      </header>
+      <div
+        class="euiTabs"
+        role="tablist"
+      >
+        <button
+          aria-selected="false"
+          class="euiTab"
+          data-test-subj="navigation-endpoints"
+          role="tab"
+          type="button"
+        >
+          <span
+            class="euiTab__content"
+          >
+            Endpoints
+          </span>
+        </button>
+        <button
+          aria-selected="false"
+          class="euiTab"
+          data-test-subj="navigation-trusted_apps"
+          role="tab"
+          type="button"
+        >
+          <span
+            class="euiTab__content"
+          >
+            Trusted applications
+          </span>
+        </button>
+      </div>
+      <div
+        class="euiSpacer euiSpacer--l"
+      />
+      <div
+        class="euiPanel euiPanel--paddingMedium sc-pJVLq cINVeB"
+      >
+        <div
+          class="euiBasicTable euiBasicTable-loading"
+        >
+          <div>
+            <div
+              class="euiTableHeaderMobile"
+            >
+              <div
+                class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsBaseline euiFlexGroup--justifyContentSpaceBetween euiFlexGroup--directionRow"
+              >
+                <div
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
+                />
+                <div
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
+                />
+              </div>
+            </div>
+            <table
+              class="euiTable euiTable--responsive"
+              id="mockId"
+              tabindex="-1"
+            >
+              <caption
+                class="euiScreenReaderOnly euiTableCaption"
+              />
+              <thead>
+                <tr>
+                  <th
+                    class="euiTableHeaderCell"
+                    data-test-subj="tableHeaderCell_name_0"
+                    role="columnheader"
+                    scope="col"
+                  >
+                    <div
+                      class="euiTableCellContent"
+                    >
+                      <span
+                        class="euiTableCellContent__text"
+                        title="Name"
+                      >
+                        Name
+                      </span>
+                    </div>
+                  </th>
+                  <th
+                    class="euiTableHeaderCell"
+                    data-test-subj="tableHeaderCell_os_1"
+                    role="columnheader"
+                    scope="col"
+                  >
+                    <div
+                      class="euiTableCellContent"
+                    >
+                      <span
+                        class="euiTableCellContent__text"
+                        title="OS"
+                      >
+                        OS
+                      </span>
+                    </div>
+                  </th>
+                  <th
+                    class="euiTableHeaderCell"
+                    data-test-subj="tableHeaderCell_created_at_2"
+                    role="columnheader"
+                    scope="col"
+                  >
+                    <div
+                      class="euiTableCellContent"
+                    >
+                      <span
+                        class="euiTableCellContent__text"
+                        title="Date Created"
+                      >
+                        Date Created
+                      </span>
+                    </div>
+                  </th>
+                  <th
+                    class="euiTableHeaderCell"
+                    data-test-subj="tableHeaderCell_created_by_3"
+                    role="columnheader"
+                    scope="col"
+                  >
+                    <div
+                      class="euiTableCellContent"
+                    >
+                      <span
+                        class="euiTableCellContent__text"
+                        title="Created By"
+                      >
+                        Created By
+                      </span>
+                    </div>
+                  </th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr
+                  class="euiTableRow"
+                >
+                  <td
+                    class="euiTableRowCell euiTableRowCell--isMobileFullWidth"
+                    colspan="4"
+                  >
+                    <div
+                      class="euiTableCellContent euiTableCellContent--alignCenter"
+                    >
+                      <span
+                        class="euiTableCellContent__text"
+                      >
+                        No items found
+                      </span>
+                    </div>
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>,
+  "debug": [Function],
+  "findAllByAltText": [Function],
+  "findAllByDisplayValue": [Function],
+  "findAllByLabelText": [Function],
+  "findAllByPlaceholderText": [Function],
+  "findAllByRole": [Function],
+  "findAllByTestId": [Function],
+  "findAllByText": [Function],
+  "findAllByTitle": [Function],
+  "findByAltText": [Function],
+  "findByDisplayValue": [Function],
+  "findByLabelText": [Function],
+  "findByPlaceholderText": [Function],
+  "findByRole": [Function],
+  "findByTestId": [Function],
+  "findByText": [Function],
+  "findByTitle": [Function],
+  "getAllByAltText": [Function],
+  "getAllByDisplayValue": [Function],
+  "getAllByLabelText": [Function],
+  "getAllByPlaceholderText": [Function],
+  "getAllByRole": [Function],
+  "getAllByTestId": [Function],
+  "getAllByText": [Function],
+  "getAllByTitle": [Function],
+  "getByAltText": [Function],
+  "getByDisplayValue": [Function],
+  "getByLabelText": [Function],
+  "getByPlaceholderText": [Function],
+  "getByRole": [Function],
+  "getByTestId": [Function],
+  "getByText": [Function],
+  "getByTitle": [Function],
+  "queryAllByAltText": [Function],
+  "queryAllByDisplayValue": [Function],
+  "queryAllByLabelText": [Function],
+  "queryAllByPlaceholderText": [Function],
+  "queryAllByRole": [Function],
+  "queryAllByTestId": [Function],
+  "queryAllByText": [Function],
+  "queryAllByTitle": [Function],
+  "queryByAltText": [Function],
+  "queryByDisplayValue": [Function],
+  "queryByLabelText": [Function],
+  "queryByPlaceholderText": [Function],
+  "queryByRole": [Function],
+  "queryByTestId": [Function],
+  "queryByText": [Function],
+  "queryByTitle": [Function],
+  "rerender": [Function],
+  "unmount": [Function],
+}
+`;
+
+exports[`TrustedAppsPage when the Add Trusted App button is clicked should display create form 1`] = `
+@media only screen and (min-width:575px) {
+
+}
+
+<div
+  class="euiForm"
+  data-test-subj="addTrustedAppFlyout-createForm"
 >
-  <TrustedAppsList />
-</AdministrationListPage>
+  <div
+    class="euiFormRow euiFormRow--fullWidth"
+    data-test-subj="addTrustedAppFlyout-createForm-nameRow"
+    id="mockId-row"
+  >
+    <div
+      class="euiFormRow__labelWrapper"
+    >
+      <label
+        class="euiFormLabel euiFormRow__label"
+        for="mockId"
+      >
+        Name your trusted app application
+      </label>
+    </div>
+    <div
+      class="euiFormRow__fieldWrapper"
+    >
+      <div
+        class="euiFormControlLayout euiFormControlLayout--fullWidth"
+      >
+        <div
+          class="euiFormControlLayout__childrenWrapper"
+        >
+          <input
+            class="euiFieldText euiFieldText--fullWidth"
+            data-test-subj="addTrustedAppFlyout-createForm-nameTextField"
+            id="mockId"
+            name="name"
+            type="text"
+            value=""
+          />
+        </div>
+      </div>
+    </div>
+  </div>
+  <div
+    class="euiFormRow euiFormRow--fullWidth"
+    data-test-subj="addTrustedAppFlyout-createForm-OsRow"
+    id="mockId-row"
+  >
+    <div
+      class="euiFormRow__labelWrapper"
+    >
+      <label
+        class="euiFormLabel euiFormRow__label"
+        for="mockId"
+      >
+        Select operating system
+      </label>
+    </div>
+    <div
+      class="euiFormRow__fieldWrapper"
+    >
+      <div
+        class="euiPopover euiPopover--anchorDownCenter euiPopover--displayBlock euiSuperSelect euiSuperSelect--fullWidth"
+      >
+        <div
+          class="euiPopover__anchor"
+        >
+          <input
+            id="mockId"
+            name="os"
+            type="hidden"
+            value="windows"
+          />
+          <div
+            class="euiFormControlLayout euiFormControlLayout--fullWidth"
+          >
+            <div
+              class="euiFormControlLayout__childrenWrapper"
+            >
+              <span
+                class="euiScreenReaderOnly"
+                id="mockId"
+              >
+                Select an option: Windows, is selected
+              </span>
+              <button
+                aria-haspopup="true"
+                aria-labelledby="mockId mockId"
+                class="euiSuperSelectControl euiSuperSelectControl--fullWidth"
+                data-test-subj="addTrustedAppFlyout-createForm-osSelectField"
+                type="button"
+              >
+                Windows
+              </button>
+              <div
+                class="euiFormControlLayoutIcons euiFormControlLayoutIcons--right"
+              >
+                <span
+                  class="euiFormControlLayoutCustomIcon"
+                >
+                  <div
+                    aria-hidden="true"
+                    class="euiFormControlLayoutCustomIcon__icon"
+                    data-euiicon-type="arrowDown"
+                  />
+                </span>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <div
+    class="euiFormRow euiFormRow--fullWidth"
+    data-test-subj="addTrustedAppFlyout-createForm-conditionsRow"
+    id="mockId-row"
+  >
+    <div
+      class="euiFormRow__fieldWrapper"
+    >
+      <div
+        data-test-subj="addTrustedAppFlyout-createForm-conditionsBuilder"
+      >
+        <div>
+          <div
+            class="euiFlexGroup euiFlexGroup--gutterExtraSmall euiFlexGroup--directionRow euiFlexGroup--responsive"
+            data-test-subj="addTrustedAppFlyout-createForm-conditionsBuilder-group1"
+          >
+            <div
+              class="euiFlexItem euiFlexItem--flexGrow1"
+            >
+              <div
+                class="euiFlexGroup euiFlexGroup--gutterSmall euiFlexGroup--alignItemsCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
+                data-test-subj="addTrustedAppFlyout-createForm-conditionsBuilder-group1-entry0"
+              >
+                <div
+                  class="euiFlexItem euiFlexItem--flexGrow2"
+                >
+                  <div
+                    class="euiFormRow euiFormRow--fullWidth"
+                    id="mockId-row"
+                  >
+                    <div
+                      class="euiFormRow__labelWrapper"
+                    >
+                      <label
+                        class="euiFormLabel euiFormRow__label"
+                        for="mockId"
+                      >
+                        Field
+                      </label>
+                    </div>
+                    <div
+                      class="euiFormRow__fieldWrapper"
+                    >
+                      <div
+                        class="euiPopover euiPopover--anchorDownCenter euiPopover--displayBlock euiSuperSelect"
+                      >
+                        <div
+                          class="euiPopover__anchor"
+                        >
+                          <input
+                            id="mockId"
+                            type="hidden"
+                            value="process.hash.*"
+                          />
+                          <div
+                            class="euiFormControlLayout"
+                          >
+                            <div
+                              class="euiFormControlLayout__childrenWrapper"
+                            >
+                              <span
+                                class="euiScreenReaderOnly"
+                                id="mockId"
+                              >
+                                Select an option: Hash, is selected
+                              </span>
+                              <button
+                                aria-haspopup="true"
+                                aria-labelledby="mockId mockId"
+                                class="euiSuperSelectControl"
+                                data-test-subj="addTrustedAppFlyout-createForm-conditionsBuilder-group1-entry0-field"
+                                type="button"
+                              >
+                                Hash
+                              </button>
+                              <div
+                                class="euiFormControlLayoutIcons euiFormControlLayoutIcons--right"
+                              >
+                                <span
+                                  class="euiFormControlLayoutCustomIcon"
+                                >
+                                  <div
+                                    aria-hidden="true"
+                                    class="euiFormControlLayoutCustomIcon__icon"
+                                    data-euiicon-type="arrowDown"
+                                  />
+                                </span>
+                              </div>
+                            </div>
+                          </div>
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+                <div
+                  class="euiFlexItem"
+                >
+                  <div
+                    class="euiFormRow euiFormRow--fullWidth"
+                    id="mockId-row"
+                  >
+                    <div
+                      class="euiFormRow__labelWrapper"
+                    >
+                      <label
+                        class="euiFormLabel euiFormRow__label"
+                        for="mockId"
+                      >
+                        Operator
+                      </label>
+                    </div>
+                    <div
+                      class="euiFormRow__fieldWrapper"
+                    >
+                      <div
+                        class="euiFormControlLayout euiFormControlLayout--readOnly"
+                      >
+                        <div
+                          class="euiFormControlLayout__childrenWrapper"
+                        >
+                          <input
+                            class="euiFieldText"
+                            id="mockId"
+                            name="operator"
+                            readonly=""
+                            type="text"
+                            value="is"
+                          />
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+                <div
+                  class="euiFlexItem euiFlexItem--flexGrow3"
+                >
+                  <div
+                    class="euiFormRow euiFormRow--fullWidth"
+                    id="mockId-row"
+                  >
+                    <div
+                      class="euiFormRow__labelWrapper"
+                    >
+                      <label
+                        class="euiFormLabel euiFormRow__label"
+                        for="mockId"
+                      >
+                        Value
+                      </label>
+                    </div>
+                    <div
+                      class="euiFormRow__fieldWrapper"
+                    >
+                      <div
+                        class="euiFormControlLayout"
+                      >
+                        <div
+                          class="euiFormControlLayout__childrenWrapper"
+                        >
+                          <input
+                            class="euiFieldText"
+                            data-test-subj="addTrustedAppFlyout-createForm-conditionsBuilder-group1-entry0-value"
+                            id="mockId"
+                            name="value"
+                            type="text"
+                            value=""
+                          />
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+                <div
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
+                >
+                  <div
+                    class="euiFormRow euiFormRow--fullWidth"
+                    id="mockId-row"
+                  >
+                    <div
+                      class="euiFormRow__labelWrapper"
+                    >
+                      <label
+                        class="euiFormLabel euiFormRow__label"
+                        for="mockId"
+                      >
+                         
+                      </label>
+                    </div>
+                    <div
+                      class="euiFormRow__fieldWrapper"
+                    >
+                      <button
+                        aria-label="Remove Entry"
+                        class="euiButtonIcon euiButtonIcon--danger"
+                        disabled=""
+                        id="mockId"
+                        type="button"
+                      >
+                        <div
+                          aria-hidden="true"
+                          class="euiButtonIcon__icon"
+                          data-euiicon-type="trash"
+                        />
+                      </button>
+                    </div>
+                  </div>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+        <div
+          class="euiSpacer euiSpacer--s"
+        />
+        <button
+          class="euiButton euiButton--primary euiButton--small euiButton--fill"
+          data-test-subj="addTrustedAppFlyout-createForm-conditionsBuilder-AndButton"
+          style="min-width: 95px;"
+          type="button"
+        >
+          <span
+            class="euiButtonContent euiButton__content"
+          >
+            <div
+              class="euiButtonContent__icon"
+              data-euiicon-type="plusInCircle"
+            />
+            <span
+              class="euiButton__text"
+            >
+              AND
+            </span>
+          </span>
+        </button>
+      </div>
+    </div>
+  </div>
+  <div
+    class="euiFormRow euiFormRow--fullWidth"
+    data-test-subj="addTrustedAppFlyout-createForm-descriptionRow"
+    id="mockId-row"
+  >
+    <div
+      class="euiFormRow__labelWrapper"
+    >
+      <label
+        class="euiFormLabel euiFormRow__label"
+        for="mockId"
+      >
+        Description
+      </label>
+    </div>
+    <div
+      class="euiFormRow__fieldWrapper"
+    >
+      <textarea
+        class="euiTextArea euiTextArea--resizeVertical euiTextArea--fullWidth"
+        data-test-subj="addTrustedAppFlyout-createForm-descriptionField"
+        id="mockId"
+        name="description"
+        rows="6"
+      />
+    </div>
+  </div>
+</div>
 `;
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/create_trusted_app_flyout.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/create_trusted_app_flyout.tsx
new file mode 100644
index 0000000000000..cced85083348c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/create_trusted_app_flyout.tsx
@@ -0,0 +1,152 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  EuiButton,
+  EuiButtonEmpty,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFlyout,
+  EuiFlyoutBody,
+  EuiFlyoutFooter,
+  EuiFlyoutHeader,
+  EuiTitle,
+} from '@elastic/eui';
+import React, { memo, useCallback, useEffect, useState } from 'react';
+import { EuiFlyoutProps } from '@elastic/eui/src/components/flyout/flyout';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { useDispatch } from 'react-redux';
+import { i18n } from '@kbn/i18n';
+import {
+  CreateTrustedAppForm,
+  CreateTrustedAppFormProps,
+  TrustedAppFormState,
+} from './create_trusted_app_form';
+import { useTrustedAppsSelector } from '../hooks';
+import { getApiCreateErrors, isCreatePending, wasCreateSuccessful } from '../../store/selectors';
+import { AppAction } from '../../../../../common/store/actions';
+import { useToasts } from '../../../../../common/lib/kibana';
+
+type CreateTrustedAppFlyoutProps = Omit<EuiFlyoutProps, 'hideCloseButton'>;
+export const CreateTrustedAppFlyout = memo<CreateTrustedAppFlyoutProps>(
+  ({ onClose, ...flyoutProps }) => {
+    const dispatch = useDispatch<(action: AppAction) => void>();
+    const toasts = useToasts();
+
+    const pendingCreate = useTrustedAppsSelector(isCreatePending);
+    const apiErrors = useTrustedAppsSelector(getApiCreateErrors);
+    const wasCreated = useTrustedAppsSelector(wasCreateSuccessful);
+
+    const [formState, setFormState] = useState<undefined | TrustedAppFormState>();
+    const dataTestSubj = flyoutProps['data-test-subj'];
+
+    const getTestId = useCallback(
+      (suffix: string): string | undefined => {
+        if (dataTestSubj) {
+          return `${dataTestSubj}-${suffix}`;
+        }
+      },
+      [dataTestSubj]
+    );
+    const handleCancelClick = useCallback(() => {
+      if (pendingCreate) {
+        return;
+      }
+      onClose();
+    }, [onClose, pendingCreate]);
+    const handleSaveClick = useCallback(() => {
+      if (formState) {
+        dispatch({
+          type: 'userClickedSaveNewTrustedAppButton',
+          payload: {
+            type: 'pending',
+            data: formState.item,
+          },
+        });
+      }
+    }, [dispatch, formState]);
+    const handleFormOnChange = useCallback<CreateTrustedAppFormProps['onChange']>(
+      (newFormState) => {
+        setFormState(newFormState);
+      },
+      []
+    );
+
+    // If it was created, then close flyout
+    useEffect(() => {
+      if (wasCreated) {
+        toasts.addSuccess(
+          i18n.translate(
+            'xpack.securitySolution.trustedapps.createTrustedAppFlyout.successToastTitle',
+            {
+              defaultMessage: '"{name}" has been added to the Trusted Applications list.',
+              values: { name: formState?.item.name },
+            }
+          )
+        );
+        onClose();
+      }
+    }, [formState?.item?.name, onClose, toasts, wasCreated]);
+
+    return (
+      <EuiFlyout onClose={handleCancelClick} {...flyoutProps} hideCloseButton={pendingCreate}>
+        <EuiFlyoutHeader hasBorder>
+          <EuiTitle size="m">
+            <h2 data-test-subj={getTestId('headerTitle')}>
+              <FormattedMessage
+                id="xpack.securitySolution.trustedapps.createTrustedAppFlyout.title"
+                defaultMessage="Add trusted application"
+              />
+            </h2>
+          </EuiTitle>
+        </EuiFlyoutHeader>
+
+        <EuiFlyoutBody>
+          <CreateTrustedAppForm
+            fullWidth
+            onChange={handleFormOnChange}
+            isInvalid={!!apiErrors}
+            error={apiErrors?.message}
+            data-test-subj={getTestId('createForm')}
+          />
+        </EuiFlyoutBody>
+
+        <EuiFlyoutFooter>
+          <EuiFlexGroup justifyContent="spaceBetween">
+            <EuiFlexItem grow={false}>
+              <EuiButtonEmpty
+                onClick={handleCancelClick}
+                flush="left"
+                isDisabled={pendingCreate}
+                data-test-subj={getTestId('cancelButton')}
+              >
+                <FormattedMessage
+                  id="xpack.securitySolution.trustedapps.createTrustedAppFlyout.cancelButton"
+                  defaultMessage="Cancel"
+                />
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiButton
+                onClick={handleSaveClick}
+                fill
+                isDisabled={!formState?.isValid || pendingCreate}
+                isLoading={pendingCreate}
+                data-test-subj={getTestId('createButton')}
+              >
+                <FormattedMessage
+                  id="xpack.securitySolution.trustedapps.createTrustedAppFlyout.saveButton"
+                  defaultMessage="Add trusted application"
+                />
+              </EuiButton>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlyoutFooter>
+      </EuiFlyout>
+    );
+  }
+);
+CreateTrustedAppFlyout.displayName = 'NewTrustedAppFlyout';
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/create_trusted_app_form.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/create_trusted_app_form.tsx
new file mode 100644
index 0000000000000..b6eb9795acd1d
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/create_trusted_app_form.tsx
@@ -0,0 +1,280 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { ChangeEventHandler, memo, useCallback, useEffect, useMemo, useState } from 'react';
+import {
+  EuiForm,
+  EuiFormRow,
+  EuiFieldText,
+  EuiSuperSelect,
+  EuiSuperSelectOption,
+  EuiTextArea,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { EuiFormProps } from '@elastic/eui/src/components/form/form';
+import { TRUSTED_APPS_SUPPORTED_OS_TYPES } from '../../../../../../common/endpoint/constants';
+import { LogicalConditionBuilder } from './logical_condition';
+import {
+  MacosLinuxConditionEntry,
+  NewTrustedApp,
+  TrustedApp,
+} from '../../../../../../common/endpoint/types';
+import { LogicalConditionBuilderProps } from './logical_condition/logical_condition_builder';
+import { OS_TITLES } from '../constants';
+import {
+  isTrustedAppSupportedOs,
+  isWindowsTrustedApp,
+  isWindowsTrustedAppCondition,
+} from '../../state/type_guards';
+
+const generateNewEntry = (): NewTrustedApp['entries'][0] => {
+  return {
+    field: 'process.hash.*',
+    operator: 'included',
+    type: 'match',
+    value: '',
+  };
+};
+
+interface ValidationResult {
+  isValid: boolean;
+  errors: Partial<{ [k in keyof NewTrustedApp]: string }>;
+}
+const validateFormValues = (values: NewTrustedApp): ValidationResult => {
+  const errors: ValidationResult['errors'] = {};
+
+  if (!values.name.trim()) {
+    errors.name = 'Name is required';
+  }
+
+  if (!values.os) {
+    errors.os = 'OS is required';
+  }
+
+  if (!values.entries.length) {
+    errors.entries = 'At least one Field definition is required';
+  } else {
+    values.entries.some((entry, index) => {
+      if (!entry.field || !entry.value.trim()) {
+        errors.entries = `Field entry ${index + 1} must have a value`;
+        return true;
+      }
+      return false;
+    });
+  }
+
+  return {
+    isValid: Object.keys(errors).length === 0,
+    errors,
+  };
+};
+
+export interface TrustedAppFormState {
+  isValid: boolean;
+  item: NewTrustedApp;
+}
+export type CreateTrustedAppFormProps = Pick<
+  EuiFormProps,
+  'className' | 'data-test-subj' | 'isInvalid' | 'error' | 'invalidCallout'
+> & {
+  /** if form should be shown full width of parent container */
+  fullWidth?: boolean;
+  onChange: (state: TrustedAppFormState) => void;
+};
+export const CreateTrustedAppForm = memo<CreateTrustedAppFormProps>(
+  ({ fullWidth, onChange, ...formProps }) => {
+    const dataTestSubj = formProps['data-test-subj'];
+    const osOptions: Array<EuiSuperSelectOption<string>> = useMemo(() => {
+      return TRUSTED_APPS_SUPPORTED_OS_TYPES.map((os) => {
+        return {
+          value: os,
+          inputDisplay: OS_TITLES[os as TrustedApp['os']],
+        };
+      });
+    }, []);
+    const [formValues, setFormValues] = useState<NewTrustedApp>({
+      name: '',
+      os: 'windows',
+      entries: [generateNewEntry()],
+      description: '',
+    });
+    const getTestId = useCallback(
+      (suffix: string): string | undefined => {
+        if (dataTestSubj) {
+          return `${dataTestSubj}-${suffix}`;
+        }
+      },
+      [dataTestSubj]
+    );
+    const handleAndClick = useCallback(() => {
+      setFormValues(
+        (prevState): NewTrustedApp => {
+          if (isWindowsTrustedApp(prevState)) {
+            return {
+              ...prevState,
+              entries: [...prevState.entries, generateNewEntry()].filter((entry) =>
+                isWindowsTrustedAppCondition(entry)
+              ),
+            };
+          } else {
+            return {
+              ...prevState,
+              entries: [
+                ...prevState.entries.filter((entry) => !isWindowsTrustedAppCondition(entry)),
+                generateNewEntry(),
+              ] as MacosLinuxConditionEntry[],
+            };
+          }
+        }
+      );
+    }, [setFormValues]);
+    const handleDomChangeEvents = useCallback<
+      ChangeEventHandler<HTMLInputElement | HTMLTextAreaElement>
+    >(({ target: { name, value } }) => {
+      setFormValues(
+        (prevState): NewTrustedApp => {
+          return {
+            ...prevState,
+            [name]: value,
+          };
+        }
+      );
+    }, []);
+    const handleOsChange = useCallback<(v: string) => void>((newOsValue) => {
+      setFormValues(
+        (prevState): NewTrustedApp => {
+          if (isTrustedAppSupportedOs(newOsValue)) {
+            const updatedState: NewTrustedApp = {
+              ...prevState,
+              entries: [],
+              os: newOsValue,
+            };
+            if (!isWindowsTrustedApp(updatedState)) {
+              updatedState.entries.push(
+                ...(prevState.entries.filter(
+                  (entry) => !isWindowsTrustedAppCondition(entry)
+                ) as MacosLinuxConditionEntry[])
+              );
+            }
+            return updatedState;
+          }
+          return prevState;
+        }
+      );
+    }, []);
+    const handleEntryRemove = useCallback((entry: NewTrustedApp['entries'][0]) => {
+      setFormValues(
+        (prevState): NewTrustedApp => {
+          return {
+            ...prevState,
+            entries: prevState.entries.filter((item) => item !== entry),
+          } as NewTrustedApp;
+        }
+      );
+    }, []);
+    const handleEntryChange = useCallback<LogicalConditionBuilderProps['onEntryChange']>(
+      (newEntry, oldEntry) => {
+        setFormValues(
+          (prevState): NewTrustedApp => {
+            if (isWindowsTrustedApp(prevState)) {
+              return {
+                ...prevState,
+                entries: prevState.entries.map((item) => {
+                  if (item === oldEntry) {
+                    return newEntry;
+                  }
+                  return item;
+                }),
+              } as NewTrustedApp;
+            } else {
+              return {
+                ...prevState,
+                entries: prevState.entries.map((item) => {
+                  if (item === oldEntry) {
+                    return newEntry;
+                  }
+                  return item;
+                }),
+              } as NewTrustedApp;
+            }
+          }
+        );
+      },
+      []
+    );
+
+    // Anytime the form values change - validate and notify
+    useEffect(() => {
+      onChange({
+        isValid: validateFormValues(formValues).isValid,
+        item: formValues,
+      });
+    }, [formValues, onChange]);
+
+    return (
+      <EuiForm {...formProps} component="div">
+        <EuiFormRow
+          label={i18n.translate('xpack.securitySolution.trustedapps.create.name', {
+            defaultMessage: 'Name your trusted app application',
+          })}
+          fullWidth={fullWidth}
+          data-test-subj={getTestId('nameRow')}
+        >
+          <EuiFieldText
+            name="name"
+            value={formValues.name}
+            onChange={handleDomChangeEvents}
+            fullWidth
+            data-test-subj={getTestId('nameTextField')}
+          />
+        </EuiFormRow>
+        <EuiFormRow
+          label={i18n.translate('xpack.securitySolution.trustedapps.create.os', {
+            defaultMessage: 'Select operating system',
+          })}
+          fullWidth={fullWidth}
+          data-test-subj={getTestId('OsRow')}
+        >
+          <EuiSuperSelect
+            name="os"
+            options={osOptions}
+            valueOfSelected={formValues.os}
+            onChange={handleOsChange}
+            fullWidth
+            data-test-subj={getTestId('osSelectField')}
+          />
+        </EuiFormRow>
+        <EuiFormRow fullWidth={fullWidth} data-test-subj={getTestId('conditionsRow')}>
+          <LogicalConditionBuilder
+            entries={formValues.entries}
+            os={formValues.os}
+            onAndClicked={handleAndClick}
+            onEntryRemove={handleEntryRemove}
+            onEntryChange={handleEntryChange}
+            data-test-subj={getTestId('conditionsBuilder')}
+          />
+        </EuiFormRow>
+        <EuiFormRow
+          label={i18n.translate('xpack.securitySolution.trustedapps.create.description', {
+            defaultMessage: 'Description',
+          })}
+          fullWidth={fullWidth}
+          data-test-subj={getTestId('descriptionRow')}
+        >
+          <EuiTextArea
+            name="description"
+            value={formValues.description}
+            onChange={handleDomChangeEvents}
+            fullWidth
+            data-test-subj={getTestId('descriptionField')}
+          />
+        </EuiFormRow>
+      </EuiForm>
+    );
+  }
+);
+
+CreateTrustedAppForm.displayName = 'NewTrustedAppForm';
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/components/condition_entry.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/components/condition_entry.tsx
new file mode 100644
index 0000000000000..23bced0c048b1
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/components/condition_entry.tsx
@@ -0,0 +1,188 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { ChangeEventHandler, memo, useCallback, useMemo } from 'react';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiSuperSelect,
+  EuiFieldText,
+  EuiButtonIcon,
+  EuiSuperSelectOption,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { TrustedApp } from '../../../../../../../../common/endpoint/types';
+
+const ConditionEntryCell = memo<{
+  showLabel: boolean;
+  label?: string;
+  children: React.ReactElement;
+}>(({ showLabel, label = '', children }) => {
+  return showLabel ? (
+    <EuiFormRow label={label} fullWidth>
+      {children}
+    </EuiFormRow>
+  ) : (
+    <>{children}</>
+  );
+});
+
+ConditionEntryCell.displayName = 'ConditionEntryCell';
+
+export interface ConditionEntryProps {
+  // FIXME:PT probably need to adjust below types to match what is done in `TrustedApp` type
+  os: TrustedApp['os'];
+  entry: TrustedApp['entries'][0];
+  /** controls if remove button is enabled/disabled */
+  isRemoveDisabled?: boolean;
+  /** If the labels for each Column in the input row should be shown. Normally set on the first row entry */
+  showLabels: boolean;
+  onRemove: (entry: TrustedApp['entries'][0]) => void;
+  onChange: (newEntry: TrustedApp['entries'][0], oldEntry: TrustedApp['entries'][0]) => void;
+  'data-test-subj'?: string;
+}
+export const ConditionEntry = memo<ConditionEntryProps>(
+  ({
+    entry,
+    showLabels = false,
+    onRemove,
+    onChange,
+    isRemoveDisabled = false,
+    'data-test-subj': dataTestSubj,
+  }) => {
+    const getTestId = useCallback(
+      (suffix: string): string | undefined => {
+        if (dataTestSubj) {
+          return `${dataTestSubj}-${suffix}`;
+        }
+      },
+      [dataTestSubj]
+    );
+    const fieldOptions = useMemo<Array<EuiSuperSelectOption<string>>>(() => {
+      return [
+        {
+          inputDisplay: i18n.translate(
+            'xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.field.hash',
+            { defaultMessage: 'Hash' }
+          ),
+          value: 'process.hash.*',
+        },
+        {
+          inputDisplay: i18n.translate(
+            'xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.field.path',
+            { defaultMessage: 'Path' }
+          ),
+          value: 'process.path',
+        },
+      ];
+    }, []);
+    const handleValueUpdate = useCallback<ChangeEventHandler<HTMLInputElement>>(
+      (ev) => {
+        onChange(
+          {
+            ...entry,
+            value: ev.target.value,
+          },
+          entry
+        );
+      },
+      [entry, onChange]
+    );
+    const handleFieldUpdate = useCallback(
+      (newField) => {
+        onChange(
+          {
+            ...entry,
+            field: newField,
+          },
+          entry
+        );
+      },
+      [entry, onChange]
+    );
+    const handleRemoveClick = useCallback(() => {
+      onRemove(entry);
+    }, [entry, onRemove]);
+
+    return (
+      <EuiFlexGroup
+        gutterSize="s"
+        alignItems="center"
+        direction="row"
+        data-test-subj={dataTestSubj}
+      >
+        <EuiFlexItem grow={2}>
+          <ConditionEntryCell
+            showLabel={showLabels}
+            label={i18n.translate(
+              'xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.field',
+              { defaultMessage: 'Field' }
+            )}
+          >
+            <EuiSuperSelect
+              options={fieldOptions}
+              valueOfSelected={entry.field}
+              onChange={handleFieldUpdate}
+              data-test-subj={getTestId('field')}
+            />
+          </ConditionEntryCell>
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <ConditionEntryCell
+            showLabel={showLabels}
+            label={i18n.translate(
+              'xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.operator',
+              { defaultMessage: 'Operator' }
+            )}
+          >
+            <EuiFieldText
+              name="operator"
+              value={i18n.translate(
+                'xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.operator.is',
+                { defaultMessage: 'is' }
+              )}
+              readOnly
+            />
+          </ConditionEntryCell>
+        </EuiFlexItem>
+        <EuiFlexItem grow={3}>
+          <ConditionEntryCell
+            showLabel={showLabels}
+            label={i18n.translate(
+              'xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.value',
+              { defaultMessage: 'Value' }
+            )}
+          >
+            <EuiFieldText
+              name="value"
+              value={entry.value}
+              onChange={handleValueUpdate}
+              data-test-subj={getTestId('value')}
+            />
+          </ConditionEntryCell>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          {/* Unicode `nbsp` is used below so that Remove button is property displayed */}
+          <ConditionEntryCell showLabel={showLabels} label={'\u00A0'}>
+            <EuiButtonIcon
+              color="danger"
+              iconType="trash"
+              onClick={handleRemoveClick}
+              isDisabled={isRemoveDisabled}
+              aria-label={i18n.translate(
+                'xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.removeLabel',
+                { defaultMessage: 'Remove Entry' }
+              )}
+            />
+          </ConditionEntryCell>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  }
+);
+
+ConditionEntry.displayName = 'ConditionEntry';
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/components/condition_group.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/components/condition_group.tsx
new file mode 100644
index 0000000000000..323eddbaf8648
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/components/condition_group.tsx
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useCallback } from 'react';
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import styled from 'styled-components';
+import { NewTrustedApp, TrustedApp } from '../../../../../../../../common/endpoint/types';
+import { ConditionEntry, ConditionEntryProps } from './condition_entry';
+import { AndOrBadge } from '../../../../../../../common/components/and_or_badge';
+
+const AndBadgeFlexItem = styled(EuiFlexItem)`
+  padding-top: 20px;
+`;
+
+export interface ConditionGroupProps {
+  os: TrustedApp['os'];
+  entries: TrustedApp['entries'];
+  onEntryRemove: ConditionEntryProps['onRemove'];
+  onEntryChange: ConditionEntryProps['onChange'];
+  'data-test-subj'?: string;
+}
+export const ConditionGroup = memo<ConditionGroupProps>(
+  ({ os, entries, onEntryRemove, onEntryChange, 'data-test-subj': dataTestSubj }) => {
+    const getTestId = useCallback(
+      (suffix: string): string | undefined => {
+        if (dataTestSubj) {
+          return `${dataTestSubj}-${suffix}`;
+        }
+      },
+      [dataTestSubj]
+    );
+    return (
+      <EuiFlexGroup gutterSize="xs" data-test-subj={dataTestSubj}>
+        {entries.length > 1 && (
+          <AndBadgeFlexItem grow={false}>
+            <AndOrBadge type={'and'} includeAntennas={true} />
+          </AndBadgeFlexItem>
+        )}
+        <EuiFlexItem grow={1}>
+          {(entries as (NewTrustedApp & { os: 'windows' })['entries']).map((entry, index) => (
+            <ConditionEntry
+              key={index}
+              os={os}
+              entry={entry}
+              showLabels={index === 0}
+              isRemoveDisabled={index === 0 && entries.length <= 1}
+              onRemove={onEntryRemove}
+              onChange={onEntryChange}
+              data-test-subj={getTestId(`entry${index}`)}
+            />
+          ))}
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  }
+);
+
+ConditionGroup.displayName = 'ConditionGroup';
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/index.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/index.ts
new file mode 100644
index 0000000000000..944a30abd73d3
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { LogicalConditionBuilder } from './logical_condition_builder';
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/logical_condition_builder.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/logical_condition_builder.tsx
new file mode 100644
index 0000000000000..e5e84acd0c4ad
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/logical_condition_builder.tsx
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useCallback } from 'react';
+import { EuiButton, CommonProps, EuiText, EuiSpacer } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { ConditionGroup, ConditionGroupProps } from './components/condition_group';
+
+const BUTTON_MIN_WIDTH = Object.freeze({ minWidth: '95px' });
+
+export type LogicalConditionBuilderProps = CommonProps &
+  ConditionGroupProps & {
+    onAndClicked: () => void;
+    isAndDisabled?: boolean;
+  };
+export const LogicalConditionBuilder = memo<LogicalConditionBuilderProps>(
+  ({
+    entries,
+    os,
+    className,
+    isAndDisabled = false,
+    onAndClicked,
+    onEntryRemove,
+    onEntryChange,
+    'data-test-subj': dataTestSubj,
+  }) => {
+    const getTestId = useCallback(
+      (suffix: string): string | undefined => {
+        if (dataTestSubj) {
+          return `${dataTestSubj}-${suffix}`;
+        }
+      },
+      [dataTestSubj]
+    );
+    return (
+      <div data-test-subj={dataTestSubj} className={className}>
+        <div>
+          {entries.length === 0 ? (
+            <NoEntries />
+          ) : (
+            <ConditionGroup
+              os={os}
+              entries={entries}
+              onEntryRemove={onEntryRemove}
+              onEntryChange={onEntryChange}
+              data-test-subj={getTestId('group1')}
+            />
+          )}
+        </div>
+        <EuiSpacer size="s" />
+        <EuiButton
+          fill
+          size="s"
+          iconType="plusInCircle"
+          onClick={onAndClicked}
+          data-test-subj={getTestId('AndButton')}
+          isDisabled={isAndDisabled}
+          style={BUTTON_MIN_WIDTH}
+        >
+          <FormattedMessage
+            id="xpack.securitySolution.trustedapps.logicalConditionBuilder.andOperator"
+            defaultMessage="AND"
+          />
+        </EuiButton>
+      </div>
+    );
+  }
+);
+
+LogicalConditionBuilder.displayName = 'LogicalConditionBuilder';
+
+// FIXME:PT need to style this better.
+const NoEntries = memo(() => {
+  return (
+    <div>
+      <EuiText>
+        <FormattedMessage
+          id="xpack.securitySolution.trustedapps.logicalConditionBuilder.noEntries"
+          defaultMessage="No entries"
+        />
+      </EuiText>
+    </div>
+  );
+});
+
+NoEntries.displayName = 'NoEntries';
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/constants.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/constants.ts
new file mode 100644
index 0000000000000..d5df8c528511a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/constants.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { TrustedApp } from '../../../../../common/endpoint/types';
+
+export const OS_TITLES: Readonly<{ [K in TrustedApp['os']]: string }> = {
+  windows: i18n.translate('xpack.securitySolution.trustedapps.os.windows', {
+    defaultMessage: 'Windows',
+  }),
+  macos: i18n.translate('xpack.securitySolution.trustedapps.os.macos', {
+    defaultMessage: 'Mac OS',
+  }),
+  linux: i18n.translate('xpack.securitySolution.trustedapps.os.linux', {
+    defaultMessage: 'Linux',
+  }),
+};
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_list.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_list.tsx
index a9077dd84913e..ea834060d5223 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_list.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_list.tsx
@@ -26,18 +26,7 @@ import {
 import { useTrustedAppsSelector } from './hooks';
 
 import { FormattedDate } from '../../../../common/components/formatted_date';
-
-const OS_TITLES: Readonly<{ [K in TrustedApp['os']]: string }> = {
-  windows: i18n.translate('xpack.securitySolution.trustedapps.os.windows', {
-    defaultMessage: 'Windows',
-  }),
-  macos: i18n.translate('xpack.securitySolution.trustedapps.os.macos', {
-    defaultMessage: 'Mac OS',
-  }),
-  linux: i18n.translate('xpack.securitySolution.trustedapps.os.linux', {
-    defaultMessage: 'Linux',
-  }),
-};
+import { OS_TITLES } from './constants';
 
 const COLUMN_TITLES: Readonly<{ [K in keyof Omit<TrustedApp, 'id' | 'entries'>]: string }> = {
   name: i18n.translate('xpack.securitySolution.trustedapps.list.columns.name', {
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx
index cc7dbd42d7a7d..c0c9cdf227643 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx
@@ -3,13 +3,273 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { shallow } from 'enzyme';
 import React from 'react';
-
+import * as reactTestingLibrary from '@testing-library/react';
 import { TrustedAppsPage } from './trusted_apps_page';
+import { AppContextTestRender, createAppRootMockRenderer } from '../../../../common/mock/endpoint';
+import { fireEvent } from '@testing-library/dom';
+import { MiddlewareActionSpyHelper } from '../../../../common/store/test_utils';
+import { NewTrustedApp, PostTrustedAppCreateResponse } from '../../../../../common/endpoint/types';
+import { HttpFetchOptions } from 'kibana/public';
+
+jest.mock('@elastic/eui/lib/services/accessibility/html_id_generator', () => ({
+  htmlIdGenerator: () => () => 'mockId',
+}));
 
 describe('TrustedAppsPage', () => {
+  let history: AppContextTestRender['history'];
+  let coreStart: AppContextTestRender['coreStart'];
+  let waitForAction: MiddlewareActionSpyHelper['waitForAction'];
+  let render: () => ReturnType<AppContextTestRender['render']>;
+
+  beforeEach(() => {
+    const mockedContext = createAppRootMockRenderer();
+
+    history = mockedContext.history;
+    coreStart = mockedContext.coreStart;
+    waitForAction = mockedContext.middlewareSpy.waitForAction;
+    render = () => mockedContext.render(<TrustedAppsPage />);
+    reactTestingLibrary.act(() => {
+      history.push('/trusted_apps');
+    });
+  });
+
   test('rendering', () => {
-    expect(shallow(<TrustedAppsPage />)).toMatchSnapshot();
+    expect(render()).toMatchSnapshot();
+  });
+
+  it('should display a Add Trusted App button', async () => {
+    const { getByTestId } = render();
+    const addButton = await getByTestId('trustedAppsListAddButton');
+    expect(addButton.textContent).toBe('Add Trusted Application');
+  });
+
+  describe('when the Add Trusted App button is clicked', () => {
+    const renderAndClickAddButton = async (): Promise<
+      ReturnType<AppContextTestRender['render']>
+    > => {
+      const renderResult = render();
+      const addButton = renderResult.getByTestId('trustedAppsListAddButton');
+      reactTestingLibrary.act(() => {
+        fireEvent.click(addButton, { button: 1 });
+      });
+      return renderResult;
+    };
+
+    it('should display the create flyout', async () => {
+      const { getByTestId } = await renderAndClickAddButton();
+      const flyout = getByTestId('addTrustedAppFlyout');
+      expect(flyout).not.toBeNull();
+
+      const flyoutTitle = getByTestId('addTrustedAppFlyout-headerTitle');
+      expect(flyoutTitle.textContent).toBe('Add trusted application');
+    });
+
+    it('should update the URL to indicate the flyout is opened', async () => {
+      await renderAndClickAddButton();
+      expect(/show\=create/.test(history.location.search)).toBe(true);
+    });
+
+    it('should preserve other URL search params', async () => {
+      reactTestingLibrary.act(() => {
+        history.push('/trusted_apps?page_index=2&page_size=20');
+      });
+      await renderAndClickAddButton();
+      expect(history.location.search).toBe('?page_index=2&page_size=20&show=create');
+    });
+
+    it('should display create form', async () => {
+      const { getByTestId } = await renderAndClickAddButton();
+      expect(getByTestId('addTrustedAppFlyout-createForm')).toMatchSnapshot();
+    });
+
+    it('should initially have the flyout Add button disabled', async () => {
+      const { getByTestId } = await renderAndClickAddButton();
+      expect((getByTestId('addTrustedAppFlyout-createButton') as HTMLButtonElement).disabled).toBe(
+        true
+      );
+    });
+
+    it('should close flyout if cancel button is clicked', async () => {
+      const { getByTestId, queryByTestId } = await renderAndClickAddButton();
+      const cancelButton = getByTestId('addTrustedAppFlyout-cancelButton');
+      reactTestingLibrary.act(() => {
+        fireEvent.click(cancelButton, { button: 1 });
+      });
+      expect(queryByTestId('addTrustedAppFlyout')).toBeNull();
+      expect(history.location.search).toBe('');
+    });
+
+    it('should close flyout if flyout close button is clicked', async () => {
+      const { getByTestId, queryByTestId } = await renderAndClickAddButton();
+      const flyoutCloseButton = getByTestId('euiFlyoutCloseButton');
+      reactTestingLibrary.act(() => {
+        fireEvent.click(flyoutCloseButton, { button: 1 });
+      });
+      expect(queryByTestId('addTrustedAppFlyout')).toBeNull();
+      expect(history.location.search).toBe('');
+    });
+
+    describe('and when the form data is valid', () => {
+      const fillInCreateForm = ({ getByTestId }: ReturnType<AppContextTestRender['render']>) => {
+        reactTestingLibrary.act(() => {
+          fireEvent.change(getByTestId('addTrustedAppFlyout-createForm-nameTextField'), {
+            target: { value: 'trusted app A' },
+          });
+
+          fireEvent.change(
+            getByTestId('addTrustedAppFlyout-createForm-conditionsBuilder-group1-entry0-value'),
+            { target: { value: 'SOME$HASH#HERE' } }
+          );
+
+          fireEvent.change(getByTestId('addTrustedAppFlyout-createForm-descriptionField'), {
+            target: { value: 'let this be' },
+          });
+        });
+      };
+
+      it('should enable the Flyout Add button', async () => {
+        const renderResult = await renderAndClickAddButton();
+        const { getByTestId } = renderResult;
+        fillInCreateForm(renderResult);
+        const flyoutAddButton = getByTestId(
+          'addTrustedAppFlyout-createButton'
+        ) as HTMLButtonElement;
+        expect(flyoutAddButton.disabled).toBe(false);
+      });
+
+      describe('and the Flyout Add button is clicked', () => {
+        let renderResult: ReturnType<AppContextTestRender['render']>;
+        let resolveHttpPost: (response?: PostTrustedAppCreateResponse) => void;
+        let httpPostBody: string;
+        let rejectHttpPost: (response: Error) => void;
+
+        beforeEach(async () => {
+          // Mock the http.post() call and expose `resolveHttpPost()` method so that
+          // we can control when the API call response is returned, which will allow us
+          // to test the UI behaviours while the API call is in flight
+          coreStart.http.post.mockImplementation(
+            // @ts-ignore
+            async (path: string, options: HttpFetchOptions) => {
+              return new Promise((resolve, reject) => {
+                httpPostBody = options.body as string;
+                resolveHttpPost = resolve;
+                rejectHttpPost = reject;
+              });
+            }
+          );
+
+          renderResult = await renderAndClickAddButton();
+          fillInCreateForm(renderResult);
+          const userClickedSaveActionWatcher = waitForAction('userClickedSaveNewTrustedAppButton');
+          reactTestingLibrary.act(() => {
+            fireEvent.click(renderResult.getByTestId('addTrustedAppFlyout-createButton'), {
+              button: 1,
+            });
+          });
+          await reactTestingLibrary.act(async () => {
+            await userClickedSaveActionWatcher;
+          });
+        });
+
+        afterEach(() => resolveHttpPost());
+
+        it('should disable the Cancel button', async () => {
+          expect(
+            (renderResult.getByTestId('addTrustedAppFlyout-cancelButton') as HTMLButtonElement)
+              .disabled
+          ).toBe(true);
+          resolveHttpPost();
+        });
+
+        it('should hide the dialog close button', async () => {
+          expect(renderResult.queryByTestId('euiFlyoutCloseButton')).toBeNull();
+        });
+
+        it('should disable the flyout Add button and set it to loading', async () => {
+          const saveButton = renderResult.getByTestId(
+            'addTrustedAppFlyout-createButton'
+          ) as HTMLButtonElement;
+          expect(saveButton.disabled).toBe(true);
+          expect(saveButton.querySelector('.euiLoadingSpinner')).not.toBeNull();
+        });
+
+        describe('and if create was successful', () => {
+          beforeEach(async () => {
+            const successCreateApiResponse: PostTrustedAppCreateResponse = {
+              data: {
+                ...(JSON.parse(httpPostBody) as NewTrustedApp),
+                id: '1',
+                created_at: '2020-09-16T14:09:45.484Z',
+                created_by: 'kibana',
+              },
+            };
+            await reactTestingLibrary.act(async () => {
+              const serverResponseAction = waitForAction('serverReturnedCreateTrustedAppSuccess');
+              coreStart.http.get.mockClear();
+              resolveHttpPost(successCreateApiResponse);
+              await serverResponseAction;
+            });
+          });
+
+          it('should close the flyout', async () => {
+            expect(renderResult.queryByTestId('addTrustedAppFlyout')).toBeNull();
+          });
+
+          it('should show success toast notification', async () => {
+            expect(coreStart.notifications.toasts.addSuccess.mock.calls[0][0]).toEqual(
+              '"trusted app A" has been added to the Trusted Applications list.'
+            );
+          });
+
+          it('should trigger the List to reload', async () => {
+            expect(coreStart.http.get.mock.calls[0][0]).toEqual('/api/endpoint/trusted_apps');
+          });
+        });
+
+        describe('and if create failed', () => {
+          beforeEach(async () => {
+            const failedCreateApiResponse: Error & { body?: { message: string } } = new Error(
+              'Bad call'
+            );
+            failedCreateApiResponse.body = {
+              message: 'bad call',
+            };
+            await reactTestingLibrary.act(async () => {
+              const serverResponseAction = waitForAction('serverReturnedCreateTrustedAppFailure');
+              coreStart.http.get.mockClear();
+              rejectHttpPost(failedCreateApiResponse);
+              await serverResponseAction;
+            });
+          });
+
+          it('should continue to show the flyout', async () => {
+            expect(renderResult.getByTestId('addTrustedAppFlyout')).not.toBeNull();
+          });
+
+          it('should enable the Cancel Button', async () => {
+            expect(
+              (renderResult.getByTestId('addTrustedAppFlyout-cancelButton') as HTMLButtonElement)
+                .disabled
+            ).toBe(false);
+          });
+
+          it('should show the dialog close button', async () => {
+            expect(renderResult.getByTestId('euiFlyoutCloseButton')).not.toBeNull();
+          });
+
+          it('should enable the flyout Add button and remove loading indicating', () => {
+            expect(
+              (renderResult.getByTestId('addTrustedAppFlyout-createButton') as HTMLButtonElement)
+                .disabled
+            ).toBe(false);
+          });
+
+          it('should show API errors in the form', async () => {
+            expect(renderResult.container.querySelector('.euiForm__errors')).not.toBeNull();
+          });
+        });
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.tsx
index c0d3b9cd699de..a0dae900eb30e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.tsx
@@ -3,12 +3,49 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { memo } from 'react';
+import React, { memo, useCallback } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiButton } from '@elastic/eui';
+import { useHistory } from 'react-router-dom';
 import { AdministrationListPage } from '../../../components/administration_list_page';
 import { TrustedAppsList } from './trusted_apps_list';
+import { CreateTrustedAppFlyout } from './components/create_trusted_app_flyout';
+import { getTrustedAppsListPath } from '../../../common/routing';
+import { useTrustedAppsSelector } from './hooks';
+import { getListCurrentShowValue, getListUrlSearchParams } from '../store/selectors';
 
 export const TrustedAppsPage = memo(() => {
+  const history = useHistory();
+  const urlParams = useTrustedAppsSelector(getListUrlSearchParams);
+  const showAddFlout = useTrustedAppsSelector(getListCurrentShowValue) === 'create';
+  const handleAddButtonClick = useCallback(() => {
+    history.push(
+      getTrustedAppsListPath({
+        ...urlParams,
+        show: 'create',
+      })
+    );
+  }, [history, urlParams]);
+  const handleAddFlyoutClose = useCallback(() => {
+    const { show, ...paginationParamsOnly } = urlParams;
+    history.push(getTrustedAppsListPath(paginationParamsOnly));
+  }, [history, urlParams]);
+
+  const addButton = (
+    <EuiButton
+      fill
+      iconType="plusInCircle"
+      isDisabled={showAddFlout}
+      onClick={handleAddButtonClick}
+      data-test-subj="trustedAppsListAddButton"
+    >
+      <FormattedMessage
+        id="xpack.securitySolution.trustedapps.list.addButton"
+        defaultMessage="Add Trusted Application"
+      />
+    </EuiButton>
+  );
+
   return (
     <AdministrationListPage
       beta={true}
@@ -24,7 +61,15 @@ export const TrustedAppsPage = memo(() => {
           defaultMessage="View and configure trusted applications"
         />
       }
+      actions={addButton}
     >
+      {showAddFlout && (
+        <CreateTrustedAppFlyout
+          onClose={handleAddFlyoutClose}
+          size="s"
+          data-test-subj="addTrustedAppFlyout"
+        />
+      )}
       <TrustedAppsList />
     </AdministrationListPage>
   );
diff --git a/x-pack/plugins/security_solution/public/resolver/models/location_search.ts b/x-pack/plugins/security_solution/public/resolver/models/location_search.ts
index 8c21043c268d5..6c1dc7991e298 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/location_search.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/location_search.ts
@@ -4,36 +4,44 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-/**
- * The legacy `crumbEvent` and `crumbId` parameters.
- * @deprecated
- */
-export function breadcrumbParameters(
-  locationSearch: string,
-  resolverComponentInstanceID: string
-): { crumbEvent: string; crumbId: string } {
-  const urlSearchParams = new URLSearchParams(locationSearch);
-  const { eventKey, idKey } = parameterNames(resolverComponentInstanceID);
-  return {
-    // Use `''` for backwards compatibility with deprecated code.
-    crumbEvent: urlSearchParams.get(eventKey) ?? '',
-    crumbId: urlSearchParams.get(idKey) ?? '',
-  };
-}
+import { PanelViewAndParameters } from '../types';
+import * as schema from './schema';
 
 /**
- * Parameter names based on the `resolverComponentInstanceID`.
+ * Validates an `unknown` value, narrowing it to `PanelViewAndParameters`.
+ * Use this to validate that the value decoded from the URL is a valid `PanelViewAndParameters` object.
  */
-function parameterNames(
-  resolverComponentInstanceID: string
-): {
-  idKey: string;
-  eventKey: string;
-} {
-  const idKey: string = `resolver-${resolverComponentInstanceID}-id`;
-  const eventKey: string = `resolver-${resolverComponentInstanceID}-event`;
-  return {
-    idKey,
-    eventKey,
-  };
-}
+export const isPanelViewAndParameters: (
+  value: unknown
+) => value is PanelViewAndParameters = schema.oneOf([
+  schema.object({
+    panelView: schema.literal('nodes' as const),
+  }),
+  schema.object({
+    panelView: schema.literal('nodeDetail' as const),
+    panelParameters: schema.object({
+      nodeID: schema.string(),
+    }),
+  }),
+  schema.object({
+    panelView: schema.literal('nodeEvents' as const),
+    panelParameters: schema.object({
+      nodeID: schema.string(),
+    }),
+  }),
+  schema.object({
+    panelView: schema.literal('nodeEventsOfType' as const),
+    panelParameters: schema.object({
+      nodeID: schema.string(),
+      eventType: schema.string(),
+    }),
+  }),
+  schema.object({
+    panelView: schema.literal('eventDetail' as const),
+    panelParameters: schema.object({
+      nodeID: schema.string(),
+      eventType: schema.string(),
+      eventID: schema.string(),
+    }),
+  }),
+]);
diff --git a/x-pack/plugins/security_solution/public/resolver/models/schema.test.ts b/x-pack/plugins/security_solution/public/resolver/models/schema.test.ts
new file mode 100644
index 0000000000000..c01e1300d8914
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/models/schema.test.ts
@@ -0,0 +1,135 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as schema from './schema';
+
+interface SortDefinition {
+  page?: number;
+  sort?: Array<{ field: 'name' | 'ip' | 'date'; direction: 'asc' | 'desc' }>;
+}
+describe(`a validator made using the 'schema' module which validates that a value has the type:
+{
+  page?: number;
+  sort?: Array<{ field: 'name' | 'ip' | 'date'; direction: 'asc' | 'desc' }>;
+}`, () => {
+  let validator: (value: unknown) => value is SortDefinition;
+  beforeEach(() => {
+    validator = schema.object({
+      page: schema.oneOf([schema.literal(undefined), schema.number()]),
+      sort: schema.oneOf([
+        schema.array(
+          schema.object({
+            field: schema.oneOf([
+              schema.literal('name' as const),
+              schema.literal('ip' as const),
+              schema.literal('date' as const),
+            ]),
+            direction: schema.oneOf([
+              schema.literal('asc' as const),
+              schema.literal('desc' as const),
+            ]),
+          })
+        ),
+        schema.literal(undefined),
+      ]),
+    });
+  });
+  describe.each([
+    [
+      {
+        page: 1,
+        sort: [
+          {
+            field: 'name',
+            direction: 'asc',
+          },
+          {
+            field: 'date',
+            direction: 'desc',
+          },
+        ],
+      },
+      true,
+    ],
+    [
+      {
+        // page has the wrong type
+        page: '1',
+        sort: [
+          {
+            field: 'name',
+            direction: 'asc',
+          },
+          {
+            field: 'date',
+            direction: 'desc',
+          },
+        ],
+      },
+      false,
+    ],
+
+    [
+      {
+        sort: [
+          {
+            // missing direction
+            field: 'name',
+          },
+        ],
+      },
+      false,
+    ],
+    [
+      {
+        sort: [
+          {
+            field: 'name',
+            // invalid direction
+            direction: 'invalid',
+          },
+        ],
+      },
+      false,
+    ],
+    [
+      {
+        sort: [
+          {
+            // missing field
+            direction: 'desc',
+          },
+        ],
+      },
+      false,
+    ],
+    [
+      {
+        sort: [
+          {
+            // invalid field
+            field: 'invalid',
+            direction: 'desc',
+          },
+        ],
+      },
+      false,
+    ],
+    // nothing in the array
+    [{ sort: [] }, true],
+    // page only
+    [{ page: 1 }, true],
+    // empty object (valid because all keys are optional.)
+    [{}, true],
+    // entirely invalid types
+    [null, false],
+    [true, false],
+    ['', false],
+  ])('when the value to be validated is `%j`', (value, expected) => {
+    it(`should return ${expected}`, () => {
+      expect(validator(value)).toBe(expected);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/resolver/models/schema.ts b/x-pack/plugins/security_solution/public/resolver/models/schema.ts
new file mode 100644
index 0000000000000..07912b82b425c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/models/schema.ts
@@ -0,0 +1,176 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+type Validator<T> = (value: unknown) => value is T;
+type TypeOf<V extends Validator<unknown>> = V extends Validator<infer T> ? T : never;
+
+/**
+ * Validate that `value` matches at least one of `validators`.
+ * Use this to create a predicate for a union type.
+ * e.g.
+ * ```
+ * import * as schema from './schema';
+ * const isAscOrDesc: (value: unknown) => value is 'asc' | 'desc' = schema.oneOf([
+ *   schema.literal('asc' as const),
+ *   schema.literal('desc' as const),
+ * ]);
+ * ```
+ */
+export function oneOf<V extends Array<Validator<unknown>>>(validators: V) {
+  return function (
+    value: unknown
+  ): value is V extends Array<Validator<infer ElementType>> ? ElementType : never {
+    for (const validator of validators) {
+      if (validator(value)) {
+        return true;
+      }
+    }
+    return false;
+  };
+}
+
+/**
+ * Validate that `value` is an array and that each of its elements matches `elementValidator`.
+ * Use this to create a predicate for an array type.
+ * ```
+ * import * as schema from './schema';
+ * const isAscOrDesc: (value: unknown) => value is 'asc' | 'desc' = schema.oneOf([
+ *   schema.literal('asc' as const),
+ *   schema.literal('desc' as const),
+ * ]);
+ * ```
+ */
+export function array<V extends Validator<unknown>>(elementValidator: V) {
+  return function (
+    value: unknown
+  ): value is Array<V extends Validator<infer ElementType> ? ElementType : never> {
+    if (Array.isArray(value)) {
+      for (const element of value as unknown[]) {
+        const result = elementValidator(element);
+        if (!result) {
+          return false;
+        }
+      }
+      return true;
+    }
+    return false;
+  };
+}
+
+/**
+ * The keys of `T` where `undefined` is assignable to the corresponding value.
+ * Used to figure out which keys could be made optional.
+ */
+type KeysWithOptionalValues<T extends { [key: string]: unknown }> = {
+  [K in keyof T]: undefined extends T[K] ? K : never;
+}[keyof T];
+
+/**
+ * `T` with required keys changed to optional if the corresponding value could be `undefined`.
+ * Converts a type like `{  key: number | undefined; requiredKey: string }` to a type like `{ key?: number | undefined; requiredKey: string }`
+ * This allows us to write object literals that omit a key if the value can accept `undefined`.
+ */
+type OptionalKeyWhenValueAcceptsUndefined<T extends { [key: string]: unknown }> = {
+  [K in Exclude<keyof T, KeysWithOptionalValues<T>>]: T[K];
+} &
+  {
+    [K in KeysWithOptionalValues<T>]?: Exclude<T[K], undefined>;
+  };
+
+/**
+ * Validate that `value` is an object with string keys. The value at each key is tested against its own validator.
+ *
+ * Use this to create a predicate for a type like `{ a: string[] }`. For example:
+ * ```ts
+ * import * as schema from './schema';
+ * const myValidator: (value: unknown) => value is { a: string[] } = schema.object({
+ *   a: schema.array(schema.string()),
+ * });
+ * ```
+ */
+export function object<
+  ValidatorDictionary extends {
+    [key: string]: Validator<unknown>;
+  }
+>(validatorDictionary: ValidatorDictionary) {
+  return function (
+    value: unknown
+  ): value is /** If a key can point to `undefined`, then instead make the key optional and exclude `undefined` from the value type. */ OptionalKeyWhenValueAcceptsUndefined<
+    {
+      [K in keyof ValidatorDictionary]: TypeOf<ValidatorDictionary[K]>;
+    }
+  > {
+    // This only validates non-null objects
+    if (typeof value !== 'object' || value === null) {
+      return false;
+    }
+
+    // Rebind value as the result type so that we can interrogate it
+    const trusted = value as { [K in keyof ValidatorDictionary]: TypeOf<ValidatorDictionary[K]> };
+
+    // Get each validator in the validator dictionary and use it to validate the corresponding value
+    for (const key of Object.keys(validatorDictionary)) {
+      const validator = validatorDictionary[key];
+      if (!validator(trusted[key])) {
+        return false;
+      }
+    }
+    return true;
+  };
+}
+
+/**
+ * Validate that `value` is strictly equal to `acceptedValue`.
+ * Use this for a literal type, for example:
+ * ```
+ * import * as schema from './schema';
+ * const isAscOrDesc: (value: unknown) => value is 'asc' | 'desc' = schema.oneOf([
+ *   schema.literal('asc' as const),
+ *   schema.literal('desc' as const),
+ * ]);
+ * ```
+ */
+export function literal<T>(acceptedValue: T) {
+  return function (value: unknown): value is T {
+    return acceptedValue === value;
+  };
+}
+
+/**
+ * Validate that `value` is a string.
+ * NB: this is used as `string` externally via named export.
+ * Usage:
+ * ```
+ * import * as schema from './schema';
+ * const isString: (value: unknown) => value is string = schema.string();
+ * ```
+ */
+function anyString(): (value: unknown) => value is string {
+  return function (value: unknown): value is string {
+    return typeof value === 'string';
+  };
+}
+
+/**
+ * Validate that `value` is a number.
+ * NB: this just checks if `typeof value === 'number'`. It will return `true` for `NaN`.
+ * NB: this is used as `number` externally via named export.
+ * Usage:
+ * ```
+ * import * as schema from './schema';
+ * const isNumber: (value: unknown) => value is number = schema.number();
+ * ```
+ */
+function anyNumber(): (value: unknown) => value is number {
+  return function (value: unknown): value is number {
+    return typeof value === 'number';
+  };
+}
+
+/**
+ * Export `anyString` as `string`. We can't define a function named `string`.
+ * Export `anyNumber` as `number`. We can't define a function named `number`.
+ */
+export { anyString as string, anyNumber as number };
diff --git a/x-pack/plugins/security_solution/public/resolver/store/actions.ts b/x-pack/plugins/security_solution/public/resolver/store/actions.ts
index 7d71cbd97b9ee..6a02d5b76bc4c 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/actions.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/actions.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { CameraAction } from './camera';
-import { ResolverEvent, SafeResolverEvent } from '../../../common/endpoint/types';
+import { ResolverEvent } from '../../../common/endpoint/types';
 import { DataAction } from './data/action';
 
 /**
@@ -88,19 +88,6 @@ interface UserSelectedResolverNode {
   readonly payload: string;
 }
 
-/**
- * This action should dispatch to indicate that the user chose to
- * focus on examining the related events of a particular ResolverEvent.
- * Optionally, this can be bound by a category of related events (e.g. 'file' or 'dns')
- */
-interface UserSelectedRelatedEventCategory {
-  readonly type: 'userSelectedRelatedEventCategory';
-  readonly payload: {
-    subject: SafeResolverEvent;
-    category?: string;
-  };
-}
-
 /**
  * Used by `useStateSyncingActions` hook.
  * This is dispatched when external sources provide new parameters for Resolver.
@@ -141,6 +128,5 @@ export type ResolverAction =
   | UserFocusedOnResolverNode
   | UserSelectedResolverNode
   | UserRequestedRelatedEventData
-  | UserSelectedRelatedEventCategory
   | AppDetectedNewIdFromQueryParams
   | AppDetectedMissingEventData;
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
index e647828ddb606..d714ddb181470 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
@@ -152,6 +152,7 @@ export const tree = createSelector(graphableProcesses, function indexedTree(
 
 /**
  * This returns a map of entity_ids to stats about the related events and alerts.
+ * @deprecated
  */
 export const relatedEventsStats: (
   state: DataState
@@ -189,6 +190,7 @@ export const relatedEventAggregateTotalByEntityId: (
 
 /**
  * returns a map of entity_ids to related event data.
+ * @deprecated
  */
 export function relatedEventsByEntityId(data: DataState): Map<string, ResolverRelatedEvents> {
   return data.relatedEvents;
@@ -205,6 +207,7 @@ export function relatedEventsByEntityId(data: DataState): Map<string, ResolverRe
  * {title: "a.b", description: "1"}, {title: "c", description: "d"}
  *
  * @param {object} obj The object to turn into `<dt><dd>` entries
+ * @deprecated
  */
 const objectToDescriptionListEntries = function* (
   obj: object,
@@ -232,6 +235,7 @@ const objectToDescriptionListEntries = function* (
 /**
  * Returns a function that returns the information needed to display related event details based on
  * the related event's entityID and its own ID.
+ * @deprecated
  */
 export const relatedEventDisplayInfoByEntityAndSelfID: (
   state: DataState
@@ -262,9 +266,8 @@ export const relatedEventDisplayInfoByEntityAndSelfID: (
     const countOfCategory = relatedEventsForThisProcess.events.reduce((sumtotal, evt) => {
       return eventModel.primaryEventCategory(evt) === specificCategory ? sumtotal + 1 : sumtotal;
     }, 0);
-
     // Assuming these details (agent, ecs, process) aren't as helpful, can revisit
-    const { agent, ecs, process, ...relevantData } = specificEvent as ResolverEvent & {
+    const { agent, ecs, process, ...relevantData } = specificEvent as SafeResolverEvent & {
       // Type this with various unknown keys so that ts will let us delete those keys
       ecs: unknown;
       process: unknown;
@@ -291,12 +294,13 @@ export const relatedEventDisplayInfoByEntityAndSelfID: (
 /**
  * Returns a function that returns a function (when supplied with an entity id for a node)
  * that returns related events for a node that match an event.category (when supplied with the category)
+ * @deprecated
  */
 export const relatedEventsByCategory: (
   state: DataState
 ) => (entityID: string) => (ecsCategory: string) => ResolverEvent[] = createSelector(
   relatedEventsByEntityId,
-  function provideGettersByCategory(
+  function (
     /* eslint-disable no-shadow */
     relatedEventsByEntityId
     /* eslint-enable no-shadow */
@@ -327,6 +331,7 @@ export const relatedEventsByCategory: (
 /**
  * returns a map of entity_ids to booleans indicating if it is waiting on related event
  * A value of `undefined` can be interpreted as `not yet requested`
+ * @deprecated
  */
 export function relatedEventsReady(data: DataState): Map<string, boolean> {
   return data.relatedEventsReady;
@@ -334,6 +339,7 @@ export function relatedEventsReady(data: DataState): Map<string, boolean> {
 
 /**
  * `true` if there were more children than we got in the last request.
+ * @deprecated
  */
 export function hasMoreChildren(state: DataState): boolean {
   const resolverTree = resolverTreeResponse(state);
@@ -342,6 +348,7 @@ export function hasMoreChildren(state: DataState): boolean {
 
 /**
  * `true` if there were more ancestors than we got in the last request.
+ * @deprecated
  */
 export function hasMoreAncestors(state: DataState): boolean {
   const resolverTree = resolverTreeResponse(state);
@@ -357,6 +364,7 @@ interface RelatedInfoFunctions {
  * A map of `entity_id`s to functions that provide information about
  * related events by ECS `.category` Primarily to avoid having business logic
  * in UI components.
+ * @deprecated
  */
 export const relatedEventInfoByEntityId: (
   state: DataState
diff --git a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
index 8ea0bc9199cb6..96b080206b61e 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
@@ -128,6 +128,7 @@ export const relatedEventAggregateTotalByEntityId: (
 
 /**
  * Map of related events... by entity id
+ * @deprecated
  */
 export const relatedEventsByEntityId = composeSelectors(
   dataStateSelector,
@@ -137,6 +138,7 @@ export const relatedEventsByEntityId = composeSelectors(
 /**
  * Returns a function that returns the information needed to display related event details based on
  * the related event's entityID and its own ID.
+ * @deprecated
  */
 export const relatedEventDisplayInfoByEntityAndSelfId = composeSelectors(
   dataStateSelector,
@@ -146,6 +148,7 @@ export const relatedEventDisplayInfoByEntityAndSelfId = composeSelectors(
 /**
  * Returns a function that returns a function (when supplied with an entity id for a node)
  * that returns related events for a node that match an event.category (when supplied with the category)
+ * @deprecated
  */
 export const relatedEventsByCategory = composeSelectors(
   dataStateSelector,
@@ -154,6 +157,7 @@ export const relatedEventsByCategory = composeSelectors(
 
 /**
  * Entity ids to booleans for waiting status
+ * @deprecated
  */
 export const relatedEventsReady = composeSelectors(
   dataStateSelector,
@@ -164,6 +168,7 @@ export const relatedEventsReady = composeSelectors(
  * Business logic lookup functions by ECS category by entity id.
  * Example usage:
  * const numberOfFileEvents = infoByEntityId.get(`someEntityId`)?.getAggregateTotalForCategory(`file`);
+ * @deprecated
  */
 export const relatedEventInfoByEntityId = composeSelectors(
   dataStateSelector,
@@ -241,6 +246,7 @@ const nodesAndEdgelines = composeSelectors(dataStateSelector, dataSelectors.node
 
 /**
  * Total count of related events for a process.
+ * @deprecated
  */
 export const relatedEventTotalForProcess = composeSelectors(
   dataStateSelector,
@@ -316,13 +322,27 @@ export const ariaFlowtoNodeID: (
   }
 );
 
+export const panelViewAndParameters = composeSelectors(
+  uiStateSelector,
+  uiSelectors.panelViewAndParameters
+);
+
+export const relativeHref = composeSelectors(uiStateSelector, uiSelectors.relativeHref);
+
+/**
+ * @deprecated
+ */
+export const relatedEventsRelativeHrefs = composeSelectors(
+  uiStateSelector,
+  uiSelectors.relatedEventsRelativeHrefs
+);
+
 /**
- * The legacy `crumbEvent` and `crumbId` parameters.
  * @deprecated
  */
-export const breadcrumbParameters = composeSelectors(
+export const relatedEventDetailHrefs = composeSelectors(
   uiStateSelector,
-  uiSelectors.breadcrumbParameters
+  uiSelectors.relatedEventDetailHrefs
 );
 
 /**
diff --git a/x-pack/plugins/security_solution/public/resolver/store/ui/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/ui/selectors.ts
index 5315ffb3c5fdb..6bc41832b92f2 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/ui/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/ui/selectors.ts
@@ -4,9 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { decode, encode } from 'rison-node';
+
 import { createSelector } from 'reselect';
-import { ResolverUIState } from '../../types';
-import * as locationSearchModel from '../../models/location_search';
+import { PanelViewAndParameters, ResolverUIState } from '../../types';
+import { ResolverEvent } from '../../../../common/endpoint/types';
+import { isPanelViewAndParameters } from '../../models/location_search';
+import { eventId } from '../../../../common/endpoint/models/event';
 
 /**
  * id of the "current" tree node (fake-focused)
@@ -31,20 +35,129 @@ export const selectedNode = createSelector(
 );
 
 /**
- * The legacy `crumbEvent` and `crumbId` parameters.
- * @deprecated
+ * Which view should show in the panel, as well as what parameters should be used.
+ * Calculated using the query string
  */
-export const breadcrumbParameters = createSelector(
+export const panelViewAndParameters = createSelector(
   (state: ResolverUIState) => state.locationSearch,
   (state: ResolverUIState) => state.resolverComponentInstanceID,
   (locationSearch, resolverComponentInstanceID) => {
     if (locationSearch === undefined || resolverComponentInstanceID === undefined) {
       // Equivalent to `null`
-      return {
-        crumbId: '',
-        crumbEvent: '',
-      };
+      return defaultParameters();
+    }
+    const urlSearchParams = new URLSearchParams(locationSearch);
+    const value = urlSearchParams.get(parameterName(resolverComponentInstanceID));
+    if (value === null) {
+      // Equivalent to `null`
+      return defaultParameters();
+    }
+    const decodedValue: unknown = decode(value);
+    if (isPanelViewAndParameters(decodedValue)) {
+      return decodedValue;
     }
-    return locationSearchModel.breadcrumbParameters(locationSearch, resolverComponentInstanceID);
+    return defaultParameters();
   }
 );
+
+/**
+ * Return a relative href (which includes just the 'search' part) that contains an encoded version of `params `.
+ * All other values in the 'search' will be kept.
+ * Use this to get an `href` for an anchor tag.
+ */
+export const relativeHref: (
+  state: ResolverUIState
+) => (params: PanelViewAndParameters) => string | undefined = createSelector(
+  (state: ResolverUIState) => state.locationSearch,
+  (state: ResolverUIState) => state.resolverComponentInstanceID,
+  (locationSearch, resolverComponentInstanceID) => {
+    return (params: PanelViewAndParameters) => {
+      /**
+       * This is only possible before the first `'appReceivedNewExternalProperties'` action is fired.
+       */
+      if (locationSearch === undefined || resolverComponentInstanceID === undefined) {
+        return undefined;
+      }
+      const urlSearchParams = new URLSearchParams(locationSearch);
+      const value = encode(params);
+      urlSearchParams.set(parameterName(resolverComponentInstanceID), value);
+      return `?${urlSearchParams.toString()}`;
+    };
+  }
+);
+
+/**
+ * Returns a map of ecs category name to urls for use in panel navigation.
+ * @deprecated
+ */
+export const relatedEventsRelativeHrefs: (
+  state: ResolverUIState
+) => (
+  categories: Record<string, number> | undefined,
+  nodeID: string
+) => Map<string, string | undefined> = createSelector(relativeHref, (relativeHref) => {
+  return (categories: Record<string, number> | undefined, nodeID: string) => {
+    const hrefsByCategory = new Map<string, string | undefined>();
+    if (categories !== undefined) {
+      Object.keys(categories).map((category) => {
+        const categoryPanelParams: PanelViewAndParameters = {
+          panelView: 'nodeEventsOfType',
+          panelParameters: {
+            nodeID,
+            eventType: category,
+          },
+        };
+        hrefsByCategory.set(category, relativeHref(categoryPanelParams));
+        return category;
+      });
+    }
+    return hrefsByCategory;
+  };
+});
+
+/**
+ * Returns a map of event entity ids to urls for use in navigation.
+ * @deprecated
+ */
+export const relatedEventDetailHrefs: (
+  state: ResolverUIState
+) => (
+  category: string,
+  nodeID: string,
+  events: ResolverEvent[]
+) => Map<string, string | undefined> = createSelector(relativeHref, (relativeHref) => {
+  return (category: string, nodeID: string, events: ResolverEvent[]) => {
+    const hrefsByEntityID = new Map<string, string | undefined>();
+    events.map((event) => {
+      const entityID = String(eventId(event));
+      const eventDetailPanelParams: PanelViewAndParameters = {
+        panelView: 'eventDetail',
+        panelParameters: {
+          nodeID,
+          eventType: category,
+          eventID: entityID,
+        },
+      };
+      hrefsByEntityID.set(entityID, relativeHref(eventDetailPanelParams));
+      return event;
+    });
+    return hrefsByEntityID;
+  };
+});
+
+/**
+ * The parameter name that we use to read/write state to the query string
+ */
+export function parameterName(resolverComponentInstanceID: string): string {
+  return `resolver-${resolverComponentInstanceID}`;
+}
+/**
+ * The default parameters to use when no (valid) location search is available.
+ */
+export function defaultParameters(): PanelViewAndParameters {
+  // Note, this really should be a selector. it needs to know about the state of the app so it can select
+  // the origin event.
+  return {
+    panelView: 'nodes',
+  };
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/test_utilities/url_search.ts b/x-pack/plugins/security_solution/public/resolver/test_utilities/url_search.ts
index 1a26e29d22da7..0792dae8928bd 100644
--- a/x-pack/plugins/security_solution/public/resolver/test_utilities/url_search.ts
+++ b/x-pack/plugins/security_solution/public/resolver/test_utilities/url_search.ts
@@ -4,23 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-interface Options {
-  /**
-   * The entity_id of the selected node.
-   */
-  selectedEntityID?: string;
-}
+import { encode } from 'rison-node';
+import { PanelViewAndParameters } from '../types';
 
 /**
  * Calculate the expected URL search based on options.
  */
-export function urlSearch(resolverComponentInstanceID: string, options?: Options): string {
+export function urlSearch(
+  resolverComponentInstanceID: string,
+  options?: PanelViewAndParameters
+): string {
   if (!options) {
     return '';
   }
   const params = new URLSearchParams();
-  if (options.selectedEntityID !== undefined) {
-    params.set(`resolver-${resolverComponentInstanceID}-id`, options.selectedEntityID);
-  }
+  params.set(`resolver-${resolverComponentInstanceID}`, encode(options));
   return params.toString();
 }
diff --git a/x-pack/plugins/security_solution/public/resolver/types.ts b/x-pack/plugins/security_solution/public/resolver/types.ts
index 1e7e2a8eba8a8..952a1c5764d8e 100644
--- a/x-pack/plugins/security_solution/public/resolver/types.ts
+++ b/x-pack/plugins/security_solution/public/resolver/types.ts
@@ -619,3 +619,81 @@ export interface ResolverPluginSetup {
     };
   };
 }
+
+/**
+ * Parameters to control what panel content is shown. Can be encoded and decoded from the URL using methods in
+ * `models/location_search`
+ */
+export type PanelViewAndParameters =
+  | {
+      /**
+       * The panel will show a index view (e.g. a list) of the nodes.
+       */
+      panelView: 'nodes';
+    }
+  | {
+      /**
+       * The panel will show the details of a single node.
+       */
+      panelView: 'nodeDetail';
+      panelParameters: {
+        /**
+         * The nodeID (e.g. `process.entity_id`) for the node that will be shown in detail
+         */
+        nodeID: string;
+      };
+    }
+  | {
+      /**
+       * The panel will show a index view of the all events related to a specific node.
+       * This may show a summary of aggregation of the events related to the node.
+       */
+      panelView: 'nodeEvents';
+      panelParameters: {
+        /**
+         * The nodeID (e.g. `process.entity_id`) for the node whose events will be shown.
+         */
+        nodeID: string;
+      };
+    }
+  | {
+      /**
+       * The panel will show an index view of the events related to a specific node. Only events with a specific type will be shown.
+       */
+      panelView: 'nodeEventsOfType';
+      panelParameters: {
+        /**
+         * The nodeID (e.g. `process.entity_id`) for the node whose events will be shown.
+         */
+        nodeID: string;
+        /**
+         * A parameter used to filter the events. For example, events that don't contain `eventType` in their `event.category` field may be hidden.
+         */
+        eventType: string;
+      };
+    }
+  | {
+      /**
+       * The panel will show details about a particular event. This is meant as a subview of 'nodeEventsOfType'.
+       */
+      panelView: 'eventDetail';
+      panelParameters: {
+        /**
+         * The nodeID (e.g. `process.entity_id`) for the node related to the event being shown.
+         */
+        nodeID: string;
+        /**
+         * A value used for the `nodeEventsOfType` view. Used to associate this view with a parent `nodeEventsOfType` view.
+         * e.g. The user views the `nodeEventsOfType` and follows a link to the `eventDetail` view. The `eventDetail` view can
+         * use `eventType` to populate breadcrumbs and allow the user to return to the previous filter.
+         *
+         * This cannot be inferred from the event itself, as an event may have any number of 'eventType's.
+         */
+        eventType: string;
+
+        /**
+         * `event.id` that uniquely identifies the event to show.
+         */
+        eventID: string;
+      };
+    };
diff --git a/x-pack/plugins/security_solution/public/resolver/view/assets.tsx b/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
index a066eb9421fc1..db4b514a6c748 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
@@ -12,9 +12,8 @@ import euiThemeAmsterdamLight from '@elastic/eui/dist/eui_theme_amsterdam_light.
 import { htmlIdGenerator, ButtonColor } from '@elastic/eui';
 import styled from 'styled-components';
 import { i18n } from '@kbn/i18n';
-import { useUiSetting } from '../../common/lib/kibana';
-import { DEFAULT_DARK_MODE as defaultDarkMode } from '../../../common/constants';
 import { ResolverProcessType } from '../types';
+import { useUiSetting } from '../../../../../../src/plugins/kibana_react/public';
 
 type ResolverColorNames =
   | 'descriptionText'
@@ -38,7 +37,7 @@ interface NodeStyleConfig {
   strokeColor: string;
 }
 
-export interface NodeStyleMap {
+interface NodeStyleMap {
   runningProcessCube: NodeStyleConfig;
   runningTriggerCube: NodeStyleConfig;
   terminatedProcessCube: NodeStyleConfig;
@@ -50,7 +49,7 @@ const idGenerator = htmlIdGenerator();
 /**
  * Ids of paint servers to be referenced by fill and stroke attributes
  */
-export const PaintServerIds = {
+const PaintServerIds = {
   runningProcessCube: idGenerator('psRunningProcessCube'),
   runningTriggerCube: idGenerator('psRunningTriggerCube'),
   terminatedProcessCube: idGenerator('psTerminatedProcessCube'),
@@ -385,7 +384,7 @@ const SymbolsAndShapes = memo(({ isDarkMode }: { isDarkMode: boolean }) => (
  *  3. `<use>` elements can be handled by compositor (faster)
  */
 const SymbolDefinitionsComponent = memo(({ className }: { className?: string }) => {
-  const isDarkMode = useUiSetting<boolean>(defaultDarkMode);
+  const isDarkMode = useUiSetting<boolean>('theme:darkMode');
   return (
     <svg className={className}>
       <defs>
@@ -421,7 +420,7 @@ export const useResolverTheme = (): {
   nodeAssets: NodeStyleMap;
   cubeAssetsForNode: (isProcessTerimnated: boolean, isProcessTrigger: boolean) => NodeStyleConfig;
 } => {
-  const isDarkMode = useUiSetting<boolean>(defaultDarkMode);
+  const isDarkMode = useUiSetting('theme:darkMode');
   const theme = isDarkMode ? euiThemeAmsterdamDark : euiThemeAmsterdamLight;
 
   const getThemedOption = (lightOption: string, darkOption: string): string => {
@@ -429,7 +428,7 @@ export const useResolverTheme = (): {
   };
 
   const colorMap = {
-    descriptionText: theme.euiColorDarkestShade,
+    descriptionText: theme.euiTextColor,
     full: theme.euiColorFullShade,
     graphControls: theme.euiColorDarkestShade,
     graphControlsBackground: theme.euiColorEmptyShade,
diff --git a/x-pack/plugins/security_solution/public/resolver/view/clickthrough.test.tsx b/x-pack/plugins/security_solution/public/resolver/view/clickthrough.test.tsx
index 223ce728f4267..935e565be039e 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/clickthrough.test.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/clickthrough.test.tsx
@@ -177,7 +177,7 @@ describe('Resolver, when analyzing a tree that has no ancestors and 2 children',
         );
         // Click the second child node's primary button
         if (button) {
-          button.simulate('click');
+          button.simulate('click', { button: 0 });
         }
       });
       it('should render the second child node as selected, and the origin as not selected, and the query string should indicate that the second child is selected', async () => {
@@ -194,7 +194,8 @@ describe('Resolver, when analyzing a tree that has no ancestors and 2 children',
         ).toYieldEqualTo({
           // Just the second child should be marked as selected in the query string
           search: urlSearch(resolverComponentInstanceID, {
-            selectedEntityID: entityIDs.secondChild,
+            panelParameters: { nodeID: entityIDs.secondChild },
+            panelView: 'nodeDetail',
           }),
           // The second child is rendered and has `[aria-selected]`
           selectedSecondChildNodeCount: 1,
@@ -291,7 +292,7 @@ describe('Resolver, when analyzing a tree that has two related events for the or
           simulator.processNodeSubmenuButton(entityIDs.origin)
         );
         if (button) {
-          button.simulate('click');
+          button.simulate('click', { button: 0 });
         }
       });
       it('should open the submenu and display exactly one option with the correct count', async () => {
@@ -308,8 +309,8 @@ describe('Resolver, when analyzing a tree that has two related events for the or
           simulator.processNodeSubmenuButton(entityIDs.origin)
         );
         if (button) {
-          button.simulate('click');
-          button.simulate('click'); // The first click opened the menu, this second click closes it
+          button.simulate('click', { button: 0 });
+          button.simulate('click', { button: 0 }); // The first click opened the menu, this second click closes it
         }
       });
       it('should close the submenu', async () => {
diff --git a/x-pack/plugins/security_solution/public/resolver/view/limit_warnings.tsx b/x-pack/plugins/security_solution/public/resolver/view/limit_warnings.tsx
index e3bad8ee2e574..3f2b7c769cad7 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/limit_warnings.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/limit_warnings.tsx
@@ -1,126 +1,118 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { EuiCallOut } from '@elastic/eui';
-import { FormattedMessage } from 'react-intl';
-
-const lineageLimitMessage = (
-  <>
-    <FormattedMessage
-      id="xpack.securitySolution.endpoint.resolver.eitherLineageLimitExceeded"
-      defaultMessage="Some process events in the visualization and event list below could not be displayed because the data limit has been reached."
-    />
-  </>
-);
-
-const LineageTitleMessage = React.memo(function LineageTitleMessage({
-  numberOfEntries,
-}: {
-  numberOfEntries: number;
-}) {
-  return (
-    <>
-      <FormattedMessage
-        id="xpack.securitySolution.endpoint.resolver.relatedEventLimitTitle"
-        defaultMessage="This list includes {numberOfEntries} process events."
-        values={{ numberOfEntries }}
-      />
-    </>
-  );
-});
-
-const RelatedEventsLimitMessage = React.memo(function RelatedEventsLimitMessage({
-  category,
-  numberOfEventsMissing,
-}: {
-  numberOfEventsMissing: number;
-  category: string;
-}) {
-  return (
-    <>
-      <FormattedMessage
-        id="xpack.securitySolution.endpoint.resolver.relatedEventLimitExceeded"
-        defaultMessage="{numberOfEventsMissing} {category} events could not be displayed because the data limit has been reached."
-        values={{ numberOfEventsMissing, category }}
-      />
-    </>
-  );
-});
-
-const RelatedLimitTitleMessage = React.memo(function RelatedLimitTitleMessage({
-  category,
-  numberOfEventsDisplayed,
-}: {
-  numberOfEventsDisplayed: number;
-  category: string;
-}) {
-  return (
-    <>
-      <FormattedMessage
-        id="xpack.securitySolution.endpoint.resolver.relatedLimitsExceededTitle"
-        defaultMessage="This list includes {numberOfEventsDisplayed} {category} events."
-        values={{ numberOfEventsDisplayed, category }}
-      />
-    </>
-  );
-});
-
-/**
- * Limit warning for hitting the /events API limit
- */
-export const RelatedEventLimitWarning = React.memo(function RelatedEventLimitWarning({
-  className,
-  eventType,
-  numberActuallyDisplayed,
-  numberMissing,
-}: {
-  className?: string;
-  eventType: string;
-  numberActuallyDisplayed: number;
-  numberMissing: number;
-}) {
-  /**
-   * Based on API limits, all related events may not be displayed.
-   */
-  return (
-    <EuiCallOut
-      size="s"
-      className={className}
-      title={
-        <RelatedLimitTitleMessage
-          category={eventType}
-          numberOfEventsDisplayed={numberActuallyDisplayed}
-        />
-      }
-    >
-      <p>
-        <RelatedEventsLimitMessage category={eventType} numberOfEventsMissing={numberMissing} />
-      </p>
-    </EuiCallOut>
-  );
-});
-
-/**
- * Limit warning for hitting a limit of nodes in the tree
- */
-export const LimitWarning = React.memo(function LimitWarning({
-  className,
-  numberDisplayed,
-}: {
-  className?: string;
-  numberDisplayed: number;
-}) {
-  return (
-    <EuiCallOut
-      size="s"
-      className={className}
-      title={<LineageTitleMessage numberOfEntries={numberDisplayed} />}
-    >
-      <p>{lineageLimitMessage}</p>
-    </EuiCallOut>
-  );
-});
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { EuiCallOut } from '@elastic/eui';
+import { FormattedMessage } from 'react-intl';
+
+const lineageLimitMessage = (
+  <FormattedMessage
+    id="xpack.securitySolution.endpoint.resolver.eitherLineageLimitExceeded"
+    defaultMessage="Some process events in the visualization and event list below could not be displayed because the data limit has been reached."
+  />
+);
+
+const LineageTitleMessage = React.memo(function LineageTitleMessage({
+  numberOfEntries,
+}: {
+  numberOfEntries: number;
+}) {
+  return (
+    <FormattedMessage
+      id="xpack.securitySolution.endpoint.resolver.relatedEventLimitTitle"
+      defaultMessage="This list includes {numberOfEntries} process events."
+      values={{ numberOfEntries }}
+    />
+  );
+});
+
+const RelatedEventsLimitMessage = React.memo(function RelatedEventsLimitMessage({
+  category,
+  numberOfEventsMissing,
+}: {
+  numberOfEventsMissing: number;
+  category: string;
+}) {
+  return (
+    <FormattedMessage
+      id="xpack.securitySolution.endpoint.resolver.relatedEventLimitExceeded"
+      defaultMessage="{numberOfEventsMissing} {category} events could not be displayed because the data limit has been reached."
+      values={{ numberOfEventsMissing, category }}
+    />
+  );
+});
+
+const RelatedLimitTitleMessage = React.memo(function RelatedLimitTitleMessage({
+  category,
+  numberOfEventsDisplayed,
+}: {
+  numberOfEventsDisplayed: number;
+  category: string;
+}) {
+  return (
+    <FormattedMessage
+      id="xpack.securitySolution.endpoint.resolver.relatedLimitsExceededTitle"
+      defaultMessage="This list includes {numberOfEventsDisplayed} {category} events."
+      values={{ numberOfEventsDisplayed, category }}
+    />
+  );
+});
+
+/**
+ * Limit warning for hitting the /events API limit
+ */
+export const RelatedEventLimitWarning = React.memo(function RelatedEventLimitWarning({
+  className,
+  eventType,
+  numberActuallyDisplayed,
+  numberMissing,
+}: {
+  className?: string;
+  eventType: string;
+  numberActuallyDisplayed: number;
+  numberMissing: number;
+}) {
+  /**
+   * Based on API limits, all related events may not be displayed.
+   */
+  return (
+    <EuiCallOut
+      size="s"
+      className={className}
+      title={
+        <RelatedLimitTitleMessage
+          category={eventType}
+          numberOfEventsDisplayed={numberActuallyDisplayed}
+        />
+      }
+    >
+      <p>
+        <RelatedEventsLimitMessage category={eventType} numberOfEventsMissing={numberMissing} />
+      </p>
+    </EuiCallOut>
+  );
+});
+
+/**
+ * Limit warning for hitting a limit of nodes in the tree
+ */
+export const LimitWarning = React.memo(function LimitWarning({
+  className,
+  numberDisplayed,
+}: {
+  className?: string;
+  numberDisplayed: number;
+}) {
+  return (
+    <EuiCallOut
+      size="s"
+      className={className}
+      title={<LineageTitleMessage numberOfEntries={numberDisplayed} />}
+    >
+      <p>{lineageLimitMessage}</p>
+    </EuiCallOut>
+  );
+});
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panel.test.tsx b/x-pack/plugins/security_solution/public/resolver/view/panel.test.tsx
index 7021e476e6439..7cfbd9a794669 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panel.test.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panel.test.tsx
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
 import { createMemoryHistory, History as HistoryPackageHistoryInterface } from 'history';
 
 import { noAncestorsTwoChildren } from '../data_access_layer/mocks/no_ancestors_two_children';
@@ -61,7 +60,8 @@ describe(`Resolver: when analyzing a tree with no ancestors and two children, an
   });
 
   const queryStringWithOriginSelected = urlSearch(resolverComponentInstanceID, {
-    selectedEntityID: 'origin',
+    panelParameters: { nodeID: 'origin' },
+    panelView: 'nodeDetail',
   });
 
   describe(`when the URL query string is ${queryStringWithOriginSelected}`, () => {
@@ -111,7 +111,8 @@ describe(`Resolver: when analyzing a tree with no ancestors and two children, an
   });
 
   const queryStringWithFirstChildSelected = urlSearch(resolverComponentInstanceID, {
-    selectedEntityID: 'firstChild',
+    panelParameters: { nodeID: 'firstChild' },
+    panelView: 'nodeDetail',
   });
 
   describe(`when the URL query string is ${queryStringWithFirstChildSelected}`, () => {
@@ -135,6 +136,14 @@ describe(`Resolver: when analyzing a tree with no ancestors and two children, an
     });
   });
 
+  it('should show a single analyzed event in the node list', async () => {
+    await expect(
+      simulator().map(
+        () => simulator().testSubject('resolver:node-list:node-link:analyzed-event').length
+      )
+    ).toYieldEqualTo(1);
+  });
+
   it('should have 3 nodes (with icons) in the node list', async () => {
     await expect(
       simulator().map(() => simulator().testSubject('resolver:node-list:node-link:title').length)
@@ -149,7 +158,7 @@ describe(`Resolver: when analyzing a tree with no ancestors and two children, an
       const nodeLinks = await simulator().resolve('resolver:node-list:node-link:title');
       expect(nodeLinks).toBeTruthy();
       if (nodeLinks) {
-        nodeLinks.first().simulate('click');
+        nodeLinks.first().simulate('click', { button: 0 });
       }
     });
     it('should show the details for the first node', async () => {
@@ -168,7 +177,10 @@ describe(`Resolver: when analyzing a tree with no ancestors and two children, an
     it("should have the first node's ID in the query string", async () => {
       await expect(simulator().map(() => simulator().historyLocationSearch)).toYieldEqualTo(
         urlSearch(resolverComponentInstanceID, {
-          selectedEntityID: entityIDs.origin,
+          panelView: 'nodeDetail',
+          panelParameters: {
+            nodeID: entityIDs.origin,
+          },
         })
       );
     });
@@ -178,7 +190,7 @@ describe(`Resolver: when analyzing a tree with no ancestors and two children, an
           'resolver:node-detail:breadcrumbs:node-list-link'
         );
         if (nodeListLink) {
-          nodeListLink.simulate('click');
+          nodeListLink.simulate('click', { button: 0 });
         }
       });
       it('should show the list of nodes with links to each node', async () => {
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/cube_for_process.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/cube_for_process.tsx
index b7c8ed0dfd7db..deddd17198229 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/cube_for_process.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/cube_for_process.tsx
@@ -11,13 +11,19 @@ import { i18n } from '@kbn/i18n';
 /* eslint-disable react/display-name */
 
 import React, { memo } from 'react';
-import { useResolverTheme } from '../assets';
+import { useResolverTheme, SymbolIds } from '../assets';
+
+interface StyledSVGCube {
+  readonly isOrigin?: boolean;
+}
 
 /**
  * Icon representing a process node.
  */
 export const CubeForProcess = memo(function ({
+  className,
   running,
+  isOrigin,
   'data-test-subj': dataTestSubj,
 }: {
   'data-test-subj'?: string;
@@ -25,25 +31,46 @@ export const CubeForProcess = memo(function ({
    * True if the process represented by the node is still running.
    */
   running: boolean;
+  isOrigin?: boolean;
+  className?: string;
 }) {
   const { cubeAssetsForNode } = useResolverTheme();
-  const { cubeSymbol } = cubeAssetsForNode(!running, false);
+  const { cubeSymbol, strokeColor } = cubeAssetsForNode(!running, false);
 
   return (
-    <StyledSVG width="1.5em" height="1.5em" viewBox="0 0 1 1" data-test-subj={dataTestSubj}>
+    <StyledSVG
+      className={className}
+      width="2.15em"
+      height="2.15em"
+      viewBox="0 0 100% 100%"
+      data-test-subj={dataTestSubj}
+      isOrigin={isOrigin}
+    >
       <desc>
         {i18n.translate('xpack.securitySolution.resolver.node_icon', {
           defaultMessage: '{running, select, true {Running Process} false {Terminated Process}}',
           values: { running },
         })}
       </desc>
+      {isOrigin && (
+        <use
+          xlinkHref={`#${SymbolIds.processCubeActiveBacking}`}
+          fill="transparent"
+          x={0}
+          y={-1}
+          stroke={strokeColor}
+          strokeDashoffset={0}
+          width="100%"
+          height="100%"
+        />
+      )}
       <use
         role="presentation"
         xlinkHref={cubeSymbol}
-        x={0}
-        y={0}
-        width={1}
-        height={1}
+        x={5.25}
+        y={4.25}
+        width="70%"
+        height="70%"
         opacity="1"
         className="cube"
       />
@@ -51,8 +78,6 @@ export const CubeForProcess = memo(function ({
   );
 });
 
-const StyledSVG = styled.svg`
-  position: relative;
-  top: 0.4em;
-  margin-right: 0.25em;
+const StyledSVG = styled.svg<StyledSVGCube>`
+  margin-right: ${(props) => (props.isOrigin ? '0.15em' : 0)};
 `;
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/related_event_detail.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/event_detail.tsx
similarity index 77%
rename from x-pack/plugins/security_solution/public/resolver/view/panels/related_event_detail.tsx
rename to x-pack/plugins/security_solution/public/resolver/view/panels/event_detail.tsx
index 4762c615ba793..24d2a4a8f43f0 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/related_event_detail.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/event_detail.tsx
@@ -10,14 +10,15 @@ import { EuiSpacer, EuiText, EuiDescriptionList, EuiTextColor, EuiTitle } from '
 import styled from 'styled-components';
 import { useSelector } from 'react-redux';
 import { FormattedMessage } from 'react-intl';
+import { StyledPanel } from '../styles';
 import { StyledBreadcrumbs, BoldCode, StyledTime, GeneratedText } from './panel_content_utilities';
 import * as event from '../../../../common/endpoint/models/event';
-import { ResolverEvent } from '../../../../common/endpoint/types';
 import * as selectors from '../../store/selectors';
 import { useResolverDispatch } from '../use_resolver_dispatch';
 import { PanelContentError } from './panel_content_error';
+import { PanelLoading } from './panel_loading';
 import { ResolverState } from '../../types';
-import { useReplaceBreadcrumbParameters } from '../use_replace_breadcrumb_parameters';
+import { useNavigateOrReplace } from '../use_navigate_or_replace';
 
 // Adding some styles to prevent horizontal scrollbars, per request from UX review
 const StyledDescriptionList = memo(styled(EuiDescriptionList)`
@@ -77,17 +78,26 @@ function entriesForDisplay(entries: Array<{ title: string; description: string }
  * This view presents a detailed view of all the available data for a related event, split and titled by the "section"
  * it appears in the underlying ResolverEvent
  */
-export const RelatedEventDetail = memo(function ({
-  relatedEventId,
-  parentEvent,
-  countForParent,
+export const EventDetail = memo(function ({
+  nodeID,
+  eventID,
 }: {
-  relatedEventId: string;
-  parentEvent: ResolverEvent;
-  countForParent: number | undefined;
+  nodeID: string;
+  eventID: string;
 }) {
+  const parentEvent = useSelector((state: ResolverState) =>
+    selectors.processEventForID(state)(nodeID)
+  );
+
+  const relatedEventsStats = useSelector((state: ResolverState) =>
+    selectors.relatedEventsStats(state)(nodeID)
+  );
+  const countForParent: number = Object.values(relatedEventsStats?.events.byCategory || {}).reduce(
+    (sum, val) => sum + val,
+    0
+  );
   const processName = (parentEvent && event.eventName(parentEvent)) || '*';
-  const processEntityId = parentEvent && event.entityId(parentEvent);
+  const processEntityId = (parentEvent && event.entityId(parentEvent)) || '';
   const totalCount = countForParent || 0;
   const eventsString = i18n.translate(
     'xpack.securitySolution.endpoint.resolver.panel.relatedEventDetail.events',
@@ -105,13 +115,23 @@ export const RelatedEventDetail = memo(function ({
   const relatedsReadyMap = useSelector(selectors.relatedEventsReady);
   const relatedsReady = relatedsReadyMap.get(processEntityId!);
   const dispatch = useResolverDispatch();
+  const nodesHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({ panelView: 'nodes' })
+  );
+  const nodesLinkNavProps = useNavigateOrReplace({
+    search: nodesHref,
+  });
 
   /**
    * If we don't have the related events for the parent yet, use this effect
    * to request them.
    */
   useEffect(() => {
-    if (typeof relatedsReady === 'undefined') {
+    if (
+      typeof relatedsReady === 'undefined' &&
+      processEntityId !== null &&
+      processEntityId !== undefined
+    ) {
       dispatch({
         type: 'appDetectedMissingEventData',
         payload: processEntityId,
@@ -126,38 +146,51 @@ export const RelatedEventDetail = memo(function ({
     sections,
     formattedDate,
   ] = useSelector((state: ResolverState) =>
-    selectors.relatedEventDisplayInfoByEntityAndSelfId(state)(processEntityId, relatedEventId)
+    selectors.relatedEventDisplayInfoByEntityAndSelfId(state)(nodeID, eventID)
   );
 
-  const pushToQueryParams = useReplaceBreadcrumbParameters();
-
-  const waitCrumbs = useMemo(() => {
-    return [
-      {
-        text: eventsString,
-        onClick: () => {
-          pushToQueryParams({ crumbId: '', crumbEvent: '' });
-        },
-      },
-    ];
-  }, [pushToQueryParams, eventsString]);
-
   const { subject = '', descriptor = '' } = relatedEventToShowDetailsFor
     ? event.descriptiveName(relatedEventToShowDetailsFor)
     : {};
+
+  const nodeDetailHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({
+      panelView: 'nodeDetail',
+      panelParameters: { nodeID: processEntityId },
+    })
+  );
+  const nodeDetailLinkNavProps = useNavigateOrReplace({
+    search: nodeDetailHref,
+  });
+
+  const nodeEventsHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({
+      panelView: 'nodeEvents',
+      panelParameters: { nodeID: processEntityId },
+    })
+  );
+  const nodeEventsLinkNavProps = useNavigateOrReplace({
+    search: nodeEventsHref,
+  });
+
+  const nodeEventsOfTypeHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({
+      panelView: 'nodeEventsOfType',
+      panelParameters: { nodeID: processEntityId, eventType: relatedEventCategory },
+    })
+  );
+  const nodeEventsOfTypeLinkNavProps = useNavigateOrReplace({
+    search: nodeEventsOfTypeHref,
+  });
   const crumbs = useMemo(() => {
     return [
       {
         text: eventsString,
-        onClick: () => {
-          pushToQueryParams({ crumbId: '', crumbEvent: '' });
-        },
+        ...nodesLinkNavProps,
       },
       {
         text: processName,
-        onClick: () => {
-          pushToQueryParams({ crumbId: processEntityId!, crumbEvent: '' });
-        },
+        ...nodeDetailLinkNavProps,
       },
       {
         text: (
@@ -169,9 +202,7 @@ export const RelatedEventDetail = memo(function ({
             />
           </>
         ),
-        onClick: () => {
-          pushToQueryParams({ crumbId: processEntityId!, crumbEvent: 'all' });
-        },
+        ...nodeEventsLinkNavProps,
       },
       {
         text: (
@@ -183,12 +214,7 @@ export const RelatedEventDetail = memo(function ({
             />
           </>
         ),
-        onClick: () => {
-          pushToQueryParams({
-            crumbId: processEntityId!,
-            crumbEvent: relatedEventCategory || 'all',
-          });
-        },
+        ...nodeEventsOfTypeLinkNavProps,
       },
       {
         text: relatedEventToShowDetailsFor ? (
@@ -205,9 +231,7 @@ export const RelatedEventDetail = memo(function ({
     ];
   }, [
     processName,
-    processEntityId,
     eventsString,
-    pushToQueryParams,
     totalCount,
     countBySameCategory,
     naString,
@@ -215,27 +239,14 @@ export const RelatedEventDetail = memo(function ({
     relatedEventToShowDetailsFor,
     subject,
     descriptor,
+    nodeEventsOfTypeLinkNavProps,
+    nodeEventsLinkNavProps,
+    nodeDetailLinkNavProps,
+    nodesLinkNavProps,
   ]);
 
-  /**
-   * If the ship hasn't come in yet, wait on the dock
-   */
   if (!relatedsReady) {
-    const waitingString = i18n.translate(
-      'xpack.securitySolution.endpoint.resolver.panel.relatedDetail.wait',
-      {
-        defaultMessage: 'Waiting For Events...',
-      }
-    );
-    return (
-      <>
-        <StyledBreadcrumbs breadcrumbs={waitCrumbs} />
-        <EuiSpacer size="l" />
-        <EuiTitle>
-          <h4>{waitingString}</h4>
-        </EuiTitle>
-      </>
-    );
+    return <PanelLoading />;
   }
 
   /**
@@ -252,7 +263,7 @@ export const RelatedEventDetail = memo(function ({
   }
 
   return (
-    <>
+    <StyledPanel>
       <StyledBreadcrumbs breadcrumbs={crumbs} />
       <EuiSpacer size="l" />
       <EuiText size="s">
@@ -310,6 +321,6 @@ export const RelatedEventDetail = memo(function ({
           </Fragment>
         );
       })}
-    </>
+    </StyledPanel>
   );
 });
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/index.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/index.tsx
index 133dcd21e7f56..da5cb1acfed6d 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/index.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/index.tsx
@@ -4,216 +4,46 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { memo, useMemo, useContext, useLayoutEffect, useState } from 'react';
+/* eslint-disable react/display-name */
+
+import React, { memo } from 'react';
 import { useSelector } from 'react-redux';
-import { EuiPanel } from '@elastic/eui';
 import * as selectors from '../../store/selectors';
-import { useResolverDispatch } from '../use_resolver_dispatch';
-import * as event from '../../../../common/endpoint/models/event';
-import { ResolverEvent, ResolverNodeStats } from '../../../../common/endpoint/types';
-import { SideEffectContext } from '../side_effect_context';
-import { ProcessEventList } from './process_event_list';
-import { EventCountsForProcess } from './event_counts_for_process';
-import { ProcessDetails } from './process_details';
-import { ProcessListWithCounts } from './process_list_with_counts';
-import { RelatedEventDetail } from './related_event_detail';
-import { ResolverState } from '../../types';
+import { NodeEventsOfType } from './node_events_of_type';
+import { NodeEvents } from './node_events';
+import { NodeDetail } from './node_details';
+import { NodeList } from './node_list';
+import { EventDetail } from './event_detail';
+import { PanelViewAndParameters } from '../../types';
 
 /**
- * The team decided to use this table to determine which breadcrumbs/view to display:
- *
- * | Crumb/Table            | &crumbId                   | &crumbEvent              |
- * | :--------------------- | :------------------------- | :----------------------  |
- * | all processes/default  | null                       | null                     |
- * | process detail         | entity_id of process       | null                     |
- * | relateds count by type | entity_id of process       | 'all'                    |
- * | relateds list 1 type   | entity_id of process       | valid related event type |
- * | related event detail   | event_id of related event  | entity_id of process     |
  *
  * This component implements the strategy laid out above by determining the "right" view and doing some other housekeeping e.g. effects to keep the UI-selected node in line with what's indicated by the URL parameters.
  *
  * @returns {JSX.Element} The "right" table content to show based on the query params as described above
  */
-const PanelContent = memo(function PanelContent() {
-  const dispatch = useResolverDispatch();
-
-  const { timestamp } = useContext(SideEffectContext);
-
-  const queryParams = useSelector(selectors.breadcrumbParameters);
-
-  const graphableProcesses = useSelector(selectors.graphableProcesses);
-  const graphableProcessEntityIds = useMemo(() => {
-    return new Set(graphableProcesses.map(event.entityId));
-  }, [graphableProcesses]);
-  // The entity id in query params of a graphable process (or false if none is found)
-  // For 1 case (the related detail, see below), the process id will be in crumbEvent instead of crumbId
-  const idFromParams = useMemo(() => {
-    if (graphableProcessEntityIds.has(queryParams.crumbId)) {
-      return queryParams.crumbId;
-    }
-    if (graphableProcessEntityIds.has(queryParams.crumbEvent)) {
-      return queryParams.crumbEvent;
-    }
-    return '';
-  }, [queryParams, graphableProcessEntityIds]);
-
-  // The "selected" node (and its corresponding event) in the tree control.
-  // It may need to be synchronized with the ID indicated as selected via the `idFromParams`
-  // memo above. When this is the case, it is handled by the layout effect below.
-  const selectedNode = useSelector(selectors.selectedNode);
-  const uiSelectedEvent = useMemo(() => {
-    return graphableProcesses.find((evt) => event.entityId(evt) === selectedNode);
-  }, [graphableProcesses, selectedNode]);
-
-  // Until an event is dispatched during update, the event indicated as selected by params may
-  // be different than the one in state.
-  const paramsSelectedEvent = useMemo(() => {
-    return graphableProcesses.find((evt) => event.entityId(evt) === idFromParams);
-  }, [graphableProcesses, idFromParams]);
-
-  const [lastUpdatedProcess, setLastUpdatedProcess] = useState<null | ResolverEvent>(null);
-
-  /**
-   * When the ui-selected node is _not_ the one indicated by the query params, but the id from params _is_ in the current tree,
-   * dispatch a selection action to amend the UI state to hold the query id as "selected".
-   * This is to cover cases where users e.g. share links to reconstitute a Resolver state or
-   * an effect pushes a new process id to the query params.
-   */
-  useLayoutEffect(() => {
-    if (
-      paramsSelectedEvent &&
-      // Check state to ensure we don't dispatch this in a way that causes unnecessary re-renders, or disrupts animation:
-      paramsSelectedEvent !== lastUpdatedProcess &&
-      paramsSelectedEvent !== uiSelectedEvent
-    ) {
-      setLastUpdatedProcess(paramsSelectedEvent);
-      dispatch({
-        type: 'appDetectedNewIdFromQueryParams',
-        payload: {
-          time: timestamp(),
-          process: paramsSelectedEvent,
-        },
-      });
-    }
-  }, [dispatch, uiSelectedEvent, paramsSelectedEvent, lastUpdatedProcess, timestamp]);
-
-  const relatedEventStats = useSelector(selectors.relatedEventsStats);
-  const { crumbId, crumbEvent } = queryParams;
-  const relatedStatsForIdFromParams: ResolverNodeStats | undefined = idFromParams
-    ? relatedEventStats(idFromParams)
-    : undefined;
-
-  const parentCount = useSelector((state: ResolverState) => {
-    if (idFromParams === '') {
-      return 0;
-    }
-    return selectors.relatedEventAggregateTotalByEntityId(state)(idFromParams);
-  });
-  /**
-   * Determine which set of breadcrumbs to display based on the query parameters
-   * for the table & breadcrumb nav.
-   *
-   */
-  const panelToShow = useMemo(() => {
-    if (crumbEvent === '' && crumbId === '') {
-      /**
-       * | Crumb/Table            | &crumbId                   | &crumbEvent              |
-       * | :--------------------- | :------------------------- | :----------------------  |
-       * | all processes/default  | null                       | null                     |
-       */
-      return 'processListWithCounts';
-    }
-
-    if (graphableProcessEntityIds.has(crumbId)) {
-      /**
-       * | Crumb/Table            | &crumbId                   | &crumbEvent              |
-       * | :--------------------- | :------------------------- | :----------------------  |
-       * | process detail         | entity_id of process       | null                     |
-       */
-      if (crumbEvent === '' && uiSelectedEvent) {
-        return 'processDetails';
-      }
-
-      /**
-       * | Crumb/Table            | &crumbId                   | &crumbEvent              |
-       * | :--------------------- | :------------------------- | :----------------------  |
-       * | relateds count by type | entity_id of process       | 'all'                    |
-       */
-
-      if (crumbEvent === 'all' && uiSelectedEvent) {
-        return 'eventCountsForProcess';
-      }
-
-      /**
-       * | Crumb/Table            | &crumbId                   | &crumbEvent              |
-       * | :--------------------- | :------------------------- | :----------------------  |
-       * | relateds list 1 type   | entity_id of process       | valid related event type |
-       */
-
-      if (crumbEvent && crumbEvent.length && uiSelectedEvent) {
-        return 'processEventList';
-      }
-    }
-
-    if (graphableProcessEntityIds.has(crumbEvent)) {
-      /**
-       * | Crumb/Table            | &crumbId                   | &crumbEvent              |
-       * | :--------------------- | :------------------------- | :----------------------  |
-       * | related event detail   | event_id of related event  | entity_id of process     |
-       */
-      return 'relatedEventDetail';
-    }
-
-    // The default 'Event List' / 'List of all processes' view
-    return 'processListWithCounts';
-  }, [uiSelectedEvent, crumbEvent, crumbId, graphableProcessEntityIds]);
-
-  const panelInstance = useMemo(() => {
-    if (panelToShow === 'processDetails') {
-      return <ProcessDetails processEvent={uiSelectedEvent!} />;
-    }
-
-    if (panelToShow === 'eventCountsForProcess') {
-      return (
-        <EventCountsForProcess
-          processEvent={uiSelectedEvent!}
-          relatedStats={relatedStatsForIdFromParams!}
-        />
-      );
-    }
-
-    if (panelToShow === 'processEventList') {
-      return (
-        <ProcessEventList
-          processEvent={uiSelectedEvent!}
-          relatedStats={relatedStatsForIdFromParams!}
-          eventType={crumbEvent}
-        />
-      );
-    }
-
-    if (panelToShow === 'relatedEventDetail') {
-      return (
-        <RelatedEventDetail
-          relatedEventId={crumbId}
-          parentEvent={uiSelectedEvent!}
-          countForParent={parentCount}
-        />
-      );
-    }
-    // The default 'Event List' / 'List of all processes' view
-    return <ProcessListWithCounts />;
-  }, [uiSelectedEvent, crumbEvent, crumbId, relatedStatsForIdFromParams, panelToShow, parentCount]);
-
-  return <>{panelInstance}</>;
-});
-PanelContent.displayName = 'PanelContent';
-
-export const Panel = memo(function Event({ className }: { className?: string }) {
-  return (
-    <EuiPanel className={className}>
-      <PanelContent />
-    </EuiPanel>
-  );
+export const PanelRouter = memo(function () {
+  const params: PanelViewAndParameters = useSelector(selectors.panelViewAndParameters);
+  if (params.panelView === 'nodeDetail') {
+    return <NodeDetail nodeID={params.panelParameters.nodeID} />;
+  } else if (params.panelView === 'nodeEvents') {
+    return <NodeEvents nodeID={params.panelParameters.nodeID} />;
+  } else if (params.panelView === 'nodeEventsOfType') {
+    return (
+      <NodeEventsOfType
+        nodeID={params.panelParameters.nodeID}
+        eventType={params.panelParameters.eventType}
+      />
+    );
+  } else if (params.panelView === 'eventDetail') {
+    return (
+      <EventDetail
+        nodeID={params.panelParameters.nodeID}
+        eventID={params.panelParameters.eventID}
+      />
+    );
+  } else {
+    /* The default 'Event List' / 'List of all processes' view */
+    return <NodeList />;
+  }
 });
-Panel.displayName = 'Panel';
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/process_details.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/node_details.tsx
similarity index 77%
rename from x-pack/plugins/security_solution/public/resolver/view/panels/process_details.tsx
rename to x-pack/plugins/security_solution/public/resolver/view/panels/node_details.tsx
index 4fcc557742643..d72a98811bd55 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/process_details.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/node_details.tsx
@@ -3,21 +3,17 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
+/* eslint-disable react/display-name */
+
 import React, { memo, useMemo, HTMLAttributes } from 'react';
 import { useSelector } from 'react-redux';
 import { i18n } from '@kbn/i18n';
-import {
-  htmlIdGenerator,
-  EuiSpacer,
-  EuiTitle,
-  EuiText,
-  EuiTextColor,
-  EuiDescriptionList,
-  EuiLink,
-} from '@elastic/eui';
-import styled from 'styled-components';
+import { htmlIdGenerator, EuiSpacer, EuiTitle, EuiText, EuiTextColor, EuiLink } from '@elastic/eui';
 import { FormattedMessage } from 'react-intl';
+import styled from 'styled-components';
 import { EuiDescriptionListProps } from '@elastic/eui/src/components/description_list/description_list';
+import { StyledDescriptionList, StyledTitle } from './styles';
 import * as selectors from '../../store/selectors';
 import * as event from '../../../../common/endpoint/models/event';
 import { formatDate, StyledBreadcrumbs, GeneratedText } from './panel_content_utilities';
@@ -33,23 +29,31 @@ import { CubeForProcess } from './cube_for_process';
 import { ResolverEvent } from '../../../../common/endpoint/types';
 import { useResolverTheme } from '../assets';
 import { ResolverState } from '../../types';
-import { useReplaceBreadcrumbParameters } from '../use_replace_breadcrumb_parameters';
+import { PanelLoading } from './panel_loading';
+import { StyledPanel } from '../styles';
+import { useNavigateOrReplace } from '../use_navigate_or_replace';
 
-const StyledDescriptionList = styled(EuiDescriptionList)`
-  &.euiDescriptionList.euiDescriptionList--column dt.euiDescriptionList__title.desc-title {
-    max-width: 10em;
-  }
+const StyledCubeForProcess = styled(CubeForProcess)`
+  position: relative;
+  top: 0.75em;
 `;
 
-const StyledTitle = styled('h4')`
-  overflow-wrap: break-word;
-`;
+export const NodeDetail = memo(function ({ nodeID }: { nodeID: string }) {
+  const processEvent = useSelector((state: ResolverState) =>
+    selectors.processEventForID(state)(nodeID)
+  );
+  return (
+    <StyledPanel>
+      {processEvent === null ? <PanelLoading /> : <NodeDetailView processEvent={processEvent} />}
+    </StyledPanel>
+  );
+});
 
 /**
  * A description list view of all the Metadata that goes with a particular process event, like:
  * Created, PID, User/Domain, etc.
  */
-export const ProcessDetails = memo(function ProcessDetails({
+const NodeDetailView = memo(function NodeDetailView({
   processEvent,
 }: {
   processEvent: ResolverEvent;
@@ -130,7 +134,13 @@ export const ProcessDetails = memo(function ProcessDetails({
     return processDescriptionListData;
   }, [processEvent]);
 
-  const pushToQueryParams = useReplaceBreadcrumbParameters();
+  const nodesHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({ panelView: 'nodes' })
+  );
+
+  const nodesLinkNavProps = useNavigateOrReplace({
+    search: nodesHref,
+  });
 
   const crumbs = useMemo(() => {
     return [
@@ -142,24 +152,20 @@ export const ProcessDetails = memo(function ProcessDetails({
           }
         ),
         'data-test-subj': 'resolver:node-detail:breadcrumbs:node-list-link',
-        onClick: () => {
-          pushToQueryParams({ crumbId: '', crumbEvent: '' });
-        },
+        ...nodesLinkNavProps,
       },
       {
         text: (
-          <>
-            <FormattedMessage
-              id="xpack.securitySolution.endpoint.resolver.panel.relatedEventDetail.detailsForProcessName"
-              values={{ processName }}
-              defaultMessage="Details for: {processName}"
-            />
-          </>
+          <FormattedMessage
+            id="xpack.securitySolution.endpoint.resolver.panel.relatedEventDetail.detailsForProcessName"
+            values={{ processName }}
+            defaultMessage="Details for: {processName}"
+          />
         ),
         onClick: () => {},
       },
     ];
-  }, [processName, pushToQueryParams]);
+  }, [processName, nodesLinkNavProps]);
   const { cubeAssetsForNode } = useResolverTheme();
   const { descriptionText } = useMemo(() => {
     if (!processEvent) {
@@ -168,11 +174,16 @@ export const ProcessDetails = memo(function ProcessDetails({
     return cubeAssetsForNode(isProcessTerminated, false);
   }, [processEvent, cubeAssetsForNode, isProcessTerminated]);
 
-  const handleEventsLinkClick = useMemo(() => {
-    return () => {
-      pushToQueryParams({ crumbId: entityId, crumbEvent: 'all' });
-    };
-  }, [entityId, pushToQueryParams]);
+  const nodeDetailHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({
+      panelView: 'nodeEvents',
+      panelParameters: { nodeID: entityId },
+    })
+  );
+
+  const nodeDetailNavProps = useNavigateOrReplace({
+    search: nodeDetailHref!,
+  });
 
   const titleID = useMemo(() => htmlIdGenerator('resolverTable')(), []);
   return (
@@ -181,7 +192,7 @@ export const ProcessDetails = memo(function ProcessDetails({
       <EuiSpacer size="l" />
       <EuiTitle size="xs">
         <StyledTitle aria-describedby={titleID}>
-          <CubeForProcess
+          <StyledCubeForProcess
             data-test-subj="resolver:node-detail:title-icon"
             running={!isProcessTerminated}
           />
@@ -196,7 +207,7 @@ export const ProcessDetails = memo(function ProcessDetails({
         </EuiTextColor>
       </EuiText>
       <EuiSpacer size="s" />
-      <EuiLink onClick={handleEventsLinkClick}>
+      <EuiLink {...nodeDetailNavProps}>
         <FormattedMessage
           id="xpack.securitySolution.endpoint.resolver.panel.processDescList.numberOfEvents"
           values={{ relatedEventTotal }}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/event_counts_for_process.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/node_events.tsx
similarity index 57%
rename from x-pack/plugins/security_solution/public/resolver/view/panels/event_counts_for_process.tsx
rename to x-pack/plugins/security_solution/public/resolver/view/panels/node_events.tsx
index f81dc174d8128..7607eafd7b31c 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/event_counts_for_process.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/node_events.tsx
@@ -8,11 +8,33 @@ import React, { memo, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
 import { EuiBasicTableColumn, EuiButtonEmpty, EuiSpacer, EuiInMemoryTable } from '@elastic/eui';
 import { FormattedMessage } from 'react-intl';
+import { useSelector } from 'react-redux';
 import { StyledBreadcrumbs } from './panel_content_utilities';
-
 import * as event from '../../../../common/endpoint/models/event';
 import { ResolverEvent, ResolverNodeStats } from '../../../../common/endpoint/types';
-import { useReplaceBreadcrumbParameters } from '../use_replace_breadcrumb_parameters';
+import * as selectors from '../../store/selectors';
+import { ResolverState } from '../../types';
+import { StyledPanel } from '../styles';
+import { useNavigateOrReplace } from '../use_navigate_or_replace';
+import { PanelLoading } from './panel_loading';
+
+export function NodeEvents({ nodeID }: { nodeID: string }) {
+  const processEvent = useSelector((state: ResolverState) =>
+    selectors.processEventForID(state)(nodeID)
+  );
+  const relatedEventsStats = useSelector((state: ResolverState) =>
+    selectors.relatedEventsStats(state)(nodeID)
+  );
+  if (processEvent === null || relatedEventsStats === undefined) {
+    return <PanelLoading />;
+  } else {
+    return (
+      <StyledPanel>
+        <EventCountsForProcess processEvent={processEvent} relatedStats={relatedEventsStats} />
+      </StyledPanel>
+    );
+  }
+}
 
 /**
  * This view gives counts for all the related events of a process grouped by related event type.
@@ -25,7 +47,7 @@ import { useReplaceBreadcrumbParameters } from '../use_replace_breadcrumb_parame
  * | 2                      | Network                    |
  *
  */
-export const EventCountsForProcess = memo(function EventCountsForProcess({
+const EventCountsForProcess = memo(function EventCountsForProcess({
   processEvent,
   relatedStats,
 }: {
@@ -60,37 +82,64 @@ export const EventCountsForProcess = memo(function EventCountsForProcess({
       defaultMessage: 'Events',
     }
   );
-  const pushToQueryParams = useReplaceBreadcrumbParameters();
+  const eventsHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({ panelView: 'nodes' })
+  );
+
+  const eventLinkNavProps = useNavigateOrReplace({
+    search: eventsHref,
+  });
+
+  const processDetailHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({
+      panelView: 'nodeDetail',
+      panelParameters: { nodeID: processEntityId },
+    })
+  );
+
+  const processDetailNavProps = useNavigateOrReplace({
+    search: processDetailHref,
+  });
+
+  const nodeDetailHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({
+      panelView: 'nodeEvents',
+      panelParameters: { nodeID: processEntityId },
+    })
+  );
+
+  const nodeDetailNavProps = useNavigateOrReplace({
+    search: nodeDetailHref!,
+  });
   const crumbs = useMemo(() => {
     return [
       {
         text: eventsString,
-        onClick: () => {
-          pushToQueryParams({ crumbId: '', crumbEvent: '' });
-        },
+        ...eventLinkNavProps,
       },
       {
         text: processName,
-        onClick: () => {
-          pushToQueryParams({ crumbId: processEntityId, crumbEvent: '' });
-        },
+        ...processDetailNavProps,
       },
       {
         text: (
-          <>
-            <FormattedMessage
-              id="xpack.securitySolution.endpoint.resolver.panel.relatedCounts.numberOfEventsInCrumb"
-              values={{ totalCount }}
-              defaultMessage="{totalCount} Events"
-            />
-          </>
+          <FormattedMessage
+            id="xpack.securitySolution.endpoint.resolver.panel.relatedCounts.numberOfEventsInCrumb"
+            values={{ totalCount }}
+            defaultMessage="{totalCount} Events"
+          />
         ),
-        onClick: () => {
-          pushToQueryParams({ crumbId: processEntityId, crumbEvent: '' });
-        },
+        ...nodeDetailNavProps,
       },
     ];
-  }, [processName, totalCount, processEntityId, pushToQueryParams, eventsString]);
+  }, [
+    processName,
+    totalCount,
+    eventsString,
+    eventLinkNavProps,
+    nodeDetailNavProps,
+    processDetailNavProps,
+  ]);
   const rows = useMemo(() => {
     return Object.entries(relatedEventsState.stats).map(
       ([eventType, count]): EventCountsTableView => {
@@ -101,6 +150,17 @@ export const EventCountsForProcess = memo(function EventCountsForProcess({
       }
     );
   }, [relatedEventsState]);
+
+  const eventDetailHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({
+      panelView: 'eventDetail',
+      panelParameters: { nodeID: processEntityId, eventType: name, eventID: processEntityId },
+    })
+  );
+
+  const eventDetailNavProps = useNavigateOrReplace({
+    search: eventDetailHref,
+  });
   const columns = useMemo<Array<EuiBasicTableColumn<EventCountsTableView>>>(
     () => [
       {
@@ -119,19 +179,11 @@ export const EventCountsForProcess = memo(function EventCountsForProcess({
         width: '80%',
         sortable: true,
         render(name: string) {
-          return (
-            <EuiButtonEmpty
-              onClick={() => {
-                pushToQueryParams({ crumbId: event.entityId(processEvent), crumbEvent: name });
-              }}
-            >
-              {name}
-            </EuiButtonEmpty>
-          );
+          return <EuiButtonEmpty {...eventDetailNavProps}>{name}</EuiButtonEmpty>;
         },
       },
     ],
-    [pushToQueryParams, processEvent]
+    [eventDetailNavProps]
   );
   return (
     <>
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/process_event_list.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/node_events_of_type.tsx
similarity index 64%
rename from x-pack/plugins/security_solution/public/resolver/view/panels/process_event_list.tsx
rename to x-pack/plugins/security_solution/public/resolver/view/panels/node_events_of_type.tsx
index 5fe33530f05dc..afff8d4b75c15 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/process_event_list.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/node_events_of_type.tsx
@@ -4,19 +4,25 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+/* eslint-disable react/display-name */
+
 import React, { memo, useMemo, useEffect, Fragment } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiTitle, EuiSpacer, EuiText, EuiButtonEmpty, EuiHorizontalRule } from '@elastic/eui';
+import { EuiSpacer, EuiText, EuiButtonEmpty, EuiHorizontalRule } from '@elastic/eui';
 import { useSelector } from 'react-redux';
 import { FormattedMessage } from 'react-intl';
 import styled from 'styled-components';
+import { StyledPanel } from '../styles';
 import { formatDate, StyledBreadcrumbs, BoldCode, StyledTime } from './panel_content_utilities';
 import * as event from '../../../../common/endpoint/models/event';
 import { ResolverEvent, ResolverNodeStats } from '../../../../common/endpoint/types';
 import * as selectors from '../../store/selectors';
 import { useResolverDispatch } from '../use_resolver_dispatch';
 import { RelatedEventLimitWarning } from '../limit_warnings';
-import { useReplaceBreadcrumbParameters } from '../use_replace_breadcrumb_parameters';
+import { ResolverState } from '../../types';
+import { useNavigateOrReplace } from '../use_navigate_or_replace';
+import { useRelatedEventDetailNavigation } from '../use_related_event_detail_navigation';
+import { PanelLoading } from './panel_loading';
 
 /**
  * This view presents a list of related events of a given type for a given process.
@@ -56,13 +62,17 @@ const StyledRelatedLimitWarning = styled(RelatedEventLimitWarning)`
   }
 `;
 
-const DisplayList = memo(function DisplayList({
+const NodeCategoryEntries = memo(function ({
   crumbs,
   matchingEventEntries,
   eventType,
   processEntityId,
 }: {
-  crumbs: Array<{ text: string | JSX.Element; onClick: () => void }>;
+  crumbs: Array<{
+    text: string | JSX.Element | null;
+    onClick: (event: React.MouseEvent<HTMLAnchorElement | HTMLButtonElement, MouseEvent>) => void;
+    href?: string;
+  }>;
   matchingEventEntries: MatchingEventEntry[];
   eventType: string;
   processEntityId: string;
@@ -125,36 +135,55 @@ const DisplayList = memo(function DisplayList({
   );
 });
 
-export const ProcessEventList = memo(function ProcessEventList({
+export function NodeEventsOfType({ nodeID, eventType }: { nodeID: string; eventType: string }) {
+  const processEvent = useSelector((state: ResolverState) =>
+    selectors.processEventForID(state)(nodeID)
+  );
+  const relatedEventsStats = useSelector((state: ResolverState) =>
+    selectors.relatedEventsStats(state)(nodeID)
+  );
+
+  return (
+    <StyledPanel>
+      <NodeEventList
+        processEvent={processEvent}
+        eventType={eventType}
+        relatedStats={relatedEventsStats}
+      />
+    </StyledPanel>
+  );
+}
+
+const NodeEventList = memo(function ({
   processEvent,
   eventType,
   relatedStats,
 }: {
-  processEvent: ResolverEvent;
+  processEvent: ResolverEvent | null;
   eventType: string;
-  relatedStats: ResolverNodeStats;
+  relatedStats: ResolverNodeStats | undefined;
 }) {
   const processName = processEvent && event.eventName(processEvent);
-  const processEntityId = event.entityId(processEvent);
-  const totalCount = Object.values(relatedStats.events.byCategory).reduce(
-    (sum, val) => sum + val,
-    0
+  const processEntityId = processEvent ? event.entityId(processEvent) : '';
+  const nodesHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({ panelView: 'nodes' })
   );
+
+  const nodesLinkNavProps = useNavigateOrReplace({
+    search: nodesHref,
+  });
+  const totalCount = relatedStats
+    ? Object.values(relatedStats.events.byCategory).reduce((sum, val) => sum + val, 0)
+    : 0;
   const eventsString = i18n.translate(
     'xpack.securitySolution.endpoint.resolver.panel.processEventListByType.events',
     {
       defaultMessage: 'Events',
     }
   );
-  const waitingString = i18n.translate(
-    'xpack.securitySolution.endpoint.resolver.panel.processEventListByType.wait',
-    {
-      defaultMessage: 'Waiting For Events...',
-    }
-  );
 
   const relatedsReadyMap = useSelector(selectors.relatedEventsReady);
-  const relatedsReady = relatedsReadyMap.get(processEntityId);
+  const relatedsReady = processEntityId && relatedsReadyMap.get(processEntityId);
 
   const dispatch = useResolverDispatch();
 
@@ -167,83 +196,80 @@ export const ProcessEventList = memo(function ProcessEventList({
     }
   }, [relatedsReady, dispatch, processEntityId]);
 
-  const pushToQueryParams = useReplaceBreadcrumbParameters();
-
-  const waitCrumbs = useMemo(() => {
-    return [
-      {
-        text: eventsString,
-        onClick: () => {
-          pushToQueryParams({ crumbId: '', crumbEvent: '' });
-        },
-      },
-    ];
-  }, [pushToQueryParams, eventsString]);
-
   const relatedByCategory = useSelector(selectors.relatedEventsByCategory);
+  const eventsForCurrentCategory = relatedByCategory(processEntityId)(eventType);
+  const relatedEventDetailNavigation = useRelatedEventDetailNavigation({
+    nodeID: processEntityId,
+    category: eventType,
+    events: eventsForCurrentCategory,
+  });
 
   /**
    * A list entry will be displayed for each of these
    */
   const matchingEventEntries: MatchingEventEntry[] = useMemo(() => {
-    const relateds = relatedByCategory(processEntityId)(eventType).map((resolverEvent) => {
+    return eventsForCurrentCategory.map((resolverEvent) => {
       const eventTime = event.eventTimestamp(resolverEvent);
       const formattedDate = typeof eventTime === 'undefined' ? '' : formatDate(eventTime);
       const entityId = event.eventId(resolverEvent);
-
       return {
         formattedDate,
         eventCategory: `${eventType}`,
         eventType: `${event.ecsEventType(resolverEvent)}`,
         name: event.descriptiveName(resolverEvent),
-        setQueryParams: () => {
-          pushToQueryParams({
-            crumbId: entityId === undefined ? '' : String(entityId),
-            crumbEvent: processEntityId,
-          });
-        },
+        setQueryParams: () => relatedEventDetailNavigation(entityId),
       };
     });
-    return relateds;
-  }, [relatedByCategory, eventType, processEntityId, pushToQueryParams]);
+  }, [eventType, eventsForCurrentCategory, relatedEventDetailNavigation]);
+
+  const nodeDetailHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({
+      panelView: 'nodeDetail',
+      panelParameters: { nodeID: processEntityId },
+    })
+  );
 
+  const nodeDetailNavProps = useNavigateOrReplace({
+    search: nodeDetailHref,
+  });
+
+  const nodeEventsHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({
+      panelView: 'nodeEvents',
+      panelParameters: { nodeID: processEntityId },
+    })
+  );
+
+  const nodeEventsNavProps = useNavigateOrReplace({
+    search: nodeEventsHref,
+  });
   const crumbs = useMemo(() => {
     return [
       {
         text: eventsString,
-        onClick: () => {
-          pushToQueryParams({ crumbId: '', crumbEvent: '' });
-        },
+        ...nodesLinkNavProps,
       },
       {
         text: processName,
-        onClick: () => {
-          pushToQueryParams({ crumbId: processEntityId, crumbEvent: '' });
-        },
+        ...nodeDetailNavProps,
       },
       {
         text: (
-          <>
-            <FormattedMessage
-              id="xpack.securitySolution.endpoint.resolver.panel.relatedEventList.numberOfEvents"
-              values={{ totalCount }}
-              defaultMessage="{totalCount} Events"
-            />
-          </>
+          <FormattedMessage
+            id="xpack.securitySolution.endpoint.resolver.panel.relatedEventList.numberOfEvents"
+            values={{ totalCount }}
+            defaultMessage="{totalCount} Events"
+          />
         ),
-        onClick: () => {
-          pushToQueryParams({ crumbId: processEntityId, crumbEvent: 'all' });
-        },
+        ...nodeEventsNavProps,
       },
       {
         text: (
-          <>
-            <FormattedMessage
-              id="xpack.securitySolution.endpoint.resolver.panel.relatedEventList.countByCategory"
-              values={{ count: matchingEventEntries.length, category: eventType }}
-              defaultMessage="{count} {category}"
-            />
-          </>
+          <FormattedMessage
+            id="xpack.securitySolution.endpoint.resolver.panel.relatedEventList.countByCategory"
+            values={{ count: matchingEventEntries.length, category: eventType }}
+            defaultMessage="{count} {category}"
+          />
         ),
         onClick: () => {},
       },
@@ -252,29 +278,19 @@ export const ProcessEventList = memo(function ProcessEventList({
     eventType,
     eventsString,
     matchingEventEntries.length,
-    processEntityId,
     processName,
-    pushToQueryParams,
     totalCount,
+    nodeDetailNavProps,
+    nodesLinkNavProps,
+    nodeEventsNavProps,
   ]);
 
-  /**
-   * Wait here until the effect resolves...
-   */
   if (!relatedsReady) {
-    return (
-      <>
-        <StyledBreadcrumbs breadcrumbs={waitCrumbs} />
-        <EuiSpacer size="l" />
-        <EuiTitle>
-          <h4>{waitingString}</h4>
-        </EuiTitle>
-      </>
-    );
+    return <PanelLoading />;
   }
 
   return (
-    <DisplayList
+    <NodeCategoryEntries
       crumbs={crumbs}
       processEntityId={processEntityId}
       matchingEventEntries={matchingEventEntries}
@@ -282,4 +298,3 @@ export const ProcessEventList = memo(function ProcessEventList({
     />
   );
 });
-ProcessEventList.displayName = 'ProcessEventList';
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/process_list_with_counts.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/node_list.tsx
similarity index 52%
rename from x-pack/plugins/security_solution/public/resolver/view/panels/process_list_with_counts.tsx
rename to x-pack/plugins/security_solution/public/resolver/view/panels/node_list.tsx
index 6035255824b1c..fd564cde9d15c 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/process_list_with_counts.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/node_list.tsx
@@ -6,7 +6,7 @@
 
 /* eslint-disable react/display-name */
 
-import React, { memo, useContext, useCallback, useMemo } from 'react';
+import React, { memo, useMemo } from 'react';
 import {
   EuiBasicTableColumn,
   EuiBadge,
@@ -17,15 +17,16 @@ import {
 import { i18n } from '@kbn/i18n';
 import { useSelector } from 'react-redux';
 import styled from 'styled-components';
+import { StyledPanel } from '../styles';
 import * as event from '../../../../common/endpoint/models/event';
 import * as selectors from '../../store/selectors';
 import { formatter, StyledBreadcrumbs } from './panel_content_utilities';
-import { useResolverDispatch } from '../use_resolver_dispatch';
-import { SideEffectContext } from '../side_effect_context';
 import { CubeForProcess } from './cube_for_process';
 import { SafeResolverEvent } from '../../../../common/endpoint/types';
 import { LimitWarning } from '../limit_warnings';
-import { useReplaceBreadcrumbParameters } from '../use_replace_breadcrumb_parameters';
+import { ResolverState } from '../../types';
+import { useNavigateOrReplace } from '../use_navigate_or_replace';
+import { useResolverTheme } from '../assets';
 
 const StyledLimitWarning = styled(LimitWarning)`
   flex-flow: row wrap;
@@ -47,34 +48,45 @@ const StyledLimitWarning = styled(LimitWarning)`
   }
 `;
 
-/**
- * The "default" view for the panel: A list of all the processes currently in the graph.
- */
-export const ProcessListWithCounts = memo(() => {
-  interface ProcessTableView {
-    name?: string;
-    timestamp?: Date;
-    event: SafeResolverEvent;
+const StyledButtonTextContainer = styled.div`
+  align-items: center;
+  display: flex;
+  flex-direction: row;
+`;
+
+const StyledAnalyzedEvent = styled.div`
+  color: ${(props) => props.color};
+  font-size: 10.5px;
+  font-weight: 700;
+`;
+
+const StyledLabelTitle = styled.div``;
+
+const StyledLabelContainer = styled.div`
+  display: inline-block;
+  flex: 3;
+  min-width: 0;
+
+  ${StyledAnalyzedEvent},
+  ${StyledLabelTitle} {
+    overflow: hidden;
+    text-align: left;
+    text-overflow: ellipsis;
+    white-space: nowrap;
   }
+`;
 
-  const dispatch = useResolverDispatch();
-  const { timestamp } = useContext(SideEffectContext);
-  const isProcessTerminated = useSelector(selectors.isProcessTerminated);
-  const pushToQueryParams = useReplaceBreadcrumbParameters();
-  const handleBringIntoViewClick = useCallback(
-    (processTableViewItem) => {
-      dispatch({
-        type: 'userBroughtProcessIntoView',
-        payload: {
-          time: timestamp(),
-          process: processTableViewItem.event,
-        },
-      });
-      pushToQueryParams({ crumbId: event.entityId(processTableViewItem.event), crumbEvent: '' });
-    },
-    [dispatch, timestamp, pushToQueryParams]
-  );
+interface ProcessTableView {
+  name?: string;
+  timestamp?: Date;
+  event: SafeResolverEvent;
+  href: string | undefined;
+}
 
+/**
+ * The "default" view for the panel: A list of all the processes currently in the graph.
+ */
+export const NodeList = memo(() => {
   const columns = useMemo<Array<EuiBasicTableColumn<ProcessTableView>>>(
     () => [
       {
@@ -88,35 +100,7 @@ export const ProcessListWithCounts = memo(() => {
         sortable: true,
         truncateText: true,
         render(name: string, item: ProcessTableView) {
-          const entityID = event.entityIDSafeVersion(item.event);
-          const isTerminated = entityID === undefined ? false : isProcessTerminated(entityID);
-          return name === '' ? (
-            <EuiBadge color="warning">
-              {i18n.translate(
-                'xpack.securitySolution.endpoint.resolver.panel.table.row.valueMissingDescription',
-                {
-                  defaultMessage: 'Value is missing',
-                }
-              )}
-            </EuiBadge>
-          ) : (
-            <EuiButtonEmpty
-              onClick={() => {
-                handleBringIntoViewClick(item);
-                pushToQueryParams({
-                  // Take the user back to the list of nodes if this node has no ID
-                  crumbId: event.entityIDSafeVersion(item.event) ?? '',
-                  crumbEvent: '',
-                });
-              }}
-            >
-              <CubeForProcess
-                running={!isTerminated}
-                data-test-subj="resolver:node-list:node-link:icon"
-              />
-              <span data-test-subj="resolver:node-list:node-link:title">{name}</span>
-            </EuiButtonEmpty>
-          );
+          return <NodeDetailLink name={name} item={item} />;
         },
       },
       {
@@ -145,10 +129,32 @@ export const ProcessListWithCounts = memo(() => {
         },
       },
     ],
-    [pushToQueryParams, handleBringIntoViewClick, isProcessTerminated]
+    []
   );
 
   const { processNodePositions } = useSelector(selectors.layout);
+  const nodeHrefs: Map<SafeResolverEvent, string | null | undefined> = useSelector(
+    (state: ResolverState) => {
+      const relativeHref = selectors.relativeHref(state);
+      return new Map(
+        [...processNodePositions.keys()].map((processEvent) => {
+          const nodeID = event.entityIDSafeVersion(processEvent);
+          if (nodeID === undefined) {
+            return [processEvent, null];
+          }
+          return [
+            processEvent,
+            relativeHref({
+              panelView: 'nodeDetail',
+              panelParameters: {
+                nodeID,
+              },
+            }),
+          ];
+        })
+      );
+    }
+  );
   const processTableView: ProcessTableView[] = useMemo(
     () =>
       [...processNodePositions.keys()].map((processEvent) => {
@@ -157,9 +163,10 @@ export const ProcessListWithCounts = memo(() => {
           name,
           timestamp: event.timestampAsDateSafeVersion(processEvent),
           event: processEvent,
+          href: nodeHrefs.get(processEvent) ?? undefined,
         };
       }),
-    [processNodePositions]
+    [processNodePositions, nodeHrefs]
   );
   const numberOfProcesses = processTableView.length;
 
@@ -179,7 +186,7 @@ export const ProcessListWithCounts = memo(() => {
   const showWarning = children === true || ancestors === true;
   const rowProps = useMemo(() => ({ 'data-test-subj': 'resolver:node-list:item' }), []);
   return (
-    <>
+    <StyledPanel>
       <StyledBreadcrumbs breadcrumbs={crumbs} />
       {showWarning && <StyledLimitWarning numberDisplayed={numberOfProcesses} />}
       <EuiSpacer size="l" />
@@ -190,6 +197,55 @@ export const ProcessListWithCounts = memo(() => {
         columns={columns}
         sorting
       />
-    </>
+    </StyledPanel>
   );
 });
+
+function NodeDetailLink({ name, item }: { name: string; item: ProcessTableView }) {
+  const entityID = event.entityIDSafeVersion(item.event);
+  const originID = useSelector(selectors.originID);
+  const isOrigin = originID === entityID;
+  const isTerminated = useSelector((state: ResolverState) =>
+    entityID === undefined ? false : selectors.isProcessTerminated(state)(entityID)
+  );
+  const {
+    colorMap: { descriptionText },
+  } = useResolverTheme();
+  return (
+    <EuiButtonEmpty {...useNavigateOrReplace({ search: item.href })}>
+      {name === '' ? (
+        <EuiBadge color="warning">
+          {i18n.translate(
+            'xpack.securitySolution.endpoint.resolver.panel.table.row.valueMissingDescription',
+            {
+              defaultMessage: 'Value is missing',
+            }
+          )}
+        </EuiBadge>
+      ) : (
+        <StyledButtonTextContainer>
+          <CubeForProcess
+            running={!isTerminated}
+            isOrigin={isOrigin}
+            data-test-subj="resolver:node-list:node-link:icon"
+          />
+          <StyledLabelContainer>
+            {isOrigin && (
+              <StyledAnalyzedEvent
+                color={descriptionText}
+                data-test-subj="resolver:node-list:node-link:analyzed-event"
+              >
+                {i18n.translate('xpack.securitySolution.resolver.panel.table.row.analyzedEvent', {
+                  defaultMessage: 'ANALYZED EVENT',
+                })}
+              </StyledAnalyzedEvent>
+            )}
+            <StyledLabelTitle data-test-subj="resolver:node-list:node-link:title">
+              {name}
+            </StyledLabelTitle>
+          </StyledLabelContainer>
+        </StyledButtonTextContainer>
+      )}
+    </EuiButtonEmpty>
+  );
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_error.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_error.tsx
index 4162412861f57..3b10a8db2bf12 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_error.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_error.tsx
@@ -7,8 +7,11 @@
 import { i18n } from '@kbn/i18n';
 import { EuiSpacer, EuiText, EuiButtonEmpty } from '@elastic/eui';
 import React, { memo, useMemo } from 'react';
+import { useSelector } from 'react-redux';
+import { useNavigateOrReplace } from '../use_navigate_or_replace';
+import * as selectors from '../../store/selectors';
+import { ResolverState } from '../../types';
 import { StyledBreadcrumbs } from './panel_content_utilities';
-import { useReplaceBreadcrumbParameters } from '../use_replace_breadcrumb_parameters';
 
 /**
  * Display an error in the panel when something goes wrong and give the user a way to "retreat" back to a default state.
@@ -21,16 +24,19 @@ export const PanelContentError = memo(function ({
 }: {
   translatedErrorMessage: string;
 }) {
-  const pushToQueryParams = useReplaceBreadcrumbParameters();
+  const nodesHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({ panelView: 'nodes' })
+  );
+  const nodesLinkNavProps = useNavigateOrReplace({
+    search: nodesHref,
+  });
   const crumbs = useMemo(() => {
     return [
       {
         text: i18n.translate('xpack.securitySolution.endpoint.resolver.panel.error.events', {
           defaultMessage: 'Events',
         }),
-        onClick: () => {
-          pushToQueryParams({ crumbId: '', crumbEvent: '' });
-        },
+        ...nodesLinkNavProps,
       },
       {
         text: i18n.translate('xpack.securitySolution.endpoint.resolver.panel.error.error', {
@@ -39,18 +45,14 @@ export const PanelContentError = memo(function ({
         onClick: () => {},
       },
     ];
-  }, [pushToQueryParams]);
+  }, [nodesLinkNavProps]);
   return (
     <>
       <StyledBreadcrumbs breadcrumbs={crumbs} />
       <EuiSpacer size="l" />
       <EuiText textAlign="center">{translatedErrorMessage}</EuiText>
       <EuiSpacer size="l" />
-      <EuiButtonEmpty
-        onClick={() => {
-          pushToQueryParams({ crumbId: '', crumbEvent: '' });
-        }}
-      >
+      <EuiButtonEmpty {...nodesLinkNavProps}>
         {i18n.translate('xpack.securitySolution.endpoint.resolver.panel.error.goBack', {
           defaultMessage: 'Click this link to return to the list of all processes.',
         })}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_loading.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_loading.tsx
new file mode 100644
index 0000000000000..864990e4d96ab
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_loading.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useMemo } from 'react';
+import { useSelector } from 'react-redux';
+import { i18n } from '@kbn/i18n';
+import { EuiSpacer, EuiTitle } from '@elastic/eui';
+import * as selectors from '../../store/selectors';
+import { StyledBreadcrumbs } from './panel_content_utilities';
+import { useNavigateOrReplace } from '../use_navigate_or_replace';
+import { ResolverState } from '../../types';
+
+export function PanelLoading() {
+  const waitingString = i18n.translate(
+    'xpack.securitySolution.endpoint.resolver.panel.relatedDetail.wait',
+    {
+      defaultMessage: 'Waiting For Events...',
+    }
+  );
+  const eventsString = i18n.translate(
+    'xpack.securitySolution.endpoint.resolver.panel.relatedEventDetail.events',
+    {
+      defaultMessage: 'Events',
+    }
+  );
+  const nodesHref = useSelector((state: ResolverState) =>
+    selectors.relativeHref(state)({ panelView: 'nodes' })
+  );
+  const nodesLinkNavProps = useNavigateOrReplace({
+    search: nodesHref,
+  });
+  const waitCrumbs = useMemo(() => {
+    return [
+      {
+        text: eventsString,
+        ...nodesLinkNavProps,
+      },
+    ];
+  }, [nodesLinkNavProps, eventsString]);
+  return (
+    <>
+      <StyledBreadcrumbs breadcrumbs={waitCrumbs} />
+      <EuiSpacer size="l" />
+      <EuiTitle>
+        <h4>{waitingString}</h4>
+      </EuiTitle>
+    </>
+  );
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/styles.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/styles.tsx
new file mode 100644
index 0000000000000..c5d5ae53a5580
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/styles.tsx
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import styled from 'styled-components';
+import { EuiDescriptionList } from '@elastic/eui';
+
+export const StyledDescriptionList = styled(EuiDescriptionList)`
+  &.euiDescriptionList.euiDescriptionList--column dt.euiDescriptionList__title.desc-title {
+    max-width: 10em;
+  }
+`;
+
+export const StyledTitle = styled('h4')`
+  overflow-wrap: break-word;
+`;
diff --git a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
index f4a7ad120e7db..3edfe36087e68 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
@@ -4,14 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-/* eslint-disable react/display-name */
-
 import React, { useCallback, useMemo } from 'react';
 import styled from 'styled-components';
-import { htmlIdGenerator, EuiButton, EuiI18nNumber, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { htmlIdGenerator, EuiButton, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { useSelector } from 'react-redux';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { NodeSubMenu, subMenuAssets } from './submenu';
+import { NodeSubMenu } from './submenu';
 import { applyMatrix3 } from '../models/vector2';
 import { Vector2, Matrix3, ResolverState } from '../types';
 import { SymbolIds, useResolverTheme, calculateResolverFontSize } from './assets';
@@ -19,7 +17,7 @@ import { ResolverEvent, SafeResolverEvent } from '../../../common/endpoint/types
 import { useResolverDispatch } from './use_resolver_dispatch';
 import * as eventModel from '../../../common/endpoint/models/event';
 import * as selectors from '../store/selectors';
-import { useReplaceBreadcrumbParameters } from './use_replace_breadcrumb_parameters';
+import { useNavigateOrReplace } from './use_navigate_or_replace';
 
 interface StyledActionsContainer {
   readonly color: string;
@@ -236,6 +234,16 @@ const UnstyledProcessEventDot = React.memo(
     const isOrigin = nodeID === originID;
 
     const dispatch = useResolverDispatch();
+    const processDetailHref = useSelector((state: ResolverState) =>
+      selectors.relativeHref(state)({
+        panelView: 'nodeDetail',
+        panelParameters: { nodeID },
+      })
+    );
+
+    const processDetailNavProps = useNavigateOrReplace({
+      search: processDetailHref,
+    });
 
     const handleFocus = useCallback(() => {
       dispatch({
@@ -251,57 +259,19 @@ const UnstyledProcessEventDot = React.memo(
       });
     }, [dispatch, nodeID]);
 
-    const pushToQueryParams = useReplaceBreadcrumbParameters();
-
-    const handleClick = useCallback(() => {
-      if (animationTarget.current?.beginElement) {
-        animationTarget.current.beginElement();
-      }
-      dispatch({
-        type: 'userSelectedResolverNode',
-        payload: nodeID,
-      });
-      pushToQueryParams({ crumbId: nodeID, crumbEvent: '' });
-    }, [animationTarget, dispatch, pushToQueryParams, nodeID]);
-
-    /**
-     * Enumerates the stats for related events to display with the node as options,
-     * generally in the form `number of related events in category` `category title`
-     * e.g. "10 DNS", "230 File"
-     */
-
-    const relatedEventOptions = useMemo(() => {
-      const relatedStatsList = [];
-
-      if (!relatedEventStats) {
-        // Return an empty set of options if there are no stats to report
-        return [];
-      }
-      // If we have entries to show, map them into options to display in the selectable list
-
-      for (const [category, total] of Object.entries(relatedEventStats.events.byCategory)) {
-        relatedStatsList.push({
-          prefix: <EuiI18nNumber value={total || 0} />,
-          optionTitle: category,
-          action: () => {
-            dispatch({
-              type: 'userSelectedRelatedEventCategory',
-              payload: {
-                subject: event,
-                category,
-              },
-            });
-
-            pushToQueryParams({ crumbId: nodeID, crumbEvent: category });
-          },
+    const handleClick = useCallback(
+      (clickEvent) => {
+        if (animationTarget.current?.beginElement) {
+          animationTarget.current.beginElement();
+        }
+        dispatch({
+          type: 'userSelectedResolverNode',
+          payload: nodeID,
         });
-      }
-      return relatedStatsList;
-    }, [relatedEventStats, dispatch, event, pushToQueryParams, nodeID]);
-
-    const relatedEventStatusOrOptions = !relatedEventStats
-      ? subMenuAssets.initialMenuStatus
-      : relatedEventOptions;
+        processDetailNavProps.onClick(clickEvent);
+      },
+      [animationTarget, dispatch, nodeID, processDetailNavProps]
+    );
 
     const grandTotal: number | null = useSelector((state: ResolverState) =>
       selectors.relatedEventTotalForProcess(state)(event as ResolverEvent)
@@ -331,9 +301,9 @@ const UnstyledProcessEventDot = React.memo(
           viewBox="-15 -15 90 30"
           preserveAspectRatio="xMidYMid meet"
           onClick={
-            () => {
+            (clickEvent) => {
               handleFocus();
-              handleClick();
+              handleClick(clickEvent);
             } /* a11y note: this is strictly an alternate to the button, so no tabindex is necessary*/
           }
           role="img"
@@ -468,9 +438,8 @@ const UnstyledProcessEventDot = React.memo(
                   buttonBorderColor={labelButtonFill}
                   buttonFill={colorMap.resolverBackground}
                   menuAction={handleRelatedEventRequest}
-                  menuTitle={subMenuAssets.relatedEvents.title}
                   projectionMatrix={projectionMatrix}
-                  optionsWithActions={relatedEventStatusOrOptions}
+                  relatedEventStats={relatedEventStats}
                   nodeID={nodeID}
                 />
               )}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/query_params.test.ts b/x-pack/plugins/security_solution/public/resolver/view/query_params.test.ts
index e42de5009a0f1..787b930344917 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/query_params.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/view/query_params.test.ts
@@ -44,15 +44,19 @@ describe('Resolver, when analyzing a tree that has no ancestors and 2 children',
       );
       if (button) {
         // Click the first button under the second child element.
-        button.simulate('click');
+        button.simulate('click', { button: 0 });
       }
     });
-    const expectedSearch = urlSearch(resolverComponentInstanceID, {
-      selectedEntityID: 'secondChild',
+    const queryStringWithOriginSelected = urlSearch(resolverComponentInstanceID, {
+      panelParameters: { nodeID: 'secondChild' },
+      panelView: 'nodeDetail',
     });
-    it(`should have a url search of ${expectedSearch}`, async () => {
+    it(`should have a url search of ${queryStringWithOriginSelected}`, async () => {
       await expect(simulator.map(() => simulator.historyLocationSearch)).toYieldEqualTo(
-        urlSearch(resolverComponentInstanceID, { selectedEntityID: 'secondChild' })
+        urlSearch(resolverComponentInstanceID, {
+          panelParameters: { nodeID: 'secondChild' },
+          panelView: 'nodeDetail',
+        })
       );
     });
     describe('when the resolver component gets unmounted', () => {
@@ -78,14 +82,18 @@ describe('Resolver, when analyzing a tree that has no ancestors and 2 children',
           );
           if (button) {
             // Click the first button under the second child element.
-            button.simulate('click');
+            button.simulate('click', { button: 0 });
           }
         });
         it(`should have a url search of ${urlSearch(newInstanceID, {
-          selectedEntityID: 'secondChild',
+          panelParameters: { nodeID: 'secondChild' },
+          panelView: 'nodeDetail',
         })}`, async () => {
           await expect(simulator.map(() => simulator.historyLocationSearch)).toYieldEqualTo(
-            urlSearch(newInstanceID, { selectedEntityID: 'secondChild' })
+            urlSearch(newInstanceID, {
+              panelParameters: { nodeID: 'secondChild' },
+              panelView: 'nodeDetail',
+            })
           );
         });
       });
diff --git a/x-pack/plugins/security_solution/public/resolver/view/resolver_without_providers.tsx b/x-pack/plugins/security_solution/public/resolver/view/resolver_without_providers.tsx
index f4d471b384b35..f96d89b893ceb 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/resolver_without_providers.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/resolver_without_providers.tsx
@@ -18,10 +18,11 @@ import { ProcessEventDot } from './process_event_dot';
 import { useCamera } from './use_camera';
 import { SymbolDefinitions, useResolverTheme } from './assets';
 import { useStateSyncingActions } from './use_state_syncing_actions';
-import { StyledMapContainer, StyledPanel, GraphContainer } from './styles';
+import { StyledMapContainer, GraphContainer } from './styles';
 import { entityIDSafeVersion } from '../../../common/endpoint/models/event';
 import { SideEffectContext } from './side_effect_context';
 import { ResolverProps, ResolverState } from '../types';
+import { PanelRouter } from './panels';
 
 /**
  * The highest level connected Resolver component. Needs a `Provider` in its ancestry to work.
@@ -126,7 +127,7 @@ export const ResolverWithoutProviders = React.memo(
             })}
           </GraphContainer>
         )}
-        <StyledPanel />
+        <PanelRouter />
         <GraphControls />
         <SymbolDefinitions />
       </StyledMapContainer>
diff --git a/x-pack/plugins/security_solution/public/resolver/view/styles.tsx b/x-pack/plugins/security_solution/public/resolver/view/styles.tsx
index dfc2f970f1e6f..fb4d4d289d254 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/styles.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/styles.tsx
@@ -3,8 +3,10 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
+import { EuiPanel } from '@elastic/eui';
+
 import styled from 'styled-components';
-import { Panel } from './panels';
 
 /**
  * The top level DOM element for Resolver
@@ -40,7 +42,7 @@ export const StyledMapContainer = styled.div<{ backgroundColor: string }>`
 /**
  * The Panel, styled for use in `ResolverMap`.
  */
-export const StyledPanel = styled(Panel)`
+export const StyledPanel = styled(EuiPanel)`
   position: absolute;
   left: 0;
   top: 0;
diff --git a/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx b/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
index adff11ee94cf9..dda90df0fff93 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
@@ -10,6 +10,8 @@ import { i18n } from '@kbn/i18n';
 import React, { useState, useCallback, useRef, useLayoutEffect, useMemo } from 'react';
 import { EuiI18nNumber, EuiButton, EuiPopover, ButtonColor } from '@elastic/eui';
 import styled from 'styled-components';
+import { ResolverNodeStats } from '../../../common/endpoint/types';
+import { useRelatedEventByCategoryNavigation } from './use_related_event_by_category_navigation';
 import { Matrix3 } from '../types';
 import { useResolverTheme } from './assets';
 
@@ -62,14 +64,12 @@ const SubButton = React.memo(
     menuIsOpen,
     action,
     count,
-    title,
     nodeID,
   }: {
     hasMenu: boolean;
     menuIsOpen?: boolean;
     action: (evt: React.MouseEvent<HTMLButtonElement, MouseEvent>) => void;
     count?: number;
-    title: string;
     nodeID: string;
   }) => {
     const iconType = menuIsOpen === true ? 'arrowUp' : 'arrowDown';
@@ -86,7 +86,7 @@ const SubButton = React.memo(
         data-test-resolver-node-id={nodeID}
         id={nodeID}
       >
-        {count ? <EuiI18nNumber value={count} /> : ''} {title}
+        {count ? <EuiI18nNumber value={count} /> : ''} {subMenuAssets.relatedEvents.title}
       </StyledActionButton>
     );
   }
@@ -101,17 +101,16 @@ const NodeSubMenuComponents = React.memo(
   ({
     count,
     buttonBorderColor,
-    menuTitle,
     menuAction,
-    optionsWithActions,
     className,
     projectionMatrix,
     nodeID,
+    relatedEventStats,
   }: {
-    menuTitle: string;
     className?: string;
     menuAction?: () => unknown;
     buttonBorderColor: ButtonColor;
+    // eslint-disable-next-line react/no-unused-prop-types
     buttonFill: string;
     count?: number;
     /**
@@ -119,8 +118,7 @@ const NodeSubMenuComponents = React.memo(
      */
     projectionMatrix: Matrix3;
     nodeID: string;
-  } & {
-    optionsWithActions?: ResolverSubmenuOptionList | string | undefined;
+    relatedEventStats: ResolverNodeStats | undefined;
   }) => {
     // keep a ref to the popover so we can call its reposition method
     const popoverRef = useRef<EuiPopover>(null);
@@ -148,6 +146,23 @@ const NodeSubMenuComponents = React.memo(
 
     // The last projection matrix that was used to position the popover
     const projectionMatrixAtLastRender = useRef<Matrix3>();
+    const relatedEventCallbacks = useRelatedEventByCategoryNavigation({
+      nodeID,
+      categories: relatedEventStats?.events?.byCategory,
+    });
+    const relatedEventOptions = useMemo(() => {
+      if (relatedEventStats === undefined) {
+        return [];
+      } else {
+        return Object.entries(relatedEventStats.events.byCategory).map(([category, total]) => {
+          return {
+            prefix: <EuiI18nNumber value={total || 0} />,
+            optionTitle: category,
+            action: () => relatedEventCallbacks(category),
+          };
+        });
+      }
+    }, [relatedEventStats, relatedEventCallbacks]);
 
     useLayoutEffect(() => {
       if (
@@ -167,7 +182,6 @@ const NodeSubMenuComponents = React.memo(
       // no matter what, keep track of the last project matrix that was used to size the popover
       projectionMatrixAtLastRender.current = projectionMatrix;
     }, [projectionMatrixAtLastRender, projectionMatrix]);
-
     const {
       colorMap: { pillStroke: pillBorderStroke, resolverBackground: pillFill },
     } = useResolverTheme();
@@ -177,8 +191,7 @@ const NodeSubMenuComponents = React.memo(
         backgroundColor: pillFill,
       };
     }, [pillBorderStroke, pillFill]);
-
-    if (!optionsWithActions) {
+    if (relatedEventStats === undefined) {
       /**
        * When called with a `menuAction`
        * Render without dropdown and call the supplied action when host button is clicked
@@ -191,14 +204,14 @@ const NodeSubMenuComponents = React.memo(
             size="s"
             tabIndex={-1}
           >
-            {menuTitle}
+            {subMenuAssets.relatedEvents.title}
           </EuiButton>
         </div>
       );
     }
 
-    if (typeof optionsWithActions === 'string') {
-      return <></>;
+    if (relatedEventOptions === undefined) {
+      return null;
     }
 
     return (
@@ -208,7 +221,6 @@ const NodeSubMenuComponents = React.memo(
           menuIsOpen={menuIsOpen}
           action={handleMenuOpenClick}
           count={count}
-          title={menuTitle}
           nodeID={nodeID}
         />
         {menuIsOpen ? (
@@ -217,7 +229,7 @@ const NodeSubMenuComponents = React.memo(
             aria-hidden={!menuIsOpen}
             aria-describedby={nodeID}
           >
-            {optionsWithActions
+            {relatedEventOptions
               .sort((opta, optb) => {
                 return opta.optionTitle.localeCompare(optb.optionTitle);
               })
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_navigate_or_replace.ts b/x-pack/plugins/security_solution/public/resolver/view/use_navigate_or_replace.ts
new file mode 100644
index 0000000000000..6b3568258a45f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/view/use_navigate_or_replace.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { MouseEventHandler, useCallback } from 'react';
+import { useHistory } from 'react-router-dom';
+import { LocationDescriptorObject } from 'history';
+
+type EventHandlerCallback = MouseEventHandler<HTMLButtonElement | HTMLAnchorElement>;
+
+export function useNavigateOrReplace(
+  to: LocationDescriptorObject<unknown>,
+  /** Additional onClick callback */
+  additionalOnClick?: EventHandlerCallback
+): { href: string; onClick: EventHandlerCallback } {
+  const history = useHistory();
+  const onClick = useCallback(
+    (event) => {
+      try {
+        if (additionalOnClick) {
+          additionalOnClick(event);
+        }
+      } catch (error) {
+        event.preventDefault();
+        throw error;
+      }
+
+      if (event.defaultPrevented) {
+        return;
+      }
+
+      if (event.button !== 0) {
+        return;
+      }
+
+      if (
+        event.currentTarget instanceof HTMLAnchorElement &&
+        event.currentTarget.target !== '' &&
+        event.currentTarget.target !== '_self'
+      ) {
+        return;
+      }
+
+      if (event.metaKey || event.altKey || event.ctrlKey || event.shiftKey) {
+        return;
+      }
+
+      event.preventDefault();
+      history.push(to);
+    },
+    [history, additionalOnClick, to]
+  );
+  return {
+    href: history.createHref(to),
+    onClick,
+  };
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_query_string_keys.ts b/x-pack/plugins/security_solution/public/resolver/view/use_query_string_keys.ts
deleted file mode 100644
index 11f1a30db72fc..0000000000000
--- a/x-pack/plugins/security_solution/public/resolver/view/use_query_string_keys.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { useSelector } from 'react-redux';
-import * as selectors from '../store/selectors';
-
-/**
- * Get the query string keys used by this Resolver instance.
- */
-export function useQueryStringKeys(): { idKey: string; eventKey: string } {
-  const resolverComponentInstanceID = useSelector(selectors.resolverComponentInstanceID);
-  const idKey: string = `resolver-${resolverComponentInstanceID}-id`;
-  const eventKey: string = `resolver-${resolverComponentInstanceID}-event`;
-  return {
-    idKey,
-    eventKey,
-  };
-}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_related_event_by_category_navigation.ts b/x-pack/plugins/security_solution/public/resolver/view/use_related_event_by_category_navigation.ts
new file mode 100644
index 0000000000000..f994350132c35
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/view/use_related_event_by_category_navigation.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { useCallback } from 'react';
+import { useSelector } from 'react-redux';
+import { useHistory } from 'react-router-dom';
+import { ResolverState } from '../types';
+import * as selectors from '../store/selectors';
+
+/**
+ * A hook that takes a nodeID and a record of categories, and returns a function that
+ * navigates to the proper url when called with a category.
+ * @deprecated
+ */
+export function useRelatedEventByCategoryNavigation({
+  nodeID,
+  categories,
+}: {
+  nodeID: string;
+  categories: Record<string, number> | undefined;
+}) {
+  const relatedEventUrls = useSelector((state: ResolverState) =>
+    selectors.relatedEventsRelativeHrefs(state)(categories, nodeID)
+  );
+  const history = useHistory();
+  return useCallback(
+    (category: string) => {
+      const urlForCategory = relatedEventUrls.get(category);
+      if (urlForCategory !== null && urlForCategory !== undefined) {
+        return history.replace({ search: urlForCategory });
+      }
+    },
+    [history, relatedEventUrls]
+  );
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_related_event_detail_navigation.ts b/x-pack/plugins/security_solution/public/resolver/view/use_related_event_detail_navigation.ts
new file mode 100644
index 0000000000000..9fc74a7567c47
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/view/use_related_event_detail_navigation.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { useCallback } from 'react';
+import { useSelector } from 'react-redux';
+import { useHistory } from 'react-router-dom';
+import { ResolverState } from '../types';
+import { ResolverEvent } from '../../../common/endpoint/types';
+import * as selectors from '../store/selectors';
+
+/**
+ * @deprecated
+ */
+export function useRelatedEventDetailNavigation({
+  nodeID,
+  category,
+  events,
+}: {
+  nodeID: string;
+  category: string;
+  events: ResolverEvent[];
+}) {
+  const relatedEventDetailUrls = useSelector((state: ResolverState) =>
+    selectors.relatedEventDetailHrefs(state)(category, nodeID, events)
+  );
+  const history = useHistory();
+  return useCallback(
+    (entityID: string | number | undefined) => {
+      if (entityID !== undefined) {
+        const urlForEntityID = relatedEventDetailUrls.get(String(entityID));
+        if (urlForEntityID !== null && urlForEntityID !== undefined) {
+          return history.replace({ search: urlForEntityID });
+        }
+      }
+    },
+    [history, relatedEventDetailUrls]
+  );
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_replace_breadcrumb_parameters.ts b/x-pack/plugins/security_solution/public/resolver/view/use_replace_breadcrumb_parameters.ts
deleted file mode 100644
index 6d819337e447d..0000000000000
--- a/x-pack/plugins/security_solution/public/resolver/view/use_replace_breadcrumb_parameters.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { useCallback } from 'react';
-import { useHistory, useLocation } from 'react-router-dom';
-import { useQueryStringKeys } from './use_query_string_keys';
-import { CrumbInfo } from '../types';
-
-/**
- * @deprecated
- * Update the browser's `search` with data from `queryStringState`. The URL search parameter names
- * will include Resolver's `resolverComponentInstanceID`.
- */
-export function useReplaceBreadcrumbParameters(): (queryStringState: CrumbInfo) => void {
-  /**
-   * This updates the breadcrumb nav and the panel view. It's supplied to each
-   * panel content view to allow them to dispatch transitions to each other.
-   */
-  const history = useHistory();
-  const urlSearch = useLocation().search;
-  const { idKey, eventKey } = useQueryStringKeys();
-  return useCallback(
-    (queryStringState: CrumbInfo) => {
-      const urlSearchParams = new URLSearchParams(urlSearch);
-
-      urlSearchParams.set(idKey, queryStringState.crumbId);
-      urlSearchParams.set(eventKey, queryStringState.crumbEvent);
-
-      // If either was passed in as empty, remove it
-      if (queryStringState.crumbId === '') {
-        urlSearchParams.delete(idKey);
-      }
-      if (queryStringState.crumbEvent === '') {
-        urlSearchParams.delete(eventKey);
-      }
-
-      const relativeURL = { search: urlSearchParams.toString() };
-      // We probably don't want to nuke the user's history with a huge
-      // trail of these, thus `.replace` instead of `.push`
-      return history.replace(relativeURL);
-    },
-    [history, urlSearch, idKey, eventKey]
-  );
-}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params_cleaner.ts b/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params_cleaner.ts
index a84eb0490aae2..9cf6c182befe1 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params_cleaner.ts
+++ b/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params_cleaner.ts
@@ -6,8 +6,9 @@
 
 import { useRef, useEffect } from 'react';
 import { useLocation, useHistory } from 'react-router-dom';
-
-import { useQueryStringKeys } from './use_query_string_keys';
+import { useSelector } from 'react-redux';
+import * as selectors from '../store/selectors';
+import { parameterName } from '../store/ui/selectors';
 /**
  * Cleanup any query string keys that were added by this Resolver instance.
  * This works by having a React effect that just has behavior in the 'cleanup' function.
@@ -23,15 +24,15 @@ export function useResolverQueryParamCleaner() {
   searchRef.current = useLocation().search;
 
   const history = useHistory();
+  const resolverComponentInstanceID = useSelector(selectors.resolverComponentInstanceID);
 
-  const { idKey, eventKey } = useQueryStringKeys();
+  const resolverKey = parameterName(resolverComponentInstanceID);
 
   useEffect(() => {
     /**
      * Keep track of the old query string keys so we can remove them.
      */
-    const oldIdKey = idKey;
-    const oldEventKey = eventKey;
+    const oldResolverKey = resolverKey;
     /**
      * When `idKey` or `eventKey` changes (such as when the `resolverComponentInstanceID` has changed) or when the component unmounts, remove any state from the query string.
      */
@@ -44,10 +45,9 @@ export function useResolverQueryParamCleaner() {
       /**
        * Remove old keys from the url
        */
-      urlSearchParams.delete(oldIdKey);
-      urlSearchParams.delete(oldEventKey);
+      urlSearchParams.delete(oldResolverKey);
       const relativeURL = { search: urlSearchParams.toString() };
       history.replace(relativeURL);
     };
-  }, [idKey, eventKey, history]);
+  }, [resolverKey, history]);
 }
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
index 10f20eeacbcb0..a711e7a1d0442 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
@@ -129,8 +129,6 @@ const mapDispatchToProps = (dispatch: Dispatch, { timelineId }: OwnProps) => ({
     dispatch(timelineActions.updateDescription({ id, description })),
   updateIsFavorite: ({ id, isFavorite }: { id: string; isFavorite: boolean }) =>
     dispatch(timelineActions.updateIsFavorite({ id, isFavorite })),
-  updateIsLive: ({ id, isLive }: { id: string; isLive: boolean }) =>
-    dispatch(timelineActions.updateIsLive({ id, isLive })),
   updateNote: (note: Note) => dispatch(appActions.updateNote({ note })),
   updateTitle: ({ id, title }: { id: string; title: string }) =>
     dispatch(timelineActions.updateTitle({ id, title })),
diff --git a/x-pack/plugins/security_solution/public/timelines/components/notes/note_card/__snapshots__/note_card_body.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/notes/note_card/__snapshots__/note_card_body.test.tsx.snap
index 9c0a9b26f5332..4eb320571a75b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/notes/note_card/__snapshots__/note_card_body.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/notes/note_card/__snapshots__/note_card_body.test.tsx.snap
@@ -122,6 +122,7 @@ exports[`NoteCardBody renders correctly against snapshot 1`] = `
         },
         "euiCardSpacing": "16px",
         "euiCheckBoxSize": "16px",
+        "euiCheckboxBorderRadius": "4px",
         "euiCodeBlockAdditionColor": "#54b399",
         "euiCodeBlockAttributeColor": "inherit",
         "euiCodeBlockBackgroundColor": "#25262e",
@@ -267,6 +268,7 @@ exports[`NoteCardBody renders correctly against snapshot 1`] = `
         "euiFormBorderColor": "rgba(255, 255, 255, 0.09999999999999998)",
         "euiFormBorderDisabledColor": "rgba(255, 255, 255, 0.09999999999999998)",
         "euiFormBorderOpaqueColor": "#ffffff",
+        "euiFormControlBorderRadius": 0,
         "euiFormControlBoxShadow": "0 1px 1px -1px rgba(0, 0, 0, 0.19999999999999996) 0 3px 2px -2px rgba(0, 0, 0, 0.19999999999999996)",
         "euiFormControlCompressedBorderRadius": "2px",
         "euiFormControlCompressedHeight": "32px",
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx
index 120fc12b425f4..ea938be91abd1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx
@@ -5,7 +5,6 @@
  */
 
 import { EuiButtonIcon, EuiCheckbox, EuiToolTip } from '@elastic/eui';
-import { noop } from 'lodash/fp';
 import React, { useState, useEffect, useCallback, useMemo } from 'react';
 import { Droppable, DraggableChildrenFn } from 'react-beautiful-dnd';
 import deepEqual from 'fast-deep-equal';
@@ -26,7 +25,6 @@ import {
   OnColumnRemoved,
   OnColumnResized,
   OnColumnSorted,
-  OnFilterChange,
   OnSelectAll,
   OnUpdateColumns,
 } from '../../events';
@@ -57,7 +55,6 @@ interface Props {
   onColumnRemoved: OnColumnRemoved;
   onColumnResized: OnColumnResized;
   onColumnSorted: OnColumnSorted;
-  onFilterChange?: OnFilterChange;
   onSelectAll: OnSelectAll;
   onUpdateColumns: OnUpdateColumns;
   showEventsSelect: boolean;
@@ -111,7 +108,6 @@ export const ColumnHeadersComponent = ({
   onColumnSorted,
   onSelectAll,
   onUpdateColumns,
-  onFilterChange = noop,
   showEventsSelect,
   showSelectAllCheckbox,
   sort,
@@ -186,18 +182,16 @@ export const ColumnHeadersComponent = ({
           isDragging={draggingIndex === draggableIndex}
           onColumnRemoved={onColumnRemoved}
           onColumnSorted={onColumnSorted}
-          onFilterChange={onFilterChange}
           onColumnResized={onColumnResized}
           sort={sort}
         />
       )),
-    // eslint-disable-next-line react-hooks/exhaustive-deps
     [
       columnHeaders,
       timelineId,
       draggingIndex,
       onColumnRemoved,
-      onFilterChange,
+      onColumnSorted,
       onColumnResized,
       sort,
     ]
@@ -312,7 +306,6 @@ export const ColumnHeaders = React.memo(
     prevProps.onColumnSorted === nextProps.onColumnSorted &&
     prevProps.onSelectAll === nextProps.onSelectAll &&
     prevProps.onUpdateColumns === nextProps.onUpdateColumns &&
-    prevProps.onFilterChange === nextProps.onFilterChange &&
     prevProps.showEventsSelect === nextProps.showEventsSelect &&
     prevProps.showSelectAllCheckbox === nextProps.showSelectAllCheckbox &&
     prevProps.sort === nextProps.sort &&
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx
index f4838f90a1e96..0d37f25d66e3f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx
@@ -7,7 +7,8 @@
 import React from 'react';
 import { getOr } from 'lodash/fp';
 
-import { Ecs, TimelineNonEcsData } from '../../../../../graphql/types';
+import { Ecs } from '../../../../../../common/ecs';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 import { OnColumnResized } from '../../events';
 import { EventsTd, EventsTdContent, EventsTdGroupData } from '../../styles';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
index f1d45d5458554..2c84a786d4432 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
@@ -8,7 +8,8 @@ import React, { useCallback, useMemo } from 'react';
 import uuid from 'uuid';
 import { useSelector, shallowEqual } from 'react-redux';
 
-import { TimelineNonEcsData, Ecs } from '../../../../../graphql/types';
+import { Ecs } from '../../../../../../common/ecs';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { Note } from '../../../../../common/lib/note';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 import { AssociateNote, UpdateNote } from '../../../notes/helpers';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx
index 64d55f8cf6c6a..0fc097de680e8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx
@@ -8,7 +8,10 @@ import React from 'react';
 
 import { inputsModel } from '../../../../../common/store';
 import { BrowserFields, DocValueFields } from '../../../../../common/containers/source';
-import { TimelineItem, TimelineNonEcsData } from '../../../../../graphql/types';
+import {
+  TimelineItem,
+  TimelineNonEcsData,
+} from '../../../../../../common/search_strategy/timeline';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 import { Note } from '../../../../../common/lib/note';
 import { AddNoteToEvent, UpdateNote } from '../../../notes/helpers';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
index 9691327f2c988..d8cc8ddd2f15a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
@@ -9,11 +9,13 @@ import { useSelector } from 'react-redux';
 import uuid from 'uuid';
 import VisibilitySensor from 'react-visibility-sensor';
 
-import { TimelineId } from '../../../../../../common/types/timeline';
 import { BrowserFields, DocValueFields } from '../../../../../common/containers/source';
-import { useTimelineDetails } from '../../../../containers/details';
-import { TimelineItem, TimelineNonEcsData } from '../../../../../graphql/types';
-import { DetailItem } from '../../../../../../common/search_strategy/timeline';
+import { useTimelineEventsDetails } from '../../../../containers/details';
+import {
+  TimelineEventsDetailsItem,
+  TimelineItem,
+  TimelineNonEcsData,
+} from '../../../../../../common/search_strategy/timeline';
 import { Note } from '../../../../../common/lib/note';
 import { ColumnHeaderOptions, TimelineModel } from '../../../../../timelines/store/timeline/model';
 import { AddNoteToEvent, UpdateNote } from '../../../notes/helpers';
@@ -68,7 +70,7 @@ interface Props {
 
 export const getNewNoteId = (): string => uuid.v4();
 
-const emptyDetails: DetailItem[] = [];
+const emptyDetails: TimelineEventsDetailsItem[] = [];
 
 /**
  * This is the default row height whenever it is a plain row renderer and not a custom row height.
@@ -135,14 +137,14 @@ const StatefulEventComponent: React.FC<Props> = ({
   const [expanded, setExpanded] = useState<{ [eventId: string]: boolean }>({});
   const [showNotes, setShowNotes] = useState<{ [eventId: string]: boolean }>({});
   const { status: timelineStatus } = useSelector<StoreState, TimelineModel>(
-    (state) => state.timeline.timelineById[TimelineId.active]
+    (state) => state.timeline.timelineById[timelineId]
   );
   const divElement = useRef<HTMLDivElement | null>(null);
-  const [loading, detailsData] = useTimelineDetails({
+  const [loading, detailsData] = useTimelineEventsDetails({
     docValueFields,
     indexName: event._index!,
     eventId: event._id,
-    executeQuery: !!expanded[event._id],
+    skip: !expanded[event._id],
   });
 
   const onToggleShowNotes = useCallback(() => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts
index f4dc691f3d059..7e438b9ee6ccc 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts
@@ -4,8 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Ecs } from '../../../../graphql/types';
-
 import {
   eventHasNotes,
   eventIsPinned,
@@ -14,6 +12,7 @@ import {
   stringifyEvent,
   isInvestigateInResolverActionEnabled,
 } from './helpers';
+import { Ecs } from '../../../../../common/ecs';
 import { TimelineType } from '../../../../../common/types/timeline';
 
 describe('helpers', () => {
@@ -145,11 +144,7 @@ describe('helpers', () => {
       };
       const toStringify: Ecs = {
         _id: '4',
-        timestamp: null,
-        host: {
-          name: null,
-          ip: null,
-        },
+        host: {},
         event: {
           id: ['4'],
           category: ['theory'],
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
index 5753efa2bf1bb..824a37f72ba59 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
@@ -8,7 +8,8 @@ import React, { useCallback, useMemo } from 'react';
 import { get, isEmpty } from 'lodash/fp';
 import { useDispatch } from 'react-redux';
 
-import { Ecs, TimelineItem, TimelineNonEcsData } from '../../../../graphql/types';
+import { Ecs } from '../../../../../common/ecs';
+import { TimelineItem, TimelineNonEcsData } from '../../../../../common/search_strategy';
 import { updateTimelineGraphEventId } from '../../../store/timeline/actions';
 import { EventType } from '../../../store/timeline/model';
 import { OnPinEvent, OnUnPinEvent } from '../events';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
index 657e1617e8d24..23a449cca972d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
@@ -9,7 +9,7 @@ import { useSelector } from 'react-redux';
 
 import '../../../../common/mock/match_media';
 import { mockBrowserFields } from '../../../../common/containers/source/mock';
-import { Direction } from '../../../../graphql/types';
+import { Direction } from '../../../../../common/search_strategy';
 import { defaultHeaders, mockTimelineData, mockTimelineModel } from '../../../../common/mock';
 import { TestProviders } from '../../../../common/mock/test_providers';
 
@@ -70,7 +70,6 @@ describe('Body', () => {
     onColumnRemoved: jest.fn(),
     onColumnResized: jest.fn(),
     onColumnSorted: jest.fn(),
-    onFilterChange: jest.fn(),
     onPinEvent: jest.fn(),
     onRowSelected: jest.fn(),
     onSelectAll: jest.fn(),
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
index 40cc12afde51d..58c87c086df6e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
@@ -8,7 +8,7 @@ import React, { useMemo, useRef } from 'react';
 
 import { inputsModel } from '../../../../common/store';
 import { BrowserFields, DocValueFields } from '../../../../common/containers/source';
-import { TimelineItem, TimelineNonEcsData } from '../../../../graphql/types';
+import { TimelineItem, TimelineNonEcsData } from '../../../../../common/search_strategy';
 import { Note } from '../../../../common/lib/note';
 import { ColumnHeaderOptions, EventType } from '../../../../timelines/store/timeline/model';
 import { AddNoteToEvent, UpdateNote } from '../../notes/helpers';
@@ -16,7 +16,6 @@ import {
   OnColumnRemoved,
   OnColumnResized,
   OnColumnSorted,
-  OnFilterChange,
   OnPinEvent,
   OnRowSelected,
   OnSelectAll,
@@ -53,7 +52,6 @@ export interface BodyProps {
   onColumnSorted: OnColumnSorted;
   onRowSelected: OnRowSelected;
   onSelectAll: OnSelectAll;
-  onFilterChange: OnFilterChange;
   onPinEvent: OnPinEvent;
   onUpdateColumns: OnUpdateColumns;
   onUnPinEvent: OnUnPinEvent;
@@ -99,7 +97,6 @@ export const Body = React.memo<BodyProps>(
     onColumnSorted,
     onRowSelected,
     onSelectAll,
-    onFilterChange,
     onPinEvent,
     onUpdateColumns,
     onUnPinEvent,
@@ -157,7 +154,6 @@ export const Body = React.memo<BodyProps>(
               onColumnRemoved={onColumnRemoved}
               onColumnResized={onColumnResized}
               onColumnSorted={onColumnSorted}
-              onFilterChange={onFilterChange}
               onSelectAll={onSelectAll}
               onUpdateColumns={onUpdateColumns}
               showEventsSelect={false}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_details.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_details.test.tsx.snap
index cf953ccef8f8e..8dd7452b5d900 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_details.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_details.test.tsx.snap
@@ -3,7 +3,6 @@
 exports[`GenericDetails rendering it renders the default AuditAcquiredCredsDetails 1`] = `
 <Details>
   <AuditdGenericLine
-    args={null}
     contextId="contextid-123"
     hostName="suricata-bangalore"
     id="22"
@@ -53,7 +52,6 @@ exports[`GenericDetails rendering it renders the default AuditAcquiredCredsDetai
             "how": Array [
               "/usr/sbin/sshd",
             ],
-            "message_type": null,
             "object": Object {
               "primary": Array [
                 "ssh",
@@ -65,10 +63,8 @@ exports[`GenericDetails rendering it renders the default AuditAcquiredCredsDetai
                 "user-session",
               ],
             },
-            "sequence": null,
           },
         },
-        "destination": null,
         "event": Object {
           "action": Array [
             "disposed-credentials",
@@ -76,14 +72,10 @@ exports[`GenericDetails rendering it renders the default AuditAcquiredCredsDetai
           "category": Array [
             "user-login",
           ],
-          "dataset": null,
-          "id": null,
           "module": Array [
             "auditd",
           ],
-          "severity": null,
         },
-        "geo": null,
         "host": Object {
           "id": Array [
             "0a63559c1acf4c419d979c4b4d8b83ff",
@@ -97,31 +89,20 @@ exports[`GenericDetails rendering it renders the default AuditAcquiredCredsDetai
             "suricata-bangalore",
           ],
         },
-        "http": null,
-        "network": null,
         "process": Object {
-          "args": null,
           "executable": Array [
             "/usr/sbin/sshd",
           ],
-          "name": null,
           "pid": Array [
             21202,
           ],
-          "ppid": null,
-          "title": null,
-          "working_directory": null,
         },
-        "source": null,
-        "suricata": null,
         "timestamp": "2019-03-13T03:35:21.614Z",
-        "url": null,
         "user": Object {
           "name": Array [
             "root",
           ],
         },
-        "zeek": null,
       }
     }
     timelineId="test"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_file_details.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_file_details.test.tsx.snap
index f6fbc771c954a..c811d0d7efece 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_file_details.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_file_details.test.tsx.snap
@@ -3,7 +3,6 @@
 exports[`GenericFileDetails rendering it renders the default GenericFileDetails 1`] = `
 <Details>
   <AuditdGenericFileLine
-    args={null}
     contextId="contextid-123"
     fileIcon="document"
     filePath="/proc/15990/attr/current"
@@ -29,7 +28,6 @@ exports[`GenericFileDetails rendering it renders the default GenericFileDetails
       Object {
         "_id": "28",
         "auditd": Object {
-          "data": null,
           "result": Array [
             "success",
           ],
@@ -48,20 +46,16 @@ exports[`GenericFileDetails rendering it renders the default GenericFileDetails
             "how": Array [
               "/lib/systemd/systemd-journald",
             ],
-            "message_type": null,
             "object": Object {
               "primary": Array [
                 "/proc/15990/attr/current",
               ],
-              "secondary": null,
               "type": Array [
                 "file",
               ],
             },
-            "sequence": null,
           },
         },
-        "destination": null,
         "event": Object {
           "action": Array [
             "opened-file",
@@ -69,19 +63,14 @@ exports[`GenericFileDetails rendering it renders the default GenericFileDetails
           "category": Array [
             "audit-rule",
           ],
-          "dataset": null,
-          "id": null,
           "module": Array [
             "auditd",
           ],
-          "severity": null,
         },
         "file": Object {
-          "ctime": null,
           "device": Array [
             "00:00",
           ],
-          "extension": null,
           "gid": Array [
             "0",
           ],
@@ -94,21 +83,16 @@ exports[`GenericFileDetails rendering it renders the default GenericFileDetails
           "mode": Array [
             "0666",
           ],
-          "mtime": null,
           "owner": Array [
             "root",
           ],
           "path": Array [
             "/proc/15990/attr/current",
           ],
-          "size": null,
-          "target_path": null,
-          "type": null,
           "uid": Array [
             "0",
           ],
         },
-        "geo": null,
         "host": Object {
           "id": Array [
             "7c21f5ed03b04d0299569d221fe18bbc",
@@ -122,10 +106,7 @@ exports[`GenericFileDetails rendering it renders the default GenericFileDetails
             "zeek-london",
           ],
         },
-        "http": null,
-        "network": null,
         "process": Object {
-          "args": null,
           "executable": Array [
             "/lib/systemd/systemd-journald",
           ],
@@ -145,16 +126,12 @@ exports[`GenericFileDetails rendering it renders the default GenericFileDetails
             "/",
           ],
         },
-        "source": null,
-        "suricata": null,
         "timestamp": "2019-03-26T22:12:18.609Z",
-        "url": null,
         "user": Object {
           "name": Array [
             "root",
           ],
         },
-        "zeek": null,
       }
     }
     timelineId="test"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_row_renderer.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_row_renderer.test.tsx.snap
index 784924e896673..63b65d3cf36be 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_row_renderer.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/__snapshots__/generic_row_renderer.test.tsx.snap
@@ -10,7 +10,6 @@ exports[`GenericRowRenderer #createGenericAuditRowRenderer renders correctly aga
         Object {
           "_id": "27",
           "auditd": Object {
-            "data": null,
             "result": Array [
               "success",
             ],
@@ -29,7 +28,6 @@ exports[`GenericRowRenderer #createGenericAuditRowRenderer renders correctly aga
               "how": Array [
                 "/usr/bin/wget",
               ],
-              "message_type": null,
               "object": Object {
                 "primary": Array [
                   "192.168.216.34",
@@ -41,7 +39,6 @@ exports[`GenericRowRenderer #createGenericAuditRowRenderer renders correctly aga
                   "socket",
                 ],
               },
-              "sequence": null,
             },
           },
           "destination": Object {
@@ -59,14 +56,10 @@ exports[`GenericRowRenderer #createGenericAuditRowRenderer renders correctly aga
             "category": Array [
               "audit-rule",
             ],
-            "dataset": null,
-            "id": null,
             "module": Array [
               "auditd",
             ],
-            "severity": null,
           },
-          "geo": null,
           "host": Object {
             "id": Array [
               "7c21f5ed03b04d0299569d221fe18bbc",
@@ -80,10 +73,7 @@ exports[`GenericRowRenderer #createGenericAuditRowRenderer renders correctly aga
               "zeek-london",
             ],
           },
-          "http": null,
-          "network": null,
           "process": Object {
-            "args": null,
             "executable": Array [
               "/usr/bin/wget",
             ],
@@ -99,18 +89,13 @@ exports[`GenericRowRenderer #createGenericAuditRowRenderer renders correctly aga
             "title": Array [
               "wget www.example.com",
             ],
-            "working_directory": null,
           },
-          "source": null,
-          "suricata": null,
           "timestamp": "2019-03-22T19:13:11.026Z",
-          "url": null,
           "user": Object {
             "name": Array [
               "alice",
             ],
           },
-          "zeek": null,
         }
       }
       text="connected using"
@@ -130,7 +115,6 @@ exports[`GenericRowRenderer #createGenericFileRowRenderer renders correctly agai
         Object {
           "_id": "28",
           "auditd": Object {
-            "data": null,
             "result": Array [
               "success",
             ],
@@ -149,20 +133,16 @@ exports[`GenericRowRenderer #createGenericFileRowRenderer renders correctly agai
               "how": Array [
                 "/lib/systemd/systemd-journald",
               ],
-              "message_type": null,
               "object": Object {
                 "primary": Array [
                   "/proc/15990/attr/current",
                 ],
-                "secondary": null,
                 "type": Array [
                   "file",
                 ],
               },
-              "sequence": null,
             },
           },
-          "destination": null,
           "event": Object {
             "action": Array [
               "opened-file",
@@ -170,19 +150,14 @@ exports[`GenericRowRenderer #createGenericFileRowRenderer renders correctly agai
             "category": Array [
               "audit-rule",
             ],
-            "dataset": null,
-            "id": null,
             "module": Array [
               "auditd",
             ],
-            "severity": null,
           },
           "file": Object {
-            "ctime": null,
             "device": Array [
               "00:00",
             ],
-            "extension": null,
             "gid": Array [
               "0",
             ],
@@ -195,21 +170,16 @@ exports[`GenericRowRenderer #createGenericFileRowRenderer renders correctly agai
             "mode": Array [
               "0666",
             ],
-            "mtime": null,
             "owner": Array [
               "root",
             ],
             "path": Array [
               "/proc/15990/attr/current",
             ],
-            "size": null,
-            "target_path": null,
-            "type": null,
             "uid": Array [
               "0",
             ],
           },
-          "geo": null,
           "host": Object {
             "id": Array [
               "7c21f5ed03b04d0299569d221fe18bbc",
@@ -223,10 +193,7 @@ exports[`GenericRowRenderer #createGenericFileRowRenderer renders correctly agai
               "zeek-london",
             ],
           },
-          "http": null,
-          "network": null,
           "process": Object {
-            "args": null,
             "executable": Array [
               "/lib/systemd/systemd-journald",
             ],
@@ -246,16 +213,12 @@ exports[`GenericRowRenderer #createGenericFileRowRenderer renders correctly agai
               "/",
             ],
           },
-          "source": null,
-          "suricata": null,
           "timestamp": "2019-03-26T22:12:18.609Z",
-          "url": null,
           "user": Object {
             "name": Array [
               "root",
             ],
           },
-          "zeek": null,
         }
       }
       fileIcon="document"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_details.tsx
index 1e82519285da3..f1e8a5aafee7d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_details.tsx
@@ -9,7 +9,7 @@ import { get } from 'lodash/fp';
 import React from 'react';
 
 import { BrowserFields } from '../../../../../../common/containers/source';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { DraggableBadge } from '../../../../../../common/components/draggables';
 
 import * as i18n from './translations';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_file_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_file_details.tsx
index d9149bae89190..ea3f20c2816db 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_file_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_file_details.tsx
@@ -9,7 +9,7 @@ import { get } from 'lodash/fp';
 import React from 'react';
 
 import { BrowserFields } from '../../../../../../common/containers/source';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { DraggableBadge } from '../../../../../../common/components/draggables';
 
 import * as i18n from './translations';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_row_renderer.test.tsx
index 1e314c0ebd281..415124d400446 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_row_renderer.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 
 import { BrowserFields } from '../../../../../../common/containers/source';
 import { mockBrowserFields } from '../../../../../../common/containers/source/mock';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { mockTimelineData, TestProviders } from '../../../../../../common/mock';
 import { useMountAppended } from '../../../../../../common/utils/use_mount_appended';
 import { RowRenderer } from '../row_renderer';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts
index 4a89fea8c5106..c462841f7ea38 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { TimelineNonEcsData } from '../../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 
 export interface ColumnRenderer {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/dns/dns_request_event_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/dns/dns_request_event_details.tsx
index 74ed5b2a6587f..7b89626467c11 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/dns/dns_request_event_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/dns/dns_request_event_details.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 
 import { BrowserFields } from '../../../../../../common/containers/source';
 import { Details } from '../helpers';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { NetflowRenderer } from '../netflow';
 
 import { DnsRequestEventDetailsLine } from './dns_request_event_details_line';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/empty_column_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/empty_column_renderer.test.tsx
index 6c9dd5092e7c1..b614f93f6c02d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/empty_column_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/empty_column_renderer.test.tsx
@@ -8,7 +8,7 @@ import { shallow } from 'enzyme';
 import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 
-import { TimelineNonEcsData } from '../../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { defaultHeaders, mockTimelineData, TestProviders } from '../../../../../common/mock';
 import '../../../../../common/mock/match_media';
 import { useMountAppended } from '../../../../../common/utils/use_mount_appended';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/empty_column_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/empty_column_renderer.tsx
index 5ffaa2898f63a..59eedd0cc9ffe 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/empty_column_renderer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/empty_column_renderer.tsx
@@ -8,7 +8,7 @@
 
 import React from 'react';
 
-import { TimelineNonEcsData } from '../../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 import {
   DraggableWrapper,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/endgame/endgame_security_event_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/endgame/endgame_security_event_details.tsx
index 11580e2536ff7..00846e7cc34af 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/endgame/endgame_security_event_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/endgame/endgame_security_event_details.tsx
@@ -9,7 +9,7 @@ import { get } from 'lodash/fp';
 import React from 'react';
 
 import { BrowserFields } from '../../../../../../common/containers/source';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { NetflowRenderer } from '../netflow';
 
 import { EndgameSecurityEventDetailsLine } from './endgame_security_event_details_line';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_column_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_column_renderer.test.tsx
index d1ed5e86e72e5..2a8f72aeaf2a4 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_column_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_column_renderer.test.tsx
@@ -9,7 +9,7 @@ import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 
 import '../../../../../common/mock/match_media';
-import { TimelineNonEcsData } from '../../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { mockTimelineData } from '../../../../../common/mock';
 import { TestProviders } from '../../../../../common/mock/test_providers';
 import { getEmptyValue } from '../../../../../common/components/empty_value';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_column_renderer.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_column_renderer.ts
index e456e8c9f02f6..9bba170a34405 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_column_renderer.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_column_renderer.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { TimelineNonEcsData } from '../../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { ColumnRenderer } from './column_renderer';
 
 const unhandledColumnRenderer = (): never => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx
index 0c7fbd08ba98c..52b9b9a31fc99 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 
 import '../../../../../common/mock/match_media';
 import { mockBrowserFields } from '../../../../../common/containers/source/mock';
-import { Ecs } from '../../../../../graphql/types';
+import { Ecs } from '../../../../../../common/ecs';
 import { mockTimelineData } from '../../../../../common/mock';
 import { TestProviders } from '../../../../../common/mock/test_providers';
 import { useMountAppended } from '../../../../../common/utils/use_mount_appended';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.ts
index 778246aeb1815..779d54216e26c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Ecs } from '../../../../../graphql/types';
+import { Ecs } from '../../../../../../common/ecs';
 import { RowRenderer } from './row_renderer';
 
 const unhandledRowRenderer = (): never => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/helpers.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/helpers.test.tsx
index 162db69416b53..7cccae2f474c2 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/helpers.test.tsx
@@ -6,7 +6,7 @@
 
 import { cloneDeep } from 'lodash/fp';
 
-import { TimelineNonEcsData } from '../../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { mockTimelineData } from '../../../../../common/mock';
 import {
   deleteItemIdx,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/helpers.tsx
index 16c2f989a8107..8042a66cd5428 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/helpers.tsx
@@ -8,7 +8,7 @@ import { EuiFlexItem } from '@elastic/eui';
 import { isNumber, isEmpty } from 'lodash/fp';
 import styled from 'styled-components';
 
-import { TimelineNonEcsData } from '../../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 
 export const deleteItemIdx = (data: TimelineNonEcsData[], idx: number) => [
   ...data.slice(0, idx),
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx
index 0492450df5134..ddd427bf9ca06 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx
@@ -7,7 +7,7 @@
 import { get } from 'lodash/fp';
 import React from 'react';
 
-import { Ecs } from '../../../../../graphql/types';
+import { Ecs } from '../../../../../../common/ecs';
 import { asArrayIfExists } from '../../../../../common/lib/helpers';
 import {
   TLS_CLIENT_CERTIFICATE_FINGERPRINT_SHA1_FIELD_NAME,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.test.tsx
index 8a8b40198bdba..3528081a20f6b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import '../../../../../../common/mock/match_media';
 import { BrowserFields } from '../../../../../../common/containers/source';
 import { mockBrowserFields } from '../../../../../../common/containers/source/mock';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { getMockNetflowData, TestProviders } from '../../../../../../common/mock';
 import { useMountAppended } from '../../../../../../common/utils/use_mount_appended';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.test.tsx
index 9199278c57f7a..0d0b011c0b438 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.test.tsx
@@ -9,7 +9,7 @@ import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 
 import '../../../../../common/mock/match_media';
-import { TimelineNonEcsData } from '../../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { defaultHeaders, mockTimelineData, TestProviders } from '../../../../../common/mock';
 import { getEmptyValue } from '../../../../../common/components/empty_value';
 import { useMountAppended } from '../../../../../common/utils/use_mount_appended';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.tsx
index 989c8015b796d..013ea1d6abb83 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_column_renderer.tsx
@@ -7,7 +7,7 @@
 import { head } from 'lodash/fp';
 import React from 'react';
 
-import { TimelineNonEcsData } from '../../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 import { getEmptyTagValue } from '../../../../../common/components/empty_value';
 import { ColumnRenderer } from './column_renderer';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_row_renderer.test.tsx
index 82d42988ef34f..a914d31ff93c5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_row_renderer.test.tsx
@@ -11,7 +11,7 @@ import React from 'react';
 import { ThemeProvider } from 'styled-components';
 
 import { mockBrowserFields } from '../../../../../common/containers/source/mock';
-import { Ecs } from '../../../../../graphql/types';
+import { Ecs } from '../../../../../../common/ecs';
 import { mockTimelineData } from '../../../../../common/mock';
 import { plainRowRenderer } from './plain_row_renderer';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/row_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/row_renderer.tsx
index 609e9dba1a46e..c4f8d35a5544f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/row_renderer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/row_renderer.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 
 import { BrowserFields } from '../../../../../common/containers/source';
 import type { RowRendererId } from '../../../../../../common/types/timeline';
-import { Ecs } from '../../../../../graphql/types';
+import { Ecs } from '../../../../../../common/ecs';
 import { EventsTrSupplement } from '../../styles';
 
 interface RowRendererContainerProps {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_details.tsx
index c21b609a0f91e..891780d7df520 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_details.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import styled from 'styled-components';
 
 import { BrowserFields } from '../../../../../../common/containers/source';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 
 import { NetflowRenderer } from '../netflow';
 import { SuricataSignature } from './suricata_signature';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_row_renderer.test.tsx
index 7d700732a6409..bed2171715380 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_row_renderer.test.tsx
@@ -9,7 +9,7 @@ import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 
 import { mockBrowserFields } from '../../../../../../common/containers/source/mock';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { mockTimelineData } from '../../../../../../common/mock';
 import '../../../../../../common/mock/match_media';
 import { TestProviders } from '../../../../../../common/mock/test_providers';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_details.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_details.test.tsx.snap
index 177a3531e5d7b..3952f05d34d25 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_details.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_details.test.tsx.snap
@@ -19,40 +19,23 @@ exports[`SystemGenericDetails rendering it renders the default SystemGenericDeta
     data={
       Object {
         "_id": "29",
-        "auditd": null,
-        "destination": null,
         "event": Object {
           "action": Array [
             "user_login",
           ],
-          "category": null,
-          "created": null,
           "dataset": Array [
             "login",
           ],
-          "duration": null,
-          "end": null,
-          "hash": null,
-          "id": null,
           "kind": Array [
             "event",
           ],
           "module": Array [
             "system",
           ],
-          "original": null,
           "outcome": Array [
             "failure",
           ],
-          "risk_score": null,
-          "risk_score_norm": null,
-          "severity": null,
-          "start": null,
-          "timezone": null,
-          "type": null,
         },
-        "file": null,
-        "geo": null,
         "host": Object {
           "id": Array [
             "7c21f5ed03b04d0299569d221fe18bbc",
@@ -66,38 +49,21 @@ exports[`SystemGenericDetails rendering it renders the default SystemGenericDeta
             "zeek-london",
           ],
         },
-        "http": null,
-        "network": null,
         "process": Object {
-          "args": null,
-          "executable": null,
-          "name": null,
           "pid": Array [
             6278,
           ],
-          "ppid": null,
-          "title": null,
-          "working_directory": null,
         },
         "source": Object {
-          "bytes": null,
-          "geo": null,
           "ip": Array [
             "128.199.212.120",
           ],
-          "packets": null,
-          "port": null,
         },
-        "suricata": null,
-        "system": null,
-        "tls": null,
-        "url": null,
         "user": Object {
           "name": Array [
             "Braden",
           ],
         },
-        "zeek": null,
       }
     }
     timelineId="test"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_file_details.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_file_details.test.tsx.snap
index 19b7f8b6f77c6..8045ce95ca272 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_file_details.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_file_details.test.tsx.snap
@@ -3,7 +3,6 @@
 exports[`SystemGenericFileDetails rendering it renders the default SystemGenericDetails 1`] = `
 <Details>
   <SystemGenericFileLine
-    args={null}
     contextId="[contextid-123]"
     eventAction="process_started"
     hostName="zeek-london"
@@ -22,40 +21,23 @@ exports[`SystemGenericFileDetails rendering it renders the default SystemGeneric
     data={
       Object {
         "_id": "30",
-        "auditd": null,
-        "destination": null,
         "event": Object {
           "action": Array [
             "process_started",
           ],
-          "category": null,
-          "created": null,
           "dataset": Array [
             "login",
           ],
-          "duration": null,
-          "end": null,
-          "hash": null,
-          "id": null,
           "kind": Array [
             "event",
           ],
           "module": Array [
             "system",
           ],
-          "original": null,
           "outcome": Array [
             "failure",
           ],
-          "risk_score": null,
-          "risk_score_norm": null,
-          "severity": null,
-          "start": null,
-          "timezone": null,
-          "type": null,
         },
-        "file": null,
-        "geo": null,
         "host": Object {
           "id": Array [
             "7c21f5ed03b04d0299569d221fe18bbc",
@@ -69,38 +51,21 @@ exports[`SystemGenericFileDetails rendering it renders the default SystemGeneric
             "zeek-london",
           ],
         },
-        "http": null,
-        "network": null,
         "process": Object {
-          "args": null,
-          "executable": null,
-          "name": null,
           "pid": Array [
             6278,
           ],
-          "ppid": null,
-          "title": null,
-          "working_directory": null,
         },
         "source": Object {
-          "bytes": null,
-          "geo": null,
           "ip": Array [
             "128.199.212.120",
           ],
-          "packets": null,
-          "port": null,
         },
-        "suricata": null,
-        "system": null,
-        "tls": null,
-        "url": null,
         "user": Object {
           "name": Array [
             "Evan",
           ],
         },
-        "zeek": null,
       }
     }
     timelineId="test"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_row_renderer.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_row_renderer.test.tsx.snap
index 6fff32925abf3..d2c405a46acf8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_row_renderer.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/__snapshots__/generic_row_renderer.test.tsx.snap
@@ -9,40 +9,23 @@ exports[`GenericRowRenderer #createGenericFileRowRenderer renders correctly agai
       data={
         Object {
           "_id": "29",
-          "auditd": null,
-          "destination": null,
           "event": Object {
             "action": Array [
               "user_login",
             ],
-            "category": null,
-            "created": null,
             "dataset": Array [
               "login",
             ],
-            "duration": null,
-            "end": null,
-            "hash": null,
-            "id": null,
             "kind": Array [
               "event",
             ],
             "module": Array [
               "system",
             ],
-            "original": null,
             "outcome": Array [
               "failure",
             ],
-            "risk_score": null,
-            "risk_score_norm": null,
-            "severity": null,
-            "start": null,
-            "timezone": null,
-            "type": null,
           },
-          "file": null,
-          "geo": null,
           "host": Object {
             "id": Array [
               "7c21f5ed03b04d0299569d221fe18bbc",
@@ -56,38 +39,21 @@ exports[`GenericRowRenderer #createGenericFileRowRenderer renders correctly agai
               "zeek-london",
             ],
           },
-          "http": null,
-          "network": null,
           "process": Object {
-            "args": null,
-            "executable": null,
-            "name": null,
             "pid": Array [
               6278,
             ],
-            "ppid": null,
-            "title": null,
-            "working_directory": null,
           },
           "source": Object {
-            "bytes": null,
-            "geo": null,
             "ip": Array [
               "128.199.212.120",
             ],
-            "packets": null,
-            "port": null,
           },
-          "suricata": null,
-          "system": null,
-          "tls": null,
-          "url": null,
           "user": Object {
             "name": Array [
               "Braden",
             ],
           },
-          "zeek": null,
         }
       }
       text="some text"
@@ -106,40 +72,23 @@ exports[`GenericRowRenderer #createGenericSystemRowRenderer renders correctly ag
       data={
         Object {
           "_id": "30",
-          "auditd": null,
-          "destination": null,
           "event": Object {
             "action": Array [
               "process_started",
             ],
-            "category": null,
-            "created": null,
             "dataset": Array [
               "login",
             ],
-            "duration": null,
-            "end": null,
-            "hash": null,
-            "id": null,
             "kind": Array [
               "event",
             ],
             "module": Array [
               "system",
             ],
-            "original": null,
             "outcome": Array [
               "failure",
             ],
-            "risk_score": null,
-            "risk_score_norm": null,
-            "severity": null,
-            "start": null,
-            "timezone": null,
-            "type": null,
           },
-          "file": null,
-          "geo": null,
           "host": Object {
             "id": Array [
               "7c21f5ed03b04d0299569d221fe18bbc",
@@ -153,38 +102,21 @@ exports[`GenericRowRenderer #createGenericSystemRowRenderer renders correctly ag
               "zeek-london",
             ],
           },
-          "http": null,
-          "network": null,
           "process": Object {
-            "args": null,
-            "executable": null,
-            "name": null,
             "pid": Array [
               6278,
             ],
-            "ppid": null,
-            "title": null,
-            "working_directory": null,
           },
           "source": Object {
-            "bytes": null,
-            "geo": null,
             "ip": Array [
               "128.199.212.120",
             ],
-            "packets": null,
-            "port": null,
           },
-          "suricata": null,
-          "system": null,
-          "tls": null,
-          "url": null,
           "user": Object {
             "name": Array [
               "Evan",
             ],
           },
-          "zeek": null,
         }
       }
       text="some text"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_details.tsx
index e849732d07f6f..2c7920ce4f1aa 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_details.tsx
@@ -9,7 +9,7 @@ import { get } from 'lodash/fp';
 import React from 'react';
 
 import { BrowserFields } from '../../../../../../common/containers/source';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { DraggableBadge } from '../../../../../../common/components/draggables';
 import { OverflowField } from '../../../../../../common/components/tables/helpers';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx
index 3a95c0ea927c8..56c48d4ad9a18 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx
@@ -9,7 +9,7 @@ import { get } from 'lodash/fp';
 import React from 'react';
 
 import { BrowserFields } from '../../../../../../common/containers/source';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { DraggableBadge } from '../../../../../../common/components/draggables';
 import { OverflowField } from '../../../../../../common/components/tables/helpers';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_row_renderer.test.tsx
index bb997b9689270..6c2e9ad7535a1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_row_renderer.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 
 import { BrowserFields } from '../../../../../../common/containers/source';
 import { mockBrowserFields } from '../../../../../../common/containers/source/mock';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import {
   mockDnsEvent,
   mockFimFileCreatedEvent,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/unknown_column_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/unknown_column_renderer.test.tsx
index 856b7ca570f3c..0f4f8d1539a9e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/unknown_column_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/unknown_column_renderer.test.tsx
@@ -10,7 +10,7 @@ import { cloneDeep } from 'lodash';
 import React from 'react';
 import { ThemeProvider } from 'styled-components';
 
-import { TimelineNonEcsData } from '../../../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { defaultHeaders, mockTimelineData } from '../../../../../common/mock';
 import { getEmptyValue } from '../../../../../common/components/empty_value';
 import { unknownColumnRenderer } from './unknown_column_renderer';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_details.tsx
index 4f991429d6a4d..8b691ad557d89 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_details.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 import styled from 'styled-components';
 
 import { BrowserFields } from '../../../../../../common/containers/source';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 
 import { NetflowRenderer } from '../netflow';
 import { ZeekSignature } from './zeek_signature';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_row_renderer.test.tsx
index 23c38f83b89d4..9c08fbacafcdc 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_row_renderer.test.tsx
@@ -9,7 +9,7 @@ import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 
 import { mockBrowserFields } from '../../../../../../common/containers/source/mock';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { mockTimelineData, TestProviders } from '../../../../../../common/mock';
 import '../../../../../../common/mock/match_media';
 import { useMountAppended } from '../../../../../../common/utils/use_mount_appended';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.test.tsx
index 3b1ce431bfc87..efa22cb2c5617 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.test.tsx
@@ -9,7 +9,7 @@ import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 
 import '../../../../../../common/mock/match_media';
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import { mockTimelineData, TestProviders } from '../../../../../../common/mock';
 import { useMountAppended } from '../../../../../../common/utils/use_mount_appended';
 import {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.tsx
index 74f75a0a73386..07e32a9a4e5d1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.tsx
@@ -9,7 +9,7 @@ import { get } from 'lodash/fp';
 import React from 'react';
 import styled from 'styled-components';
 
-import { Ecs } from '../../../../../../graphql/types';
+import { Ecs } from '../../../../../../../common/ecs';
 import {
   DragEffects,
   DraggableWrapper,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx
index 9b7b896a2ec69..ef5689f494cd0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { noop } from 'lodash/fp';
 import memoizeOne from 'memoize-one';
 import React, { useCallback, useEffect, useMemo } from 'react';
 import { connect, ConnectedProps } from 'react-redux';
@@ -12,7 +11,7 @@ import deepEqual from 'fast-deep-equal';
 
 import { RowRendererId, TimelineId } from '../../../../../common/types/timeline';
 import { BrowserFields, DocValueFields } from '../../../../common/containers/source';
-import { TimelineItem } from '../../../../graphql/types';
+import { TimelineItem } from '../../../../../common/search_strategy/timeline';
 import { Note } from '../../../../common/lib/note';
 import { appSelectors, inputsModel, State } from '../../../../common/store';
 import { appActions } from '../../../../common/store/actions';
@@ -209,7 +208,6 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
         onColumnSorted={onColumnSorted}
         onRowSelected={onRowSelected}
         onSelectAll={onSelectAll}
-        onFilterChange={noop} // TODO: this is the callback for column filters, which is out scope for this phase of delivery
         onPinEvent={onPinEvent}
         onUnPinEvent={onUnPinEvent}
         onUpdateColumns={onUpdateColumns}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts
index 4653880739c6d..f894ac4e73939 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts
@@ -74,7 +74,7 @@ export type OnColumnResized = ({ columnId, delta }: { columnId: ColumnId; delta:
 export type OnChangeItemsPerPage = (itemsPerPage: number) => void;
 
 /** Invoked when a user clicks to load more item */
-export type OnLoadMore = (cursor: string, tieBreaker: string) => void;
+export type OnChangePage = (nextPage: number) => void;
 
 export type OnChangeDroppableAndProvider = (providerId: string) => void;
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx
index 49f17db242f75..b1f48608346c7 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx
@@ -9,7 +9,7 @@ import styled from 'styled-components';
 
 import { BrowserFields } from '../../../../common/containers/source';
 import { ColumnHeaderOptions } from '../../../../timelines/store/timeline/model';
-import { DetailItem } from '../../../../../common/search_strategy/timeline';
+import { TimelineEventsDetailsItem } from '../../../../../common/search_strategy/timeline';
 import { StatefulEventDetails } from '../../../../common/components/event_details/stateful_event_details';
 import { LazyAccordion } from '../../lazy_accordion';
 import { OnUpdateColumns } from '../events';
@@ -31,7 +31,7 @@ interface Props {
   browserFields: BrowserFields;
   columnHeaders: ColumnHeaderOptions[];
   id: string;
-  event: DetailItem[];
+  event: TimelineEventsDetailsItem[];
   forceExpand?: boolean;
   hideExpandButton?: boolean;
   onEventToggled: () => void;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/__snapshots__/index.test.tsx.snap
index f155b379227f0..f81934f9a1d91 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/__snapshots__/index.test.tsx.snap
@@ -27,8 +27,8 @@ exports[`Footer Timeline Component rendering it renders the default timeline foo
       >
         <EventsCount
           closePopover={[Function]}
-          documentType="events match the search criteria"
-          footerText="events match the search criteria"
+          documentType="events"
+          footerText="events"
           isOpen={false}
           items={
             Array [
@@ -73,10 +73,11 @@ exports[`Footer Timeline Component rendering it renders the default timeline foo
       grow={false}
     >
       <PagingControl
+        activePage={0}
         data-test-subj="paging-control"
-        hasNextPage={true}
         isLoading={false}
-        loadMore={[Function]}
+        onPageClick={[Function]}
+        totalPages={2}
       />
     </EuiFlexItem>
     <EuiFlexItem
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.test.tsx
index 6675ff493d563..01e5202d03332 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.test.tsx
@@ -5,7 +5,6 @@
  */
 
 import { mount, shallow } from 'enzyme';
-import { getOr } from 'lodash/fp';
 import React from 'react';
 
 import { TestProviders } from '../../../../common/mock/test_providers';
@@ -16,14 +15,14 @@ import { mockData } from './mock';
 describe('Footer Timeline Component', () => {
   const loadMore = jest.fn();
   const onChangeItemsPerPage = jest.fn();
-  const getUpdatedAt = () => 1546878704036;
+  const updatedAt = 1546878704036;
 
   describe('rendering', () => {
     test('it renders the default timeline footer', () => {
       const wrapper = shallow(
         <FooterComponent
-          getUpdatedAt={getUpdatedAt}
-          hasNextPage={getOr(false, 'hasNextPage', mockData.Events.pageInfo)!}
+          activePage={0}
+          updatedAt={updatedAt}
           height={100}
           id={'timeline-id'}
           isLive={false}
@@ -31,11 +30,10 @@ describe('Footer Timeline Component', () => {
           itemsCount={mockData.Events.edges.length}
           itemsPerPage={2}
           itemsPerPageOptions={[1, 5, 10, 20]}
-          nextCursor={getOr(null, 'endCursor.value', mockData.Events.pageInfo)!}
           onChangeItemsPerPage={onChangeItemsPerPage}
-          onLoadMore={loadMore}
+          onChangePage={loadMore}
           serverSideEventCount={mockData.Events.totalCount}
-          tieBreaker={getOr(null, 'endCursor.tiebreaker', mockData.Events.pageInfo)}
+          totalPages={2}
         />
       );
 
@@ -45,8 +43,8 @@ describe('Footer Timeline Component', () => {
     test('it renders the loading panel at the beginning ', () => {
       const wrapper = mount(
         <FooterComponent
-          getUpdatedAt={getUpdatedAt}
-          hasNextPage={false}
+          activePage={0}
+          updatedAt={updatedAt}
           height={100}
           id={'timeline-id'}
           isLive={false}
@@ -54,11 +52,10 @@ describe('Footer Timeline Component', () => {
           itemsCount={mockData.Events.edges.length}
           itemsPerPage={2}
           itemsPerPageOptions={[1, 5, 10, 20]}
-          nextCursor={getOr(null, 'endCursor.value', mockData.Events.pageInfo)!}
           onChangeItemsPerPage={onChangeItemsPerPage}
-          onLoadMore={loadMore}
+          onChangePage={loadMore}
           serverSideEventCount={mockData.Events.totalCount}
-          tieBreaker={getOr(null, 'endCursor.tiebreaker', mockData.Events.pageInfo)}
+          totalPages={2}
         />
       );
 
@@ -69,8 +66,8 @@ describe('Footer Timeline Component', () => {
       const wrapper = mount(
         <TestProviders>
           <FooterComponent
-            getUpdatedAt={getUpdatedAt}
-            hasNextPage={getOr(false, 'hasNextPage', mockData.Events.pageInfo)!}
+            activePage={0}
+            updatedAt={updatedAt}
             height={100}
             id={'timeline-id'}
             isLive={false}
@@ -78,50 +75,50 @@ describe('Footer Timeline Component', () => {
             itemsCount={mockData.Events.edges.length}
             itemsPerPage={2}
             itemsPerPageOptions={[1, 5, 10, 20]}
-            nextCursor={getOr(null, 'endCursor.value', mockData.Events.pageInfo)!}
             onChangeItemsPerPage={onChangeItemsPerPage}
-            onLoadMore={loadMore}
+            onChangePage={loadMore}
             serverSideEventCount={mockData.Events.totalCount}
-            tieBreaker={getOr(null, 'endCursor.tiebreaker', mockData.Events.pageInfo)}
+            totalPages={2}
           />
         </TestProviders>
       );
 
-      expect(wrapper.find('[data-test-subj="TimelineMoreButton"]').exists()).toBeTruthy();
+      expect(wrapper.find('[data-test-subj="timeline-pagination"]').exists()).toBeTruthy();
     });
 
     test('it renders the Loading... in the more load button when fetching new data', () => {
       const wrapper = shallow(
         <PagingControlComponent
-          hasNextPage={getOr(false, 'hasNextPage', mockData.Events.pageInfo)!}
-          loadMore={loadMore}
+          activePage={0}
+          totalPages={3}
+          onPageClick={loadMore}
           isLoading={true}
         />
       );
 
-      const loadButton = wrapper.find('[data-test-subj="TimelineMoreButton"]').dive().text();
+      const loadButton = wrapper.text();
       expect(wrapper.find('[data-test-subj="LoadingPanelTimeline"]').exists()).toBeFalsy();
       expect(loadButton).toContain('Loading...');
     });
 
-    test('it renders the Load More in the more load button when fetching new data', () => {
+    test('it renders the Pagination in the more load button when fetching new data', () => {
       const wrapper = shallow(
         <PagingControlComponent
-          hasNextPage={getOr(false, 'hasNextPage', mockData.Events.pageInfo)!}
-          loadMore={loadMore}
+          activePage={0}
+          totalPages={3}
+          onPageClick={loadMore}
           isLoading={false}
         />
       );
 
-      const loadButton = wrapper.find('[data-test-subj="TimelineMoreButton"]').dive().text();
-      expect(loadButton).toContain('Load more');
+      expect(wrapper.find('[data-test-subj="timeline-pagination"]').exists()).toBeTruthy();
     });
 
     test('it does NOT render the loadMore button because there is nothing else to fetch', () => {
       const wrapper = mount(
         <FooterComponent
-          getUpdatedAt={getUpdatedAt}
-          hasNextPage={false}
+          activePage={0}
+          updatedAt={updatedAt}
           height={100}
           id={'timeline-id'}
           isLive={false}
@@ -129,23 +126,22 @@ describe('Footer Timeline Component', () => {
           itemsCount={mockData.Events.edges.length}
           itemsPerPage={2}
           itemsPerPageOptions={[1, 5, 10, 20]}
-          nextCursor={getOr(null, 'endCursor.value', mockData.Events.pageInfo)!}
           onChangeItemsPerPage={onChangeItemsPerPage}
-          onLoadMore={loadMore}
+          onChangePage={loadMore}
           serverSideEventCount={mockData.Events.totalCount}
-          tieBreaker={getOr(null, 'endCursor.tiebreaker', mockData.Events.pageInfo)}
+          totalPages={2}
         />
       );
 
-      expect(wrapper.find('[data-test-subj="TimelineMoreButton"]').exists()).toBeFalsy();
+      expect(wrapper.find('[data-test-subj="timeline-pagination"]').exists()).toBeFalsy();
     });
 
     test('it render popover to select new itemsPerPage in timeline', () => {
       const wrapper = mount(
         <TestProviders>
           <FooterComponent
-            getUpdatedAt={getUpdatedAt}
-            hasNextPage={getOr(false, 'hasNextPage', mockData.Events.pageInfo)!}
+            activePage={0}
+            updatedAt={updatedAt}
             height={100}
             id={'timeline-id'}
             isLive={false}
@@ -153,11 +149,10 @@ describe('Footer Timeline Component', () => {
             itemsCount={mockData.Events.edges.length}
             itemsPerPage={1}
             itemsPerPageOptions={[1, 5, 10, 20]}
-            nextCursor={getOr(null, 'endCursor.value', mockData.Events.pageInfo)!}
             onChangeItemsPerPage={onChangeItemsPerPage}
-            onLoadMore={loadMore}
+            onChangePage={loadMore}
             serverSideEventCount={mockData.Events.totalCount}
-            tieBreaker={getOr(null, 'endCursor.tiebreaker', mockData.Events.pageInfo)}
+            totalPages={2}
           />
         </TestProviders>
       );
@@ -172,8 +167,8 @@ describe('Footer Timeline Component', () => {
       const wrapper = mount(
         <TestProviders>
           <FooterComponent
-            getUpdatedAt={getUpdatedAt}
-            hasNextPage={getOr(false, 'hasNextPage', mockData.Events.pageInfo)!}
+            activePage={0}
+            updatedAt={updatedAt}
             height={100}
             id={'timeline-id'}
             isLive={false}
@@ -181,17 +176,15 @@ describe('Footer Timeline Component', () => {
             itemsCount={mockData.Events.edges.length}
             itemsPerPage={2}
             itemsPerPageOptions={[1, 5, 10, 20]}
-            nextCursor={getOr(null, 'endCursor.value', mockData.Events.pageInfo)!}
             onChangeItemsPerPage={onChangeItemsPerPage}
-            onLoadMore={loadMore}
+            onChangePage={loadMore}
             serverSideEventCount={mockData.Events.totalCount}
-            tieBreaker={getOr(null, 'endCursor.tiebreaker', mockData.Events.pageInfo)}
+            totalPages={2}
           />
         </TestProviders>
       );
 
-      wrapper.find('[data-test-subj="TimelineMoreButton"]').first().simulate('click');
-
+      wrapper.find('[data-test-subj="pagination-button-next"]').first().simulate('click');
       expect(loadMore).toBeCalled();
     });
 
@@ -199,8 +192,8 @@ describe('Footer Timeline Component', () => {
       const wrapper = mount(
         <TestProviders>
           <FooterComponent
-            getUpdatedAt={getUpdatedAt}
-            hasNextPage={getOr(false, 'hasNextPage', mockData.Events.pageInfo)!}
+            activePage={0}
+            updatedAt={updatedAt}
             height={100}
             id={'timeline-id'}
             isLive={false}
@@ -208,11 +201,10 @@ describe('Footer Timeline Component', () => {
             itemsCount={mockData.Events.edges.length}
             itemsPerPage={1}
             itemsPerPageOptions={[1, 5, 10, 20]}
-            nextCursor={getOr(null, 'endCursor.value', mockData.Events.pageInfo)!}
             onChangeItemsPerPage={onChangeItemsPerPage}
-            onLoadMore={loadMore}
+            onChangePage={loadMore}
             serverSideEventCount={mockData.Events.totalCount}
-            tieBreaker={getOr(null, 'endCursor.tiebreaker', mockData.Events.pageInfo)}
+            totalPages={2}
           />
         </TestProviders>
       );
@@ -227,8 +219,8 @@ describe('Footer Timeline Component', () => {
       const wrapper = mount(
         <TestProviders>
           <FooterComponent
-            getUpdatedAt={getUpdatedAt}
-            hasNextPage={getOr(false, 'hasNextPage', mockData.Events.pageInfo)!}
+            activePage={0}
+            updatedAt={updatedAt}
             height={100}
             id={'timeline-id'}
             isLive={true}
@@ -236,11 +228,10 @@ describe('Footer Timeline Component', () => {
             itemsCount={mockData.Events.edges.length}
             itemsPerPage={2}
             itemsPerPageOptions={[1, 5, 10, 20]}
-            nextCursor={getOr(null, 'endCursor.value', mockData.Events.pageInfo)!}
             onChangeItemsPerPage={onChangeItemsPerPage}
-            onLoadMore={loadMore}
+            onChangePage={loadMore}
             serverSideEventCount={mockData.Events.totalCount}
-            tieBreaker={getOr(null, 'endCursor.tiebreaker', mockData.Events.pageInfo)}
+            totalPages={2}
           />
         </TestProviders>
       );
@@ -253,8 +244,8 @@ describe('Footer Timeline Component', () => {
       const wrapper = mount(
         <TestProviders>
           <FooterComponent
-            getUpdatedAt={getUpdatedAt}
-            hasNextPage={getOr(false, 'hasNextPage', mockData.Events.pageInfo)!}
+            activePage={0}
+            updatedAt={updatedAt}
             height={100}
             id={'timeline-id'}
             isLive={false}
@@ -262,11 +253,10 @@ describe('Footer Timeline Component', () => {
             itemsCount={mockData.Events.edges.length}
             itemsPerPage={2}
             itemsPerPageOptions={[1, 5, 10, 20]}
-            nextCursor={getOr(null, 'endCursor.value', mockData.Events.pageInfo)!}
             onChangeItemsPerPage={onChangeItemsPerPage}
-            onLoadMore={loadMore}
+            onChangePage={loadMore}
             serverSideEventCount={mockData.Events.totalCount}
-            tieBreaker={getOr(null, 'endCursor.tiebreaker', mockData.Events.pageInfo)}
+            totalPages={2}
           />
         </TestProviders>
       );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx
index 3169201b12c7b..7174e9b2121e5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx
@@ -6,7 +6,6 @@
 
 import {
   EuiBadge,
-  EuiButton,
   EuiButtonEmpty,
   EuiContextMenuItem,
   EuiContextMenuPanel,
@@ -17,13 +16,14 @@ import {
   EuiText,
   EuiToolTip,
   EuiPopoverProps,
+  EuiPagination,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { FC, useCallback, useEffect, useState, useMemo } from 'react';
 import styled from 'styled-components';
 
 import { LoadingPanel } from '../../loading';
-import { OnChangeItemsPerPage, OnLoadMore } from '../events';
+import { OnChangeItemsPerPage, OnChangePage } from '../events';
 
 import { LastUpdatedAt } from './last_updated';
 import * as i18n from './translations';
@@ -175,24 +175,26 @@ export const EventsCount = React.memo(EventsCountComponent);
 EventsCount.displayName = 'EventsCount';
 
 export const PagingControlComponent = ({
-  hasNextPage,
+  activePage,
   isLoading,
-  loadMore,
+  onPageClick,
+  totalPages,
 }: {
-  hasNextPage: boolean;
+  activePage: number;
   isLoading: boolean;
-  loadMore: () => void;
+  onPageClick: OnChangePage;
+  totalPages: number;
 }) => (
   <>
-    {hasNextPage && (
-      <EuiButton
-        data-test-subj="TimelineMoreButton"
-        isLoading={isLoading}
-        onClick={loadMore}
-        size="s"
-      >
-        {isLoading ? `${i18n.LOADING}...` : i18n.LOAD_MORE}
-      </EuiButton>
+    {isLoading ? (
+      `${i18n.LOADING}...`
+    ) : (
+      <EuiPagination
+        data-test-subj="timeline-pagination"
+        pageCount={totalPages}
+        activePage={activePage}
+        onPageClick={onPageClick}
+      />
     )}
   </>
 );
@@ -202,10 +204,9 @@ PagingControlComponent.displayName = 'PagingControlComponent';
 export const PagingControl = React.memo(PagingControlComponent);
 
 PagingControl.displayName = 'PagingControl';
-
 interface FooterProps {
-  getUpdatedAt: () => number;
-  hasNextPage: boolean;
+  updatedAt: number;
+  activePage: number;
   height: number;
   id: string;
   isLive: boolean;
@@ -213,17 +214,16 @@ interface FooterProps {
   itemsCount: number;
   itemsPerPage: number;
   itemsPerPageOptions: number[];
-  nextCursor: string;
   onChangeItemsPerPage: OnChangeItemsPerPage;
-  onLoadMore: OnLoadMore;
+  onChangePage: OnChangePage;
   serverSideEventCount: number;
-  tieBreaker: string;
+  totalPages: number;
 }
 
 /** Renders a loading indicator and paging controls */
 export const FooterComponent = ({
-  getUpdatedAt,
-  hasNextPage,
+  activePage,
+  updatedAt,
   height,
   id,
   isLive,
@@ -231,15 +231,13 @@ export const FooterComponent = ({
   itemsCount,
   itemsPerPage,
   itemsPerPageOptions,
-  nextCursor,
   onChangeItemsPerPage,
-  onLoadMore,
+  onChangePage,
   serverSideEventCount,
-  tieBreaker,
+  totalPages,
 }: FooterProps) => {
   const [isPopoverOpen, setIsPopoverOpen] = useState(false);
   const [paginationLoading, setPaginationLoading] = useState(false);
-  const [updatedAt, setUpdatedAt] = useState<number | null>(null);
 
   const { getManageTimelineById } = useManageTimeline();
   const { documentType, loadingText, footerText } = useMemo(() => getManageTimelineById(id), [
@@ -247,10 +245,13 @@ export const FooterComponent = ({
     id,
   ]);
 
-  const loadMore = useCallback(() => {
-    setPaginationLoading(true);
-    onLoadMore(nextCursor, tieBreaker);
-  }, [nextCursor, tieBreaker, onLoadMore, setPaginationLoading]);
+  const handleChangePageClick = useCallback(
+    (nextPage: number) => {
+      setPaginationLoading(true);
+      onChangePage(nextPage);
+    },
+    [onChangePage]
+  );
 
   const onButtonClick = useCallback(() => setIsPopoverOpen(!isPopoverOpen), [
     isPopoverOpen,
@@ -261,14 +262,8 @@ export const FooterComponent = ({
   useEffect(() => {
     if (paginationLoading && !isLoading) {
       setPaginationLoading(false);
-      setUpdatedAt(getUpdatedAt());
-    }
-
-    if (updatedAt === null || !isLoading) {
-      setUpdatedAt(getUpdatedAt());
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [isLoading]);
+  }, [isLoading, paginationLoading]);
 
   if (isLoading && !paginationLoading) {
     return (
@@ -358,15 +353,16 @@ export const FooterComponent = ({
           ) : (
             <PagingControl
               data-test-subj="paging-control"
-              hasNextPage={hasNextPage}
+              totalPages={totalPages}
+              activePage={activePage}
+              onPageClick={handleChangePageClick}
               isLoading={isLoading}
-              loadMore={loadMore}
             />
           )}
         </EuiFlexItem>
 
         <EuiFlexItem data-test-subj="last-updated-container" grow={false}>
-          <FixedWidthLastUpdatedContainer updatedAt={updatedAt || getUpdatedAt()} />
+          <FixedWidthLastUpdatedContainer updatedAt={updatedAt} />
         </EuiFlexItem>
       </FooterFlexGroup>
     </FooterContainer>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/translations.ts
index e0254d0f4a62f..f581d0757bc3c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/translations.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/translations.ts
@@ -29,14 +29,10 @@ export const LOADING = i18n.translate('xpack.securitySolution.footer.loadingLabe
   defaultMessage: 'Loading',
 });
 
-export const LOAD_MORE = i18n.translate('xpack.securitySolution.footer.loadMoreLabel', {
-  defaultMessage: 'Load more',
-});
-
 export const TOTAL_COUNT_OF_EVENTS = i18n.translate(
   'xpack.securitySolution.footer.totalCountOfEvents',
   {
-    defaultMessage: 'events match the search criteria',
+    defaultMessage: 'events',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
index 51edf7336c4e7..f1bfdd5d33606 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
@@ -20,7 +20,6 @@ import { mocksSource } from '../../../common/containers/source/mock';
 import { wait as waitFor } from '@testing-library/react';
 import { defaultHeaders, mockTimelineData, TestProviders } from '../../../common/mock';
 import { Direction } from '../../../graphql/types';
-import { timelineQuery } from '../../containers/index.gql_query';
 import { timelineActions } from '../../store/timeline';
 
 import { Sort } from './body/sort';
@@ -28,6 +27,11 @@ import { mockDataProviders } from './data_providers/mock/mock_data_providers';
 import { StatefulTimeline, Props as StatefulTimelineProps } from './index';
 import { Timeline } from './timeline';
 import { TimelineType, TimelineStatus } from '../../../../common/types/timeline';
+import { useTimelineEvents } from '../../containers/index';
+
+jest.mock('../../containers/index', () => ({
+  useTimelineEvents: jest.fn(),
+}));
 
 jest.mock('../../../common/lib/kibana', () => {
   const originalModule = jest.requireActual('../../../common/lib/kibana');
@@ -63,12 +67,10 @@ describe('StatefulTimeline', () => {
   const startDate = '2018-03-23T18:49:23.132Z';
   const endDate = '2018-03-24T03:33:52.253Z';
 
-  const mocks = [
-    { request: { query: timelineQuery }, result: { data: { events: mockTimelineData } } },
-    ...mocksSource,
-  ];
+  const mocks = mocksSource;
 
   beforeEach(() => {
+    (useTimelineEvents as jest.Mock).mockReturnValue([false, { events: mockTimelineData }]);
     props = {
       addProvider: timelineActions.addProvider,
       columns: defaultHeaders,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
index 55c0709bd5543..f1f419fd4b52a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
@@ -4,17 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { isEmpty } from 'lodash/fp';
 import { useCallback, useState, useEffect } from 'react';
 import { useDispatch, useSelector, shallowEqual } from 'react-redux';
-import { useBasePath } from '../../../../common/lib/kibana';
+import { SecurityPageName } from '../../../../../common/constants';
+import { getTimelineUrl, useFormatUrl } from '../../../../common/components/link_to';
 import { CursorPosition } from '../../../../common/components/markdown_editor';
 import { timelineActions, timelineSelectors } from '../../../../timelines/store/timeline';
 import { setInsertTimeline } from '../../../store/timeline/actions';
 
 export const useInsertTimeline = (value: string, onChange: (newValue: string) => void) => {
-  const basePath = window.location.origin + useBasePath();
   const dispatch = useDispatch();
+  const { formatUrl } = useFormatUrl(SecurityPageName.timelines);
   const [cursorPosition, setCursorPosition] = useState<CursorPosition>({
     start: 0,
     end: 0,
@@ -24,21 +24,22 @@ export const useInsertTimeline = (value: string, onChange: (newValue: string) =>
 
   const handleOnTimelineChange = useCallback(
     (title: string, id: string | null, graphEventId?: string) => {
-      const builtLink = `${basePath}/app/security/timelines?timeline=(id:'${id}'${
-        !isEmpty(graphEventId) ? `,graphEventId:'${graphEventId}'` : ''
-      },isOpen:!t)`;
+      const url = formatUrl(getTimelineUrl(id ?? '', graphEventId), {
+        absolute: true,
+        skipSearch: true,
+      });
 
       const newValue: string = [
         value.slice(0, cursorPosition.start),
         cursorPosition.start === cursorPosition.end
-          ? `[${title}](${builtLink})`
-          : `[${value.slice(cursorPosition.start, cursorPosition.end)}](${builtLink})`,
+          ? `[${title}](${url})`
+          : `[${value.slice(cursorPosition.start, cursorPosition.end)}](${url})`,
         value.slice(cursorPosition.end),
       ].join('');
 
       onChange(newValue);
     },
-    [value, onChange, basePath, cursorPosition]
+    [value, onChange, cursorPosition, formatUrl]
   );
 
   const handleCursorChange = useCallback((cp: CursorPosition) => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx
index 555b22eff0c91..887a6a546d2b7 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.test.tsx
@@ -6,10 +6,8 @@
 
 import { shallow } from 'enzyme';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 import useResizeObserver from 'use-resize-observer/polyfilled';
 
-import { timelineQuery } from '../../containers/index.gql_query';
 import { mockBrowserFields } from '../../../common/containers/source/mock';
 import { Direction } from '../../../graphql/types';
 import { defaultHeaders, mockTimelineData, mockIndexPattern } from '../../../common/mock';
@@ -26,7 +24,19 @@ import { Sort } from './body/sort';
 import { mockDataProviders } from './data_providers/mock/mock_data_providers';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { TimelineStatus, TimelineType } from '../../../../common/types/timeline';
-
+import { useTimelineEvents } from '../../containers/index';
+import { useTimelineEventsDetails } from '../../containers/details/index';
+
+jest.mock('../../containers/index', () => ({
+  useTimelineEvents: jest.fn(),
+}));
+jest.mock('../../containers/details/index', () => ({
+  useTimelineEventsDetails: jest.fn(),
+}));
+jest.mock('./body/events/index', () => ({
+  // eslint-disable-next-line react/display-name
+  Events: () => <></>,
+}));
 jest.mock('../../../common/lib/kibana');
 jest.mock('./properties/properties_right');
 const mockUseResizeObserver: jest.Mock = useResizeObserver as jest.Mock;
@@ -42,6 +52,7 @@ jest.mock('../../../common/lib/kibana', () => {
       services: {
         application: {
           navigateToApp: jest.fn(),
+          getUrlForApp: jest.fn(),
         },
         uiSettings: {
           get: jest.fn(),
@@ -65,13 +76,21 @@ describe('Timeline', () => {
 
   const indexPattern = mockIndexPattern;
 
-  const mocks = [
-    { request: { query: timelineQuery }, result: { data: { events: mockTimelineData } } },
-  ];
-
   const mount = useMountAppended();
 
   beforeEach(() => {
+    (useTimelineEvents as jest.Mock).mockReturnValue([
+      false,
+      {
+        events: mockTimelineData,
+        pageInfo: {
+          activePage: 0,
+          totalPages: 10,
+        },
+      },
+    ]);
+    (useTimelineEventsDetails as jest.Mock).mockReturnValue([false, {}]);
+
     props = {
       browserFields: mockBrowserFields,
       columns: defaultHeaders,
@@ -123,9 +142,7 @@ describe('Timeline', () => {
     test('it renders the timeline header', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocks}>
-            <TimelineComponent {...props} />
-          </MockedProvider>
+          <TimelineComponent {...props} />
         </TestProviders>
       );
 
@@ -135,9 +152,7 @@ describe('Timeline', () => {
     test('it renders the title field', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocks}>
-            <TimelineComponent {...props} />
-          </MockedProvider>
+          <TimelineComponent {...props} />
         </TestProviders>
       );
 
@@ -149,9 +164,7 @@ describe('Timeline', () => {
     test('it renders the timeline table', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocks}>
-            <TimelineComponent {...props} />
-          </MockedProvider>
+          <TimelineComponent {...props} />
         </TestProviders>
       );
 
@@ -161,9 +174,7 @@ describe('Timeline', () => {
     test('it does NOT render the timeline table when the source is loading', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocks}>
-            <TimelineComponent {...props} isLoadingSource={true} />
-          </MockedProvider>
+          <TimelineComponent {...props} isLoadingSource={true} />
         </TestProviders>
       );
 
@@ -173,9 +184,7 @@ describe('Timeline', () => {
     test('it does NOT render the timeline table when start is empty', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocks}>
-            <TimelineComponent {...props} start={''} />
-          </MockedProvider>
+          <TimelineComponent {...props} start={''} />
         </TestProviders>
       );
 
@@ -185,9 +194,7 @@ describe('Timeline', () => {
     test('it does NOT render the timeline table when end is empty', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocks}>
-            <TimelineComponent {...props} end={''} />
-          </MockedProvider>
+          <TimelineComponent {...props} end={''} />
         </TestProviders>
       );
 
@@ -197,9 +204,7 @@ describe('Timeline', () => {
     test('it does NOT render the paging footer when you do NOT have any data providers', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocks}>
-            <TimelineComponent {...props} />
-          </MockedProvider>
+          <TimelineComponent {...props} />
         </TestProviders>
       );
 
@@ -209,9 +214,7 @@ describe('Timeline', () => {
     test('it defaults to showing `All`', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocks}>
-            <TimelineComponent {...props} />
-          </MockedProvider>
+          <TimelineComponent {...props} />
         </TestProviders>
       );
 
@@ -221,9 +224,7 @@ describe('Timeline', () => {
     it('it shows the timeline footer', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mocks}>
-            <TimelineComponent {...props} />
-          </MockedProvider>
+          <TimelineComponent {...props} />
         </TestProviders>
       );
 
@@ -236,9 +237,7 @@ describe('Timeline', () => {
       it('should not show the timeline footer', () => {
         const wrapper = mount(
           <TestProviders>
-            <MockedProvider mocks={mocks}>
-              <TimelineComponent {...props} />
-            </MockedProvider>
+            <TimelineComponent {...props} />
           </TestProviders>
         );
 
@@ -252,9 +251,7 @@ describe('Timeline', () => {
       test('it invokes the onDataProviderRemoved callback when the delete button on a provider is clicked', () => {
         const wrapper = mount(
           <TestProviders>
-            <MockedProvider mocks={mocks}>
-              <TimelineComponent {...props} />
-            </MockedProvider>
+            <TimelineComponent {...props} />
           </TestProviders>
         );
 
@@ -271,9 +268,7 @@ describe('Timeline', () => {
       test('it invokes the onDataProviderRemoved callback when you click on the option "Delete" in the provider menu', () => {
         const wrapper = mount(
           <TestProviders>
-            <MockedProvider mocks={mocks}>
-              <TimelineComponent {...props} />
-            </MockedProvider>
+            <TimelineComponent {...props} />
           </TestProviders>
         );
         wrapper.find('button[data-test-subj="providerBadge"]').first().simulate('click');
@@ -295,9 +290,7 @@ describe('Timeline', () => {
       test('it invokes the onToggleDataProviderEnabled callback when you click on the option "Temporary disable" in the provider menu', () => {
         const wrapper = mount(
           <TestProviders>
-            <MockedProvider mocks={mocks}>
-              <TimelineComponent {...props} />
-            </MockedProvider>
+            <TimelineComponent {...props} />
           </TestProviders>
         );
 
@@ -321,9 +314,7 @@ describe('Timeline', () => {
       test('it invokes the onToggleDataProviderExcluded callback when you click on the option "Exclude results" in the provider menu', () => {
         const wrapper = mount(
           <TestProviders>
-            <MockedProvider mocks={mocks}>
-              <TimelineComponent {...props} />
-            </MockedProvider>
+            <TimelineComponent {...props} />
           </TestProviders>
         );
 
@@ -355,9 +346,7 @@ describe('Timeline', () => {
       test('Rendering And Provider', () => {
         const wrapper = mount(
           <TestProviders>
-            <MockedProvider mocks={mocks}>
-              <TimelineComponent {...props} dataProviders={dataProviders} />
-            </MockedProvider>
+            <TimelineComponent {...props} dataProviders={dataProviders} />
           </TestProviders>
         );
 
@@ -375,9 +364,7 @@ describe('Timeline', () => {
       test('it invokes the onDataProviderRemoved callback when you click on the option "Delete" in the accordion menu', () => {
         const wrapper = mount(
           <TestProviders>
-            <MockedProvider mocks={mocks}>
-              <TimelineComponent {...props} dataProviders={dataProviders} />
-            </MockedProvider>
+            <TimelineComponent {...props} dataProviders={dataProviders} />
           </TestProviders>
         );
 
@@ -404,9 +391,7 @@ describe('Timeline', () => {
       test('it invokes the onToggleDataProviderEnabled callback when you click on the option "Temporary disable" in the accordion menu', () => {
         const wrapper = mount(
           <TestProviders>
-            <MockedProvider mocks={mocks}>
-              <TimelineComponent {...props} dataProviders={dataProviders} />
-            </MockedProvider>
+            <TimelineComponent {...props} dataProviders={dataProviders} />
           </TestProviders>
         );
 
@@ -434,9 +419,7 @@ describe('Timeline', () => {
       test('it invokes the onToggleDataProviderExcluded callback when you click on the option "Exclude results" in the accordion menu', () => {
         const wrapper = mount(
           <TestProviders>
-            <MockedProvider mocks={mocks}>
-              <TimelineComponent {...props} dataProviders={dataProviders} />
-            </MockedProvider>
+            <TimelineComponent {...props} dataProviders={dataProviders} />
           </TestProviders>
         );
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
index 7b1c1bd2119cd..434c7075a9470 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
@@ -5,14 +5,14 @@
  */
 
 import { EuiFlyoutHeader, EuiFlyoutBody, EuiFlyoutFooter, EuiProgress } from '@elastic/eui';
-import { getOr, isEmpty } from 'lodash/fp';
+import { isEmpty } from 'lodash/fp';
 import React, { useState, useMemo, useEffect } from 'react';
 import styled from 'styled-components';
 
 import { FlyoutHeaderWithCloseButton } from '../flyout/header_with_close_button';
 import { BrowserFields, DocValueFields } from '../../../common/containers/source';
-import { TimelineQuery } from '../../containers/index';
-import { Direction } from '../../../graphql/types';
+import { Direction } from '../../../../common/search_strategy';
+import { useTimelineEvents } from '../../containers/index';
 import { useKibana } from '../../../common/lib/kibana';
 import { ColumnHeaderOptions, KqlMode, EventType } from '../../../timelines/store/timeline/model';
 import { defaultHeaders } from './body/column_headers/default_headers';
@@ -217,13 +217,14 @@ export const TimelineComponent: React.FC<Props> = ({
   }, [columnsHeader]);
   const timelineQuerySortField = useMemo(
     () => ({
-      sortFieldId: sort.columnId,
+      field: sort.columnId,
       direction: sort.sortDirection as Direction,
     }),
     [sort.columnId, sort.sortDirection]
   );
   const [isQueryLoading, setIsQueryLoading] = useState(false);
   const { initializeTimeline, setIndexToAdd, setIsTimelineLoading } = useManageTimeline();
+
   useEffect(() => {
     initializeTimeline({
       filterManager,
@@ -233,6 +234,23 @@ export const TimelineComponent: React.FC<Props> = ({
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
+  const [
+    loading,
+    { events, inspect, totalCount, pageInfo, loadPage, updatedAt, refetch },
+  ] = useTimelineEvents({
+    docValueFields,
+    endDate: end,
+    eventType,
+    id,
+    indexToAdd,
+    fields: timelineQueryFields,
+    limit: itemsPerPage,
+    filterQuery: combinedQueries?.filterQuery ?? '',
+    startDate: start,
+    skip: canQueryTimeline,
+    sort: timelineQuerySortField,
+  });
+
   useEffect(() => {
     setIsTimelineLoading({ id, isLoading: isQueryLoading || loadingIndexName });
   }, [loadingIndexName, id, isQueryLoading, setIsTimelineLoading]);
@@ -241,6 +259,10 @@ export const TimelineComponent: React.FC<Props> = ({
     setIndexToAdd({ id, indexToAdd });
   }, [id, indexToAdd, setIndexToAdd]);
 
+  useEffect(() => {
+    setIsQueryLoading(loading);
+  }, [loading]);
+
   return (
     <TimelineContainer data-test-subj="timeline">
       {isSaving && <EuiProgress size="s" color="primary" position="absolute" />}
@@ -274,85 +296,52 @@ export const TimelineComponent: React.FC<Props> = ({
       </StyledEuiFlyoutHeader>
       <TimelineKqlFetch id={id} indexPattern={indexPattern} inputId="timeline" />
       {canQueryTimeline ? (
-        <TimelineQuery
-          docValueFields={docValueFields}
-          endDate={end}
-          eventType={eventType}
-          id={id}
-          indexToAdd={indexToAdd}
-          fields={timelineQueryFields}
-          sourceId="default"
-          limit={itemsPerPage}
-          filterQuery={combinedQueries!.filterQuery}
-          sortField={timelineQuerySortField}
-          startDate={start}
-          queryDeduplication="timeline"
-        >
-          {({
-            events,
-            inspect,
-            loading,
-            totalCount,
-            pageInfo,
-            loadMore,
-            getUpdatedAt,
-            refetch,
-          }) => {
-            setIsQueryLoading(loading);
-            return (
-              <>
-                <TimelineRefetch
+        <>
+          <TimelineRefetch
+            id={id}
+            inputId="timeline"
+            inspect={inspect}
+            loading={loading}
+            refetch={refetch}
+          />
+          <StyledEuiFlyoutBody data-test-subj="eui-flyout-body" className="timeline-flyout-body">
+            <StatefulBody
+              browserFields={browserFields}
+              data={events}
+              docValueFields={docValueFields}
+              id={id}
+              refetch={refetch}
+              sort={sort}
+              toggleColumn={toggleColumn}
+            />
+          </StyledEuiFlyoutBody>
+          {
+            /** Hide the footer if Resolver is showing. */
+            !graphEventId && (
+              <StyledEuiFlyoutFooter
+                data-test-subj="eui-flyout-footer"
+                className="timeline-flyout-footer"
+              >
+                <Footer
+                  activePage={pageInfo.activePage}
+                  data-test-subj="timeline-footer"
+                  updatedAt={updatedAt}
+                  height={footerHeight}
                   id={id}
-                  inputId="timeline"
-                  inspect={inspect}
-                  loading={loading}
-                  refetch={refetch}
+                  isLive={isLive}
+                  isLoading={loading || loadingIndexName}
+                  itemsCount={events.length}
+                  itemsPerPage={itemsPerPage}
+                  itemsPerPageOptions={itemsPerPageOptions}
+                  onChangeItemsPerPage={onChangeItemsPerPage}
+                  onChangePage={loadPage}
+                  serverSideEventCount={totalCount}
+                  totalPages={pageInfo.totalPages}
                 />
-                <StyledEuiFlyoutBody
-                  data-test-subj="eui-flyout-body"
-                  className="timeline-flyout-body"
-                >
-                  <StatefulBody
-                    browserFields={browserFields}
-                    data={events}
-                    docValueFields={docValueFields}
-                    id={id}
-                    refetch={refetch}
-                    sort={sort}
-                    toggleColumn={toggleColumn}
-                  />
-                </StyledEuiFlyoutBody>
-                {
-                  /** Hide the footer if Resolver is showing. */
-                  !graphEventId && (
-                    <StyledEuiFlyoutFooter
-                      data-test-subj="eui-flyout-footer"
-                      className="timeline-flyout-footer"
-                    >
-                      <Footer
-                        data-test-subj="timeline-footer"
-                        getUpdatedAt={getUpdatedAt}
-                        hasNextPage={getOr(false, 'hasNextPage', pageInfo)!}
-                        height={footerHeight}
-                        id={id}
-                        isLive={isLive}
-                        isLoading={loading || loadingIndexName}
-                        itemsCount={events.length}
-                        itemsPerPage={itemsPerPage}
-                        itemsPerPageOptions={itemsPerPageOptions}
-                        nextCursor={getOr(null, 'endCursor.value', pageInfo)!}
-                        onChangeItemsPerPage={onChangeItemsPerPage}
-                        onLoadMore={loadMore}
-                        serverSideEventCount={totalCount}
-                        tieBreaker={getOr(null, 'endCursor.tiebreaker', pageInfo)}
-                      />
-                    </StyledEuiFlyoutFooter>
-                  )
-                }
-              </>
-            );
-          }}
-        </TimelineQuery>
+              </StyledEuiFlyoutFooter>
+            )
+          }
+        </>
       ) : null}
     </TimelineContainer>
   );
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
index 35f8c7ae90e6e..af99c75ae701a 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
@@ -5,7 +5,6 @@
  */
 
 import { noop } from 'lodash/fp';
-import memoizeOne from 'memoize-one';
 import { useCallback, useEffect, useRef, useState } from 'react';
 import deepEqual from 'fast-deep-equal';
 
@@ -14,73 +13,63 @@ import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
 import { useKibana } from '../../../common/lib/kibana';
 import {
   DocValueFields,
-  DetailItem,
-  TimelineQueries,
-  TimelineDetailsRequestOptions,
-  TimelineDetailsStrategyResponse,
+  TimelineEventsDetailsItem,
+  TimelineEventsQueries,
+  TimelineEventsDetailsRequestOptions,
+  TimelineEventsDetailsStrategyResponse,
 } from '../../../../common/search_strategy';
 export interface EventsArgs {
-  detailsData: DetailItem[] | null;
-  loading: boolean;
+  detailsData: TimelineEventsDetailsItem[] | null;
 }
 
-export interface TimelineDetailsProps {
+export interface UseTimelineEventsDetailsProps {
   docValueFields: DocValueFields[];
   indexName: string;
   eventId: string;
-  executeQuery: boolean;
+  skip: boolean;
 }
 
-const getDetailsEvent = memoizeOne(
-  (variables: string, detail: DetailItem[]): DetailItem[] => detail
-);
-
-export const useTimelineDetails = ({
+export const useTimelineEventsDetails = ({
   docValueFields,
   indexName,
   eventId,
-  executeQuery,
-}: TimelineDetailsProps): [boolean, EventsArgs['detailsData']] => {
+  skip,
+}: UseTimelineEventsDetailsProps): [boolean, EventsArgs['detailsData']] => {
   const { data, notifications, uiSettings } = useKibana().services;
   const refetch = useRef<inputsModel.Refetch>(noop);
   const abortCtrl = useRef(new AbortController());
   const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
   const [loading, setLoading] = useState(false);
-  const [timelineDetailsRequest, setTimelineDetailsRequest] = useState<
-    TimelineDetailsRequestOptions
-  >({
-    defaultIndex,
-    docValueFields,
-    executeQuery,
-    indexName,
-    eventId,
-    factoryQueryType: TimelineQueries.details,
-  });
+  const [
+    timelineDetailsRequest,
+    setTimelineDetailsRequest,
+  ] = useState<TimelineEventsDetailsRequestOptions | null>(null);
 
   const [timelineDetailsResponse, setTimelineDetailsResponse] = useState<EventsArgs['detailsData']>(
     null
   );
 
   const timelineDetailsSearch = useCallback(
-    (request: TimelineDetailsRequestOptions) => {
+    (request: TimelineEventsDetailsRequestOptions) => {
       let didCancel = false;
       const asyncSearch = async () => {
         abortCtrl.current = new AbortController();
         setLoading(true);
 
         const searchSubscription$ = data.search
-          .search<TimelineDetailsRequestOptions, TimelineDetailsStrategyResponse>(request, {
-            strategy: 'securitySolutionTimelineSearchStrategy',
-            abortSignal: abortCtrl.current.signal,
-          })
+          .search<TimelineEventsDetailsRequestOptions, TimelineEventsDetailsStrategyResponse>(
+            request,
+            {
+              strategy: 'securitySolutionTimelineSearchStrategy',
+              abortSignal: abortCtrl.current.signal,
+            }
+          )
           .subscribe({
             next: (response) => {
               if (!response.isPartial && !response.isRunning) {
                 if (!didCancel) {
                   setLoading(false);
-                  setTimelineDetailsResponse(
-                    getDetailsEvent(JSON.stringify(timelineDetailsRequest), response.data || [])
-                  );
+                  setTimelineDetailsResponse(response.data || []);
                 }
                 searchSubscription$.unsubscribe();
               } else if (response.isPartial && !response.isRunning) {
@@ -105,28 +94,31 @@ export const useTimelineDetails = ({
         abortCtrl.current.abort();
       };
     },
-    [data.search, notifications.toasts, timelineDetailsRequest]
+    [data.search, notifications.toasts]
   );
 
   useEffect(() => {
     setTimelineDetailsRequest((prevRequest) => {
       const myRequest = {
-        ...prevRequest,
+        ...(prevRequest ?? {}),
         defaultIndex,
         docValueFields,
         indexName,
         eventId,
+        factoryQueryType: TimelineEventsQueries.details,
       };
-      if (!deepEqual(prevRequest, myRequest)) {
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
         return myRequest;
       }
       return prevRequest;
     });
-  }, [defaultIndex, docValueFields, eventId, indexName]);
+  }, [defaultIndex, docValueFields, eventId, indexName, skip]);
 
   useEffect(() => {
-    if (executeQuery) timelineDetailsSearch(timelineDetailsRequest);
-  }, [executeQuery, timelineDetailsRequest, timelineDetailsSearch]);
+    if (timelineDetailsRequest) {
+      timelineDetailsSearch(timelineDetailsRequest);
+    }
+  }, [timelineDetailsRequest, timelineDetailsSearch]);
 
   return [loading, timelineDetailsResponse];
 };
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
index de7175f0a7f97..f340096c75f2b 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
@@ -4,215 +4,259 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr, uniqBy } from 'lodash/fp';
-import memoizeOne from 'memoize-one';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { compose, Dispatch } from 'redux';
-import { connect, ConnectedProps } from 'react-redux';
+import deepEqual from 'fast-deep-equal';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { useDispatch } from 'react-redux';
+
+import { ESQuery } from '../../../common/typed_json';
+import { IIndexPattern } from '../../../../../../src/plugins/data/public';
 
 import { DEFAULT_INDEX_KEY } from '../../../common/constants';
-import { IIndexPattern } from '../../../../../../src/plugins/data/common/index_patterns';
-import {
-  GetTimelineQuery,
-  PageInfo,
-  SortField,
-  TimelineEdges,
-  TimelineItem,
-} from '../../graphql/types';
-import { inputsModel, inputsSelectors, State } from '../../common/store';
-import { withKibana, WithKibanaProps } from '../../common/lib/kibana';
+import { inputsModel } from '../../common/store';
+import { useKibana } from '../../common/lib/kibana';
 import { createFilter } from '../../common/containers/helpers';
-import { QueryTemplate, QueryTemplateProps } from '../../common/containers/query_template';
+import { DocValueFields } from '../../common/containers/query_template';
 import { EventType } from '../../timelines/store/timeline/model';
-import { timelineQuery } from './index.gql_query';
 import { timelineActions } from '../../timelines/store/timeline';
 import { detectionsTimelineIds, skipQueryForDetectionsPage } from './helpers';
+import { getInspectResponse } from '../../helpers';
+import {
+  Direction,
+  TimelineEventsQueries,
+  TimelineEventsAllStrategyResponse,
+  TimelineEventsAllRequestOptions,
+  TimelineEdges,
+  TimelineItem,
+  SortField,
+} from '../../../common/search_strategy';
+import { InspectResponse } from '../../types';
+import * as i18n from './translations';
 
 export interface TimelineArgs {
   events: TimelineItem[];
   id: string;
-  inspect: inputsModel.InspectQuery;
-  loading: boolean;
-  loadMore: (cursor: string, tieBreaker: string) => void;
-  pageInfo: PageInfo;
+  inspect: InspectResponse;
+  loadPage: LoadPage;
+  pageInfo: {
+    activePage: number;
+    totalPages: number;
+  };
   refetch: inputsModel.Refetch;
   totalCount: number;
-  getUpdatedAt: () => number;
+  updatedAt: number;
 }
 
-export interface CustomReduxProps {
-  clearSignalsState: ({ id }: { id?: string }) => void;
-}
+type LoadPage = (newActivePage: number) => void;
 
-export interface OwnProps extends QueryTemplateProps {
-  children?: (args: TimelineArgs) => React.ReactNode;
+interface UseTimelineEventsProps {
+  docValueFields?: DocValueFields[];
+  filterQuery?: ESQuery | string;
+  skip?: boolean;
   endDate: string;
   eventType?: EventType;
   id: string;
+  fields: string[];
   indexPattern?: IIndexPattern;
   indexToAdd?: string[];
   limit: number;
-  sortField: SortField;
-  fields: string[];
+  sort: SortField;
   startDate: string;
-  queryDeduplication: string;
+  canQueryTimeline?: boolean;
 }
 
-type TimelineQueryProps = OwnProps & PropsFromRedux & WithKibanaProps & CustomReduxProps;
-
-class TimelineQueryComponent extends QueryTemplate<
-  TimelineQueryProps,
-  GetTimelineQuery.Query,
-  GetTimelineQuery.Variables
-> {
-  private updatedDate: number = Date.now();
-  private memoizedTimelineEvents: (variables: string, events: TimelineEdges[]) => TimelineItem[];
-
-  constructor(props: TimelineQueryProps) {
-    super(props);
-    this.memoizedTimelineEvents = memoizeOne(this.getTimelineEvents);
-  }
-
-  public render() {
-    const {
-      children,
-      clearSignalsState,
-      docValueFields,
-      endDate,
-      eventType = 'raw',
-      id,
-      indexPattern,
-      indexToAdd = [],
-      isInspected,
-      kibana,
-      limit,
-      fields,
-      filterQuery,
-      sourceId,
-      sortField,
-      startDate,
-      queryDeduplication,
-    } = this.props;
-    const defaultKibanaIndex = kibana.services.uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
-    const defaultIndex =
-      indexPattern == null || (indexPattern != null && indexPattern.title === '')
-        ? [
-            ...(['all', 'raw'].includes(eventType) ? defaultKibanaIndex : []),
-            ...(['all', 'alert', 'signal'].includes(eventType) ? indexToAdd : []),
-          ]
-        : indexPattern?.title.split(',') ?? [];
-    // Fun fact: When using this hook multiple times within a component (e.g. add_exception_modal & edit_exception_modal),
-    // the apolloClient will perform queryDeduplication and prevent the first query from executing. A deep compare is not
-    // performed on `indices`, so another field must be passed to circumvent this.
-    // For details, see https://github.com/apollographql/react-apollo/issues/2202
-    const variables: GetTimelineQuery.Variables & { queryDeduplication: string } = {
-      fieldRequested: fields,
-      filterQuery: createFilter(filterQuery),
-      sourceId,
-      timerange: {
-        interval: '12h',
-        from: startDate,
-        to: endDate,
-      },
-      pagination: { limit, cursor: null, tiebreaker: null },
-      sortField,
-      defaultIndex,
-      docValueFields: docValueFields ?? [],
-      inspect: isInspected,
-      queryDeduplication,
-    };
-
-    return (
-      <Query<GetTimelineQuery.Query, GetTimelineQuery.Variables>
-        query={timelineQuery}
-        fetchPolicy="network-only"
-        notifyOnNetworkStatusChange
-        skip={skipQueryForDetectionsPage(id, defaultIndex)}
-        variables={variables}
-      >
-        {({ data, loading, fetchMore, refetch }) => {
-          this.setRefetch(refetch);
-          this.setExecuteBeforeRefetch(clearSignalsState);
-          this.setExecuteBeforeFetchMore(clearSignalsState);
-
-          const timelineEdges = getOr([], 'source.Timeline.edges', data);
-          this.setFetchMore(fetchMore);
-          this.setFetchMoreOptions((newCursor: string, tiebreaker?: string) => ({
-            variables: {
-              pagination: {
-                cursor: newCursor,
-                tiebreaker,
-                limit,
-              },
-            },
-            updateQuery: (prev, { fetchMoreResult }) => {
-              if (!fetchMoreResult) {
-                return prev;
-              }
-              return {
-                ...fetchMoreResult,
-                source: {
-                  ...fetchMoreResult.source,
-                  Timeline: {
-                    ...fetchMoreResult.source.Timeline,
-                    edges: uniqBy('node._id', [
-                      ...prev.source.Timeline.edges,
-                      ...fetchMoreResult.source.Timeline.edges,
-                    ]),
-                  },
-                },
-              };
-            },
-          }));
-          this.updatedDate = Date.now();
-          return children!({
-            id,
-            inspect: getOr(null, 'source.Timeline.inspect', data),
-            refetch: this.wrappedRefetch,
-            loading,
-            totalCount: getOr(0, 'source.Timeline.totalCount', data),
-            pageInfo: getOr({}, 'source.Timeline.pageInfo', data),
-            events: this.memoizedTimelineEvents(JSON.stringify(variables), timelineEdges),
-            loadMore: this.wrappedLoadMore,
-            getUpdatedAt: this.getUpdatedAt,
-          });
-        }}
-      </Query>
-    );
-  }
+const getTimelineEvents = (timelineEdges: TimelineEdges[]): TimelineItem[] =>
+  timelineEdges.map((e: TimelineEdges) => e.node);
 
-  private getUpdatedAt = () => this.updatedDate;
+const ID = 'timelineEventsQuery';
 
-  private getTimelineEvents = (variables: string, timelineEdges: TimelineEdges[]): TimelineItem[] =>
-    timelineEdges.map((e: TimelineEdges) => e.node);
-}
-
-const makeMapStateToProps = () => {
-  const getQuery = inputsSelectors.timelineQueryByIdSelector();
-  const mapStateToProps = (state: State, { id }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      isInspected,
-    };
-  };
-  return mapStateToProps;
-};
+export const useTimelineEvents = ({
+  docValueFields,
+  endDate,
+  eventType = 'raw',
+  id = ID,
+  indexPattern,
+  indexToAdd = [],
+  fields,
+  filterQuery,
+  startDate,
+  limit,
+  sort = {
+    field: '@timestamp',
+    direction: Direction.asc,
+  },
+  canQueryTimeline = true,
+}: UseTimelineEventsProps): [boolean, TimelineArgs] => {
+  const dispatch = useDispatch();
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultKibanaIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const defaultIndex =
+    indexPattern == null || (indexPattern != null && indexPattern.title === '')
+      ? [
+          ...(['all', 'raw'].includes(eventType) ? defaultKibanaIndex : []),
+          ...(['all', 'alert', 'signal'].includes(eventType) ? indexToAdd : []),
+        ]
+      : indexPattern?.title.split(',') ?? [];
+  const [loading, setLoading] = useState(false);
+  const [activePage, setActivePage] = useState(0);
+  const [timelineRequest, setTimelineRequest] = useState<TimelineEventsAllRequestOptions>({
+    fields,
+    fieldRequested: fields,
+    filterQuery: createFilter(filterQuery),
+    id,
+    timerange: {
+      interval: '12h',
+      from: startDate,
+      to: endDate,
+    },
+    pagination: {
+      activePage,
+      querySize: limit,
+    },
+    sort,
+    defaultIndex,
+    docValueFields: docValueFields ?? [],
+    factoryQueryType: TimelineEventsQueries.all,
+  });
 
-const mapDispatchToProps = (dispatch: Dispatch) => ({
-  clearSignalsState: ({ id }: { id?: string }) => {
+  const clearSignalsState = useCallback(() => {
     if (id != null && detectionsTimelineIds.some((timelineId) => timelineId === id)) {
       dispatch(timelineActions.clearEventsLoading({ id }));
       dispatch(timelineActions.clearEventsDeleted({ id }));
     }
-  },
-});
+  }, [dispatch, id]);
 
-const connector = connect(makeMapStateToProps, mapDispatchToProps);
+  const wrappedLoadPage = useCallback(
+    (newActivePage: number) => {
+      clearSignalsState();
+      setActivePage(newActivePage);
+    },
+    [clearSignalsState]
+  );
 
-type PropsFromRedux = ConnectedProps<typeof connector>;
+  const [timelineResponse, setTimelineResponse] = useState<TimelineArgs>({
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    refetch: refetch.current,
+    totalCount: -1,
+    pageInfo: {
+      activePage: 0,
+      totalPages: 0,
+    },
+    events: [],
+    loadPage: wrappedLoadPage,
+    updatedAt: 0,
+  });
 
-export const TimelineQuery = compose<React.ComponentClass<OwnProps>>(
-  connector,
-  withKibana
-)(TimelineQueryComponent);
+  const timelineSearch = useCallback(
+    (request: TimelineEventsAllRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<TimelineEventsAllRequestOptions, TimelineEventsAllStrategyResponse>(request, {
+            strategy: 'securitySolutionTimelineSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setTimelineResponse((prevResponse) => ({
+                    ...prevResponse,
+                    events: getTimelineEvents(response.edges),
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    pageInfo: response.pageInfo,
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                    updatedAt: Date.now(),
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                notifications.toasts.addWarning(i18n.ERROR_TIMELINE_EVENTS);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (msg.message !== 'Aborted') {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_TIMELINE_EVENTS,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
+
+  useEffect(() => {
+    if (!canQueryTimeline || skipQueryForDetectionsPage(id, defaultIndex)) {
+      return;
+    }
+
+    setTimelineRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        docValueFields: docValueFields ?? [],
+        filterQuery: createFilter(filterQuery),
+        pagination: {
+          activePage,
+          querySize: limit,
+        },
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+        sort,
+      };
+      if (
+        canQueryTimeline &&
+        !skipQueryForDetectionsPage(id, defaultIndex) &&
+        !deepEqual(prevRequest, myRequest)
+      ) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [
+    defaultIndex,
+    docValueFields,
+    endDate,
+    filterQuery,
+    startDate,
+    canQueryTimeline,
+    id,
+    activePage,
+    limit,
+    sort,
+  ]);
+
+  useEffect(() => {
+    timelineSearch(timelineRequest);
+  }, [timelineRequest, timelineSearch]);
+
+  return [loading, timelineResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/translations.ts b/x-pack/plugins/security_solution/public/timelines/containers/translations.ts
new file mode 100644
index 0000000000000..ba3cc3c84b92d
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/containers/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_TIMELINE_EVENTS = i18n.translate(
+  'xpack.securitySolution.timelineEvents.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on timeline events search`,
+  }
+);
+
+export const FAIL_TIMELINE_EVENTS = i18n.translate(
+  'xpack.securitySolution.timelineEvents.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on timeline events`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
index ebee0f5cae9a6..da9c363703d16 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
@@ -16,7 +16,7 @@ import {
 import { KueryFilterQuery, SerializedFilterQuery } from '../../../common/store/types';
 
 import { EventType, KqlMode, TimelineModel, ColumnHeaderOptions } from './model';
-import { TimelineNonEcsData } from '../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../common/search_strategy/timeline';
 import { TimelineTypeLiteral, RowRendererId } from '../../../../common/types/timeline';
 import { InsertTimeline } from './types';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
index a6b78269cff2f..1432e133244d0 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
@@ -20,7 +20,7 @@ import {
   EXISTS_OPERATOR,
 } from '../../../timelines/components/timeline/data_providers/data_provider';
 import { KueryFilterQuery, SerializedFilterQuery } from '../../../common/store/model';
-import { TimelineNonEcsData } from '../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../common/search_strategy/timeline';
 import {
   TimelineTypeLiteral,
   TimelineType,
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
index 9a8399d366967..88ec9da1e0c4e 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
@@ -8,14 +8,14 @@ import { Filter } from '../../../../../../../src/plugins/data/public';
 
 import { DataProvider } from '../../components/timeline/data_providers/data_provider';
 import { Sort } from '../../components/timeline/body/sort';
-import {
-  PinnedEvent,
-  TimelineNonEcsData,
+import { PinnedEvent } from '../../../graphql/types';
+import { TimelineNonEcsData } from '../../../../common/search_strategy/timeline';
+import { KueryFilterQuery, SerializedFilterQuery } from '../../../common/store/types';
+import type {
   TimelineType,
   TimelineStatus,
-} from '../../../graphql/types';
-import { KueryFilterQuery, SerializedFilterQuery } from '../../../common/store/types';
-import type { RowRendererId } from '../../../../common/types/timeline';
+  RowRendererId,
+} from '../../../../common/types/timeline';
 
 export const DEFAULT_PAGE_COUNT = 2; // Eui Pager will not render unless this is a minimum of 2 pages
 export type KqlMode = 'filter' | 'search';
diff --git a/x-pack/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts b/x-pack/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts
index 0ec0db9f32776..3fc41550a1fc4 100644
--- a/x-pack/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts
@@ -9,12 +9,64 @@ import {
   SavedObjectsServiceStart,
   SavedObjectsClientContract,
 } from 'src/core/server';
-import { AgentService, IngestManagerStartContract } from '../../../ingest_manager/server';
+import {
+  AgentService,
+  IngestManagerStartContract,
+  PackageService,
+} from '../../../ingest_manager/server';
 import { getPackagePolicyCreateCallback } from './ingest_integration';
 import { ManifestManager } from './services/artifacts';
+import { MetadataQueryStrategy } from './types';
+import { MetadataQueryStrategyVersions } from '../../common/endpoint/types';
+import {
+  metadataQueryStrategyV1,
+  metadataQueryStrategyV2,
+} from './routes/metadata/support/query_strategies';
+import { ElasticsearchAssetType } from '../../../ingest_manager/common/types/models';
+import { metadataTransformPrefix } from '../../common/endpoint/constants';
+
+export interface MetadataService {
+  queryStrategy(
+    savedObjectsClient: SavedObjectsClientContract,
+    version?: MetadataQueryStrategyVersions
+  ): Promise<MetadataQueryStrategy>;
+}
+
+export const createMetadataService = (packageService: PackageService): MetadataService => {
+  return {
+    async queryStrategy(
+      savedObjectsClient: SavedObjectsClientContract,
+      version?: MetadataQueryStrategyVersions
+    ): Promise<MetadataQueryStrategy> {
+      if (version === MetadataQueryStrategyVersions.VERSION_1) {
+        return metadataQueryStrategyV1();
+      }
+      if (!packageService) {
+        throw new Error('package service is uninitialized');
+      }
+
+      if (version === MetadataQueryStrategyVersions.VERSION_2 || !version) {
+        const assets = await packageService.getInstalledEsAssetReferences(
+          savedObjectsClient,
+          'endpoint'
+        );
+        const expectedTransformAssets = assets.filter(
+          (ref) =>
+            ref.type === ElasticsearchAssetType.transform &&
+            ref.id.startsWith(metadataTransformPrefix)
+        );
+        if (expectedTransformAssets && expectedTransformAssets.length === 1) {
+          return metadataQueryStrategyV2();
+        }
+        return metadataQueryStrategyV1();
+      }
+      return metadataQueryStrategyV1();
+    },
+  };
+};
 
 export type EndpointAppContextServiceStartContract = Partial<
-  Pick<IngestManagerStartContract, 'agentService'>
+  Pick<IngestManagerStartContract, 'agentService' | 'packageService'>
 > & {
   logger: Logger;
   manifestManager?: ManifestManager;
@@ -30,11 +82,13 @@ export class EndpointAppContextService {
   private agentService: AgentService | undefined;
   private manifestManager: ManifestManager | undefined;
   private savedObjectsStart: SavedObjectsServiceStart | undefined;
+  private metadataService: MetadataService | undefined;
 
   public start(dependencies: EndpointAppContextServiceStartContract) {
     this.agentService = dependencies.agentService;
     this.manifestManager = dependencies.manifestManager;
     this.savedObjectsStart = dependencies.savedObjectsStart;
+    this.metadataService = createMetadataService(dependencies.packageService!);
 
     if (this.manifestManager && dependencies.registerIngestCallback) {
       dependencies.registerIngestCallback(
@@ -50,6 +104,10 @@ export class EndpointAppContextService {
     return this.agentService;
   }
 
+  public getMetadataService(): MetadataService | undefined {
+    return this.metadataService;
+  }
+
   public getManifestManager(): ManifestManager | undefined {
     return this.manifestManager;
   }
diff --git a/x-pack/plugins/security_solution/server/endpoint/mocks.ts b/x-pack/plugins/security_solution/server/endpoint/mocks.ts
index b5f35a198fa9e..9fd1fb26b1c58 100644
--- a/x-pack/plugins/security_solution/server/endpoint/mocks.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/mocks.ts
@@ -11,6 +11,7 @@ import {
   AgentService,
   IngestManagerStartContract,
   ExternalCallback,
+  PackageService,
 } from '../../../ingest_manager/server';
 import { createPackagePolicyServiceMock } from '../../../ingest_manager/server/mocks';
 import { createMockConfig } from '../lib/detection_engine/routes/__mocks__';
@@ -58,6 +59,7 @@ export const createMockEndpointAppContextServiceStartContract = (): jest.Mocked<
 > => {
   return {
     agentService: createMockAgentService(),
+    packageService: createMockPackageService(),
     logger: loggingSystemMock.create().get('mock_endpoint_app_context'),
     savedObjectsStart: savedObjectsServiceMock.createStartContract(),
     manifestManager: getManifestManagerMock(),
@@ -68,6 +70,16 @@ export const createMockEndpointAppContextServiceStartContract = (): jest.Mocked<
   };
 };
 
+/**
+ * Create mock PackageService
+ */
+
+export const createMockPackageService = (): jest.Mocked<PackageService> => {
+  return {
+    getInstalledEsAssetReferences: jest.fn(),
+  };
+};
+
 /**
  * Creates a mock AgentService
  */
@@ -95,6 +107,7 @@ export const createMockIngestManagerStartContract = (
       getESIndexPattern: jest.fn().mockResolvedValue(indexPattern),
     },
     agentService: createMockAgentService(),
+    packageService: createMockPackageService(),
     registerExternalCallback: jest.fn((...args: ExternalCallback) => {}),
     packagePolicyService: createPackagePolicyServiceMock(),
   };
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/handlers.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/handlers.ts
new file mode 100644
index 0000000000000..cc371f9120ba0
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/handlers.ts
@@ -0,0 +1,290 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Boom from 'boom';
+import { RequestHandlerContext, Logger, RequestHandler } from 'kibana/server';
+import { TypeOf } from '@kbn/config-schema';
+import {
+  HostInfo,
+  HostMetadata,
+  HostResultList,
+  HostStatus,
+  MetadataQueryStrategyVersions,
+} from '../../../../common/endpoint/types';
+import { getESQueryHostMetadataByID, kibanaRequestToMetadataListESQuery } from './query_builders';
+import { Agent, AgentStatus } from '../../../../../ingest_manager/common/types/models';
+import { EndpointAppContext, HostListQueryResult } from '../../types';
+import { GetMetadataListRequestSchema, GetMetadataRequestSchema } from './index';
+import { findAllUnenrolledAgentIds } from './support/unenroll';
+import { findAgentIDsByStatus } from './support/agent_status';
+import { EndpointAppContextService } from '../../endpoint_app_context_services';
+
+export interface MetadataRequestContext {
+  endpointAppContextService: EndpointAppContextService;
+  logger: Logger;
+  requestHandlerContext: RequestHandlerContext;
+}
+
+const HOST_STATUS_MAPPING = new Map<AgentStatus, HostStatus>([
+  ['online', HostStatus.ONLINE],
+  ['offline', HostStatus.OFFLINE],
+  ['unenrolling', HostStatus.UNENROLLING],
+]);
+
+/**
+ * 00000000-0000-0000-0000-000000000000 is initial Elastic Agent id sent by Endpoint before policy is configured
+ * 11111111-1111-1111-1111-111111111111 is Elastic Agent id sent by Endpoint when policy does not contain an id
+ */
+
+const IGNORED_ELASTIC_AGENT_IDS = [
+  '00000000-0000-0000-0000-000000000000',
+  '11111111-1111-1111-1111-111111111111',
+];
+
+export const getLogger = (endpointAppContext: EndpointAppContext): Logger => {
+  return endpointAppContext.logFactory.get('metadata');
+};
+
+export const getMetadataListRequestHandler = function (
+  endpointAppContext: EndpointAppContext,
+  logger: Logger,
+  queryStrategyVersion?: MetadataQueryStrategyVersions
+): RequestHandler<undefined, undefined, TypeOf<typeof GetMetadataListRequestSchema.body>> {
+  return async (context, request, response) => {
+    try {
+      const agentService = endpointAppContext.service.getAgentService();
+      if (agentService === undefined) {
+        throw new Error('agentService not available');
+      }
+
+      const metadataRequestContext: MetadataRequestContext = {
+        endpointAppContextService: endpointAppContext.service,
+        logger,
+        requestHandlerContext: context,
+      };
+
+      const unenrolledAgentIds = await findAllUnenrolledAgentIds(
+        agentService,
+        context.core.savedObjects.client
+      );
+
+      const statusIDs = request?.body?.filters?.host_status?.length
+        ? await findAgentIDsByStatus(
+            agentService,
+            context.core.savedObjects.client,
+            request.body?.filters?.host_status
+          )
+        : undefined;
+
+      const queryStrategy = await endpointAppContext.service
+        ?.getMetadataService()
+        ?.queryStrategy(context.core.savedObjects.client, queryStrategyVersion);
+
+      const queryParams = await kibanaRequestToMetadataListESQuery(
+        request,
+        endpointAppContext,
+        queryStrategy!,
+        {
+          unenrolledAgentIds: unenrolledAgentIds.concat(IGNORED_ELASTIC_AGENT_IDS),
+          statusAgentIDs: statusIDs,
+        }
+      );
+
+      const hostListQueryResult = queryStrategy!.queryResponseToHostListResult(
+        await context.core.elasticsearch.legacy.client.callAsCurrentUser('search', queryParams)
+      );
+      return response.ok({
+        body: await mapToHostResultList(queryParams, hostListQueryResult, metadataRequestContext),
+      });
+    } catch (err) {
+      logger.warn(JSON.stringify(err, null, 2));
+      return response.internalError({ body: err });
+    }
+  };
+};
+
+export const getMetadataRequestHandler = function (
+  endpointAppContext: EndpointAppContext,
+  logger: Logger,
+  queryStrategyVersion?: MetadataQueryStrategyVersions
+): RequestHandler<TypeOf<typeof GetMetadataRequestSchema.params>, undefined, undefined> {
+  return async (context, request, response) => {
+    const agentService = endpointAppContext.service.getAgentService();
+    if (agentService === undefined) {
+      return response.internalError({ body: 'agentService not available' });
+    }
+
+    const metadataRequestContext: MetadataRequestContext = {
+      endpointAppContextService: endpointAppContext.service,
+      logger,
+      requestHandlerContext: context,
+    };
+
+    try {
+      const doc = await getHostData(
+        metadataRequestContext,
+        request?.params?.id,
+        queryStrategyVersion
+      );
+      if (doc) {
+        return response.ok({ body: doc });
+      }
+      return response.notFound({ body: 'Endpoint Not Found' });
+    } catch (err) {
+      logger.warn(JSON.stringify(err, null, 2));
+      if (err.isBoom) {
+        return response.customError({
+          statusCode: err.output.statusCode,
+          body: { message: err.message },
+        });
+      }
+      return response.internalError({ body: err });
+    }
+  };
+};
+
+export async function getHostData(
+  metadataRequestContext: MetadataRequestContext,
+  id: string,
+  queryStrategyVersion?: MetadataQueryStrategyVersions
+): Promise<HostInfo | undefined> {
+  const queryStrategy = await metadataRequestContext.endpointAppContextService
+    ?.getMetadataService()
+    ?.queryStrategy(
+      metadataRequestContext.requestHandlerContext.core.savedObjects.client,
+      queryStrategyVersion
+    );
+
+  const query = getESQueryHostMetadataByID(id, queryStrategy!);
+  const hostResult = queryStrategy!.queryResponseToHostResult(
+    await metadataRequestContext.requestHandlerContext.core.elasticsearch.legacy.client.callAsCurrentUser(
+      'search',
+      query
+    )
+  );
+  const hostMetadata = hostResult.result;
+  if (!hostMetadata) {
+    return undefined;
+  }
+
+  const agent = await findAgent(metadataRequestContext, hostMetadata);
+
+  if (agent && !agent.active) {
+    throw Boom.badRequest('the requested endpoint is unenrolled');
+  }
+
+  const metadata = await enrichHostMetadata(
+    hostMetadata,
+    metadataRequestContext,
+    hostResult.queryStrategyVersion
+  );
+  return { ...metadata, query_strategy_version: hostResult.queryStrategyVersion };
+}
+
+async function findAgent(
+  metadataRequestContext: MetadataRequestContext,
+  hostMetadata: HostMetadata
+): Promise<Agent | undefined> {
+  try {
+    return await metadataRequestContext.endpointAppContextService
+      ?.getAgentService()
+      ?.getAgent(
+        metadataRequestContext.requestHandlerContext.core.savedObjects.client,
+        hostMetadata.elastic.agent.id
+      );
+  } catch (e) {
+    if (
+      metadataRequestContext.requestHandlerContext.core.savedObjects.client.errors.isNotFoundError(
+        e
+      )
+    ) {
+      metadataRequestContext.logger.warn(
+        `agent with id ${hostMetadata.elastic.agent.id} not found`
+      );
+      return undefined;
+    } else {
+      throw e;
+    }
+  }
+}
+
+export async function mapToHostResultList(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  queryParams: Record<string, any>,
+  hostListQueryResult: HostListQueryResult,
+  metadataRequestContext: MetadataRequestContext
+): Promise<HostResultList> {
+  const totalNumberOfHosts = hostListQueryResult.resultLength;
+  if (hostListQueryResult.resultList.length > 0) {
+    return {
+      request_page_size: queryParams.size,
+      request_page_index: queryParams.from,
+      hosts: await Promise.all(
+        hostListQueryResult.resultList.map(async (entry) =>
+          enrichHostMetadata(
+            entry,
+            metadataRequestContext,
+            hostListQueryResult.queryStrategyVersion
+          )
+        )
+      ),
+      total: totalNumberOfHosts,
+      query_strategy_version: hostListQueryResult.queryStrategyVersion,
+    };
+  } else {
+    return {
+      request_page_size: queryParams.size,
+      request_page_index: queryParams.from,
+      total: totalNumberOfHosts,
+      hosts: [],
+      query_strategy_version: hostListQueryResult.queryStrategyVersion,
+    };
+  }
+}
+
+async function enrichHostMetadata(
+  hostMetadata: HostMetadata,
+  metadataRequestContext: MetadataRequestContext,
+  metadataQueryStrategyVersion: MetadataQueryStrategyVersions
+): Promise<HostInfo> {
+  let hostStatus = HostStatus.ERROR;
+  let elasticAgentId = hostMetadata?.elastic?.agent?.id;
+  const log = metadataRequestContext.logger;
+  try {
+    /**
+     * Get agent status by elastic agent id if available or use the host id.
+     */
+
+    if (!elasticAgentId) {
+      elasticAgentId = hostMetadata.host.id;
+      log.warn(`Missing elastic agent id, using host id instead ${elasticAgentId}`);
+    }
+
+    const status = await metadataRequestContext.endpointAppContextService
+      ?.getAgentService()
+      ?.getAgentStatusById(
+        metadataRequestContext.requestHandlerContext.core.savedObjects.client,
+        elasticAgentId
+      );
+    hostStatus = HOST_STATUS_MAPPING.get(status!) || HostStatus.ERROR;
+  } catch (e) {
+    if (
+      metadataRequestContext.requestHandlerContext.core.savedObjects.client.errors.isNotFoundError(
+        e
+      )
+    ) {
+      log.warn(`agent with id ${elasticAgentId} not found`);
+    } else {
+      log.error(e);
+      throw e;
+    }
+  }
+  return {
+    metadata: hostMetadata,
+    host_status: hostStatus,
+    query_strategy_version: metadataQueryStrategyVersion,
+  };
+}
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/index.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/index.ts
index 144c536b4e45f..bfb2a6a828e68 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/index.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/index.ts
@@ -4,51 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IRouter, Logger, RequestHandlerContext } from 'kibana/server';
-import { SearchResponse } from 'elasticsearch';
+import { IRouter } from 'kibana/server';
 import { schema } from '@kbn/config-schema';
-import Boom from 'boom';
 
-import { metadataCurrentIndexPattern } from '../../../../common/endpoint/constants';
-import { getESQueryHostMetadataByID, kibanaRequestToMetadataListESQuery } from './query_builders';
-import {
-  HostInfo,
-  HostMetadata,
-  HostMetadataDetails,
-  HostResultList,
-  HostStatus,
-} from '../../../../common/endpoint/types';
+import { HostStatus, MetadataQueryStrategyVersions } from '../../../../common/endpoint/types';
 import { EndpointAppContext } from '../../types';
-import { AgentService } from '../../../../../ingest_manager/server';
-import { Agent, AgentStatus } from '../../../../../ingest_manager/common/types/models';
-import { findAllUnenrolledAgentIds } from './support/unenroll';
-import { findAgentIDsByStatus } from './support/agent_status';
+import { getLogger, getMetadataListRequestHandler, getMetadataRequestHandler } from './handlers';
 
-interface MetadataRequestContext {
-  agentService: AgentService;
-  logger: Logger;
-  requestHandlerContext: RequestHandlerContext;
-}
-
-const HOST_STATUS_MAPPING = new Map<AgentStatus, HostStatus>([
-  ['online', HostStatus.ONLINE],
-  ['offline', HostStatus.OFFLINE],
-  ['unenrolling', HostStatus.UNENROLLING],
-]);
-
-/**
- * 00000000-0000-0000-0000-000000000000 is initial Elastic Agent id sent by Endpoint before policy is configured
- * 11111111-1111-1111-1111-111111111111 is Elastic Agent id sent by Endpoint when policy does not contain an id
- */
-
-const IGNORED_ELASTIC_AGENT_IDS = [
-  '00000000-0000-0000-0000-000000000000',
-  '11111111-1111-1111-1111-111111111111',
-];
-
-const getLogger = (endpointAppContext: EndpointAppContext): Logger => {
-  return endpointAppContext.logFactory.get('metadata');
-};
+export const BASE_ENDPOINT_ROUTE = '/api/endpoint';
+export const METADATA_REQUEST_V1_ROUTE = `${BASE_ENDPOINT_ROUTE}/v1/metadata`;
+export const GET_METADATA_REQUEST_V1_ROUTE = `${METADATA_REQUEST_V1_ROUTE}/{id}`;
+export const METADATA_REQUEST_ROUTE = `${BASE_ENDPOINT_ROUTE}/metadata`;
+export const GET_METADATA_REQUEST_ROUTE = `${METADATA_REQUEST_ROUTE}/{id}`;
 
 /* Filters that can be applied to the endpoint fetch route */
 export const endpointFilters = schema.object({
@@ -65,241 +32,73 @@ export const endpointFilters = schema.object({
   ),
 });
 
+export const GetMetadataRequestSchema = {
+  params: schema.object({ id: schema.string() }),
+};
+
+export const GetMetadataListRequestSchema = {
+  body: schema.nullable(
+    schema.object({
+      paging_properties: schema.nullable(
+        schema.arrayOf(
+          schema.oneOf([
+            /**
+             * the number of results to return for this request per page
+             */
+            schema.object({
+              page_size: schema.number({ defaultValue: 10, min: 1, max: 10000 }),
+            }),
+            /**
+             * the zero based page index of the the total number of pages of page size
+             */
+            schema.object({ page_index: schema.number({ defaultValue: 0, min: 0 }) }),
+          ])
+        )
+      ),
+      filters: endpointFilters,
+    })
+  ),
+};
+
 export function registerEndpointRoutes(router: IRouter, endpointAppContext: EndpointAppContext) {
   const logger = getLogger(endpointAppContext);
   router.post(
     {
-      path: '/api/endpoint/metadata',
-      validate: {
-        body: schema.nullable(
-          schema.object({
-            paging_properties: schema.nullable(
-              schema.arrayOf(
-                schema.oneOf([
-                  /**
-                   * the number of results to return for this request per page
-                   */
-                  schema.object({
-                    page_size: schema.number({ defaultValue: 10, min: 1, max: 10000 }),
-                  }),
-                  /**
-                   * the zero based page index of the the total number of pages of page size
-                   */
-                  schema.object({ page_index: schema.number({ defaultValue: 0, min: 0 }) }),
-                ])
-              )
-            ),
-            filters: endpointFilters,
-          })
-        ),
-      },
+      path: `${METADATA_REQUEST_V1_ROUTE}`,
+      validate: GetMetadataListRequestSchema,
       options: { authRequired: true, tags: ['access:securitySolution'] },
     },
-    async (context, req, res) => {
-      try {
-        const agentService = endpointAppContext.service.getAgentService();
-        if (agentService === undefined) {
-          throw new Error('agentService not available');
-        }
-
-        const metadataRequestContext: MetadataRequestContext = {
-          agentService,
-          logger,
-          requestHandlerContext: context,
-        };
-
-        const unenrolledAgentIds = await findAllUnenrolledAgentIds(
-          agentService,
-          context.core.savedObjects.client
-        );
-
-        const statusIDs = req.body?.filters?.host_status?.length
-          ? await findAgentIDsByStatus(
-              agentService,
-              context.core.savedObjects.client,
-              req.body?.filters?.host_status
-            )
-          : undefined;
-
-        const queryParams = await kibanaRequestToMetadataListESQuery(
-          req,
-          endpointAppContext,
-          metadataCurrentIndexPattern,
-          {
-            unenrolledAgentIds: unenrolledAgentIds.concat(IGNORED_ELASTIC_AGENT_IDS),
-            statusAgentIDs: statusIDs,
-          }
-        );
-
-        const response = (await context.core.elasticsearch.legacy.client.callAsCurrentUser(
-          'search',
-          queryParams
-        )) as SearchResponse<HostMetadataDetails>;
+    getMetadataListRequestHandler(
+      endpointAppContext,
+      logger,
+      MetadataQueryStrategyVersions.VERSION_1
+    )
+  );
 
-        return res.ok({
-          body: await mapToHostResultList(queryParams, response, metadataRequestContext),
-        });
-      } catch (err) {
-        logger.warn(JSON.stringify(err, null, 2));
-        return res.internalError({ body: err });
-      }
-    }
+  router.post(
+    {
+      path: `${METADATA_REQUEST_ROUTE}`,
+      validate: GetMetadataListRequestSchema,
+      options: { authRequired: true, tags: ['access:securitySolution'] },
+    },
+    getMetadataListRequestHandler(endpointAppContext, logger)
   );
 
   router.get(
     {
-      path: '/api/endpoint/metadata/{id}',
-      validate: {
-        params: schema.object({ id: schema.string() }),
-      },
+      path: `${GET_METADATA_REQUEST_V1_ROUTE}`,
+      validate: GetMetadataRequestSchema,
       options: { authRequired: true, tags: ['access:securitySolution'] },
     },
-    async (context, req, res) => {
-      const agentService = endpointAppContext.service.getAgentService();
-      if (agentService === undefined) {
-        return res.internalError({ body: 'agentService not available' });
-      }
-
-      const metadataRequestContext: MetadataRequestContext = {
-        agentService,
-        logger,
-        requestHandlerContext: context,
-      };
-
-      try {
-        const doc = await getHostData(metadataRequestContext, req.params.id);
-        if (doc) {
-          return res.ok({ body: doc });
-        }
-        return res.notFound({ body: 'Endpoint Not Found' });
-      } catch (err) {
-        logger.warn(JSON.stringify(err, null, 2));
-        if (err.isBoom) {
-          return res.customError({
-            statusCode: err.output.statusCode,
-            body: { message: err.message },
-          });
-        }
-        return res.internalError({ body: err });
-      }
-    }
+    getMetadataRequestHandler(endpointAppContext, logger, MetadataQueryStrategyVersions.VERSION_1)
   );
-}
-
-export async function getHostData(
-  metadataRequestContext: MetadataRequestContext,
-  id: string
-): Promise<HostInfo | undefined> {
-  const query = getESQueryHostMetadataByID(id, metadataCurrentIndexPattern);
-  const response = (await metadataRequestContext.requestHandlerContext.core.elasticsearch.legacy.client.callAsCurrentUser(
-    'search',
-    query
-  )) as SearchResponse<HostMetadataDetails>;
-
-  if (response.hits.hits.length === 0) {
-    return undefined;
-  }
-
-  const hostMetadata: HostMetadata = response.hits.hits[0]._source.HostDetails;
-  const agent = await findAgent(metadataRequestContext, hostMetadata);
-
-  if (agent && !agent.active) {
-    throw Boom.badRequest('the requested endpoint is unenrolled');
-  }
-
-  return enrichHostMetadata(hostMetadata, metadataRequestContext);
-}
-
-async function findAgent(
-  metadataRequestContext: MetadataRequestContext,
-  hostMetadata: HostMetadata
-): Promise<Agent | undefined> {
-  try {
-    return await metadataRequestContext.agentService.getAgent(
-      metadataRequestContext.requestHandlerContext.core.savedObjects.client,
-      hostMetadata.elastic.agent.id
-    );
-  } catch (e) {
-    if (
-      metadataRequestContext.requestHandlerContext.core.savedObjects.client.errors.isNotFoundError(
-        e
-      )
-    ) {
-      metadataRequestContext.logger.warn(
-        `agent with id ${hostMetadata.elastic.agent.id} not found`
-      );
-      return undefined;
-    } else {
-      throw e;
-    }
-  }
-}
 
-async function mapToHostResultList(
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  queryParams: Record<string, any>,
-  searchResponse: SearchResponse<HostMetadataDetails>,
-  metadataRequestContext: MetadataRequestContext
-): Promise<HostResultList> {
-  const totalNumberOfHosts =
-    ((searchResponse.hits?.total as unknown) as { value: number; relation: string }).value || 0;
-  if (searchResponse.hits.hits.length > 0) {
-    return {
-      request_page_size: queryParams.size,
-      request_page_index: queryParams.from,
-      hosts: await Promise.all(
-        searchResponse.hits.hits.map(async (entry) =>
-          enrichHostMetadata(entry._source.HostDetails, metadataRequestContext)
-        )
-      ),
-      total: totalNumberOfHosts,
-    };
-  } else {
-    return {
-      request_page_size: queryParams.size,
-      request_page_index: queryParams.from,
-      total: totalNumberOfHosts,
-      hosts: [],
-    };
-  }
-}
-
-async function enrichHostMetadata(
-  hostMetadata: HostMetadata,
-  metadataRequestContext: MetadataRequestContext
-): Promise<HostInfo> {
-  let hostStatus = HostStatus.ERROR;
-  let elasticAgentId = hostMetadata?.elastic?.agent?.id;
-  const log = metadataRequestContext.logger;
-  try {
-    /**
-     * Get agent status by elastic agent id if available or use the host id.
-     */
-
-    if (!elasticAgentId) {
-      elasticAgentId = hostMetadata.host.id;
-      log.warn(`Missing elastic agent id, using host id instead ${elasticAgentId}`);
-    }
-
-    const status = await metadataRequestContext.agentService.getAgentStatusById(
-      metadataRequestContext.requestHandlerContext.core.savedObjects.client,
-      elasticAgentId
-    );
-    hostStatus = HOST_STATUS_MAPPING.get(status) || HostStatus.ERROR;
-  } catch (e) {
-    if (
-      metadataRequestContext.requestHandlerContext.core.savedObjects.client.errors.isNotFoundError(
-        e
-      )
-    ) {
-      log.warn(`agent with id ${elasticAgentId} not found`);
-    } else {
-      log.error(e);
-      throw e;
-    }
-  }
-  return {
-    metadata: hostMetadata,
-    host_status: hostStatus,
-  };
+  router.get(
+    {
+      path: `${GET_METADATA_REQUEST_ROUTE}`,
+      validate: GetMetadataRequestSchema,
+      options: { authRequired: true, tags: ['access:securitySolution'] },
+    },
+    getMetadataRequestHandler(endpointAppContext, logger)
+  );
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts
index f784941f3539a..299939eb92444 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts
@@ -22,21 +22,26 @@ import {
 } from '../../../../../../../src/core/server/mocks';
 import {
   HostInfo,
-  HostMetadata,
-  HostMetadataDetails,
   HostResultList,
   HostStatus,
+  MetadataQueryStrategyVersions,
 } from '../../../../common/endpoint/types';
-import { SearchResponse } from 'elasticsearch';
-import { registerEndpointRoutes, endpointFilters } from './index';
+import { registerEndpointRoutes, METADATA_REQUEST_ROUTE } from './index';
 import {
   createMockEndpointAppContextServiceStartContract,
+  createMockPackageService,
   createRouteHandlerContext,
 } from '../../mocks';
 import { EndpointAppContextService } from '../../endpoint_app_context_services';
 import { createMockConfig } from '../../../lib/detection_engine/routes/__mocks__';
 import { EndpointDocGenerator } from '../../../../common/endpoint/generate_data';
-import { Agent } from '../../../../../ingest_manager/common/types/models';
+import {
+  Agent,
+  ElasticsearchAssetType,
+  EsAssetReference,
+} from '../../../../../ingest_manager/common/types/models';
+import { createV1SearchResponse, createV2SearchResponse } from './support/test_support';
+import { PackageService } from '../../../../../ingest_manager/server/services';
 
 describe('test endpoint route', () => {
   let routerMock: jest.Mocked<IRouter>;
@@ -44,6 +49,7 @@ describe('test endpoint route', () => {
   let mockClusterClient: jest.Mocked<ILegacyClusterClient>;
   let mockScopedClient: jest.Mocked<ILegacyScopedClusterClient>;
   let mockSavedObjectClient: jest.Mocked<SavedObjectsClientContract>;
+  let mockPackageService: jest.Mocked<PackageService>;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   let routeHandler: RequestHandler<any, any, any>;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -61,195 +67,45 @@ describe('test endpoint route', () => {
   };
 
   beforeEach(() => {
+    mockScopedClient = elasticsearchServiceMock.createLegacyScopedClusterClient();
     mockClusterClient = elasticsearchServiceMock.createLegacyClusterClient() as jest.Mocked<
       ILegacyClusterClient
     >;
-    mockScopedClient = elasticsearchServiceMock.createLegacyScopedClusterClient();
     mockSavedObjectClient = savedObjectsClientMock.create();
     mockClusterClient.asScoped.mockReturnValue(mockScopedClient);
     routerMock = httpServiceMock.createRouter();
     mockResponse = httpServerMock.createResponseFactory();
-    endpointAppContextService = new EndpointAppContextService();
-    const startContract = createMockEndpointAppContextServiceStartContract();
-    endpointAppContextService.start(startContract);
-    mockAgentService = startContract.agentService!;
-
-    registerEndpointRoutes(routerMock, {
-      logFactory: loggingSystemMock.create(),
-      service: endpointAppContextService,
-      config: () => Promise.resolve(createMockConfig()),
-    });
-  });
-
-  afterEach(() => endpointAppContextService.stop());
-
-  it('test find the latest of all endpoints', async () => {
-    const mockRequest = httpServerMock.createKibanaRequest({});
-    const response = createSearchResponse(new EndpointDocGenerator().generateHostMetadata());
-    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
-    [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
-      path.startsWith('/api/endpoint/metadata')
-    )!;
-    mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
-    mockAgentService.listAgents = jest.fn().mockReturnValue(noUnenrolledAgent);
-    await routeHandler(
-      createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
-      mockRequest,
-      mockResponse
-    );
-
-    expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
-    expect(routeConfig.options).toEqual({ authRequired: true, tags: ['access:securitySolution'] });
-    expect(mockResponse.ok).toBeCalled();
-    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
-    expect(endpointResultList.hosts.length).toEqual(1);
-    expect(endpointResultList.total).toEqual(1);
-    expect(endpointResultList.request_page_index).toEqual(0);
-    expect(endpointResultList.request_page_size).toEqual(10);
-  });
-
-  it('test find the latest of all endpoints with paging properties', async () => {
-    const mockRequest = httpServerMock.createKibanaRequest({
-      body: {
-        paging_properties: [
-          {
-            page_size: 10,
-          },
-          {
-            page_index: 1,
-          },
-        ],
-      },
-    });
-
-    mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
-    mockAgentService.listAgents = jest.fn().mockReturnValue(noUnenrolledAgent);
-    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
-      Promise.resolve(createSearchResponse(new EndpointDocGenerator().generateHostMetadata()))
-    );
-    [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
-      path.startsWith('/api/endpoint/metadata')
-    )!;
-
-    await routeHandler(
-      createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
-      mockRequest,
-      mockResponse
-    );
-
-    expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
-    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body?.query).toEqual({
-      bool: {
-        must_not: {
-          terms: {
-            'HostDetails.elastic.agent.id': [
-              '00000000-0000-0000-0000-000000000000',
-              '11111111-1111-1111-1111-111111111111',
-            ],
-          },
-        },
-      },
-    });
-    expect(routeConfig.options).toEqual({ authRequired: true, tags: ['access:securitySolution'] });
-    expect(mockResponse.ok).toBeCalled();
-    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
-    expect(endpointResultList.hosts.length).toEqual(1);
-    expect(endpointResultList.total).toEqual(1);
-    expect(endpointResultList.request_page_index).toEqual(10);
-    expect(endpointResultList.request_page_size).toEqual(10);
   });
 
-  it('test find the latest of all endpoints with paging and filters properties', async () => {
-    const mockRequest = httpServerMock.createKibanaRequest({
-      body: {
-        paging_properties: [
-          {
-            page_size: 10,
-          },
-          {
-            page_index: 1,
-          },
-        ],
-
-        filters: { kql: 'not host.ip:10.140.73.246' },
-      },
-    });
+  describe('with no transform package', () => {
+    beforeEach(() => {
+      endpointAppContextService = new EndpointAppContextService();
+      const startContract = createMockEndpointAppContextServiceStartContract();
+      mockPackageService = createMockPackageService();
+      mockPackageService.getInstalledEsAssetReferences.mockReturnValue(
+        Promise.resolve(([] as unknown) as EsAssetReference[])
+      );
+      endpointAppContextService.start({ ...startContract, packageService: mockPackageService });
+      mockAgentService = startContract.agentService!;
 
-    mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
-    mockAgentService.listAgents = jest.fn().mockReturnValue(noUnenrolledAgent);
-    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
-      Promise.resolve(createSearchResponse(new EndpointDocGenerator().generateHostMetadata()))
-    );
-    [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
-      path.startsWith('/api/endpoint/metadata')
-    )!;
-
-    await routeHandler(
-      createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
-      mockRequest,
-      mockResponse
-    );
-
-    expect(mockScopedClient.callAsCurrentUser).toBeCalled();
-    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body?.query).toEqual({
-      bool: {
-        must: [
-          {
-            bool: {
-              must_not: {
-                terms: {
-                  'HostDetails.elastic.agent.id': [
-                    '00000000-0000-0000-0000-000000000000',
-                    '11111111-1111-1111-1111-111111111111',
-                  ],
-                },
-              },
-            },
-          },
-          {
-            bool: {
-              must_not: {
-                bool: {
-                  should: [
-                    {
-                      match: {
-                        'host.ip': '10.140.73.246',
-                      },
-                    },
-                  ],
-                  minimum_should_match: 1,
-                },
-              },
-            },
-          },
-        ],
-      },
+      registerEndpointRoutes(routerMock, {
+        logFactory: loggingSystemMock.create(),
+        service: endpointAppContextService,
+        config: () => Promise.resolve(createMockConfig()),
+      });
     });
-    expect(routeConfig.options).toEqual({ authRequired: true, tags: ['access:securitySolution'] });
-    expect(mockResponse.ok).toBeCalled();
-    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
-    expect(endpointResultList.hosts.length).toEqual(1);
-    expect(endpointResultList.total).toEqual(1);
-    expect(endpointResultList.request_page_index).toEqual(10);
-    expect(endpointResultList.request_page_size).toEqual(10);
-  });
-
-  describe('Endpoint Details route', () => {
-    it('should return 404 on no results', async () => {
-      const mockRequest = httpServerMock.createKibanaRequest({ params: { id: 'BADID' } });
-
-      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
-        Promise.resolve(createSearchResponse())
-      );
 
-      mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
-      mockAgentService.getAgent = jest.fn().mockReturnValue(({
-        active: true,
-      } as unknown) as Agent);
+    afterEach(() => endpointAppContextService.stop());
 
-      [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
-        path.startsWith('/api/endpoint/metadata')
+    it('test find the latest of all endpoints', async () => {
+      const mockRequest = httpServerMock.createKibanaRequest({});
+      const response = createV1SearchResponse(new EndpointDocGenerator().generateHostMetadata());
+      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+      [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+        path.startsWith(`${METADATA_REQUEST_ROUTE}`)
       )!;
+      mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
+      mockAgentService.listAgents = jest.fn().mockReturnValue(noUnenrolledAgent);
       await routeHandler(
         createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
         mockRequest,
@@ -261,13 +117,19 @@ describe('test endpoint route', () => {
         authRequired: true,
         tags: ['access:securitySolution'],
       });
-      expect(mockResponse.notFound).toBeCalled();
-      const message = mockResponse.notFound.mock.calls[0][0]?.body;
-      expect(message).toEqual('Endpoint Not Found');
+      expect(mockResponse.ok).toBeCalled();
+      const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
+      expect(endpointResultList.hosts.length).toEqual(1);
+      expect(endpointResultList.total).toEqual(1);
+      expect(endpointResultList.request_page_index).toEqual(0);
+      expect(endpointResultList.request_page_size).toEqual(10);
+      expect(endpointResultList.query_strategy_version).toEqual(
+        MetadataQueryStrategyVersions.VERSION_1
+      );
     });
 
     it('should return a single endpoint with status online', async () => {
-      const response = createSearchResponse(new EndpointDocGenerator().generateHostMetadata());
+      const response = createV1SearchResponse(new EndpointDocGenerator().generateHostMetadata());
       const mockRequest = httpServerMock.createKibanaRequest({
         params: { id: response.hits.hits[0]._id },
       });
@@ -279,7 +141,7 @@ describe('test endpoint route', () => {
       mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
 
       [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
-        path.startsWith('/api/endpoint/metadata')
+        path.startsWith(`${METADATA_REQUEST_ROUTE}`)
       )!;
 
       await routeHandler(
@@ -297,29 +159,48 @@ describe('test endpoint route', () => {
       const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
       expect(result).toHaveProperty('metadata.Endpoint');
       expect(result.host_status).toEqual(HostStatus.ONLINE);
+      expect(result.query_strategy_version).toEqual(MetadataQueryStrategyVersions.VERSION_1);
     });
+  });
 
-    it('should return a single endpoint with status error when AgentService throw 404', async () => {
-      const response = createSearchResponse(new EndpointDocGenerator().generateHostMetadata());
-
-      const mockRequest = httpServerMock.createKibanaRequest({
-        params: { id: response.hits.hits[0]._id },
-      });
+  describe('with new transform package', () => {
+    beforeEach(() => {
+      endpointAppContextService = new EndpointAppContextService();
+      const startContract = createMockEndpointAppContextServiceStartContract();
+      mockPackageService = createMockPackageService();
+      mockPackageService.getInstalledEsAssetReferences.mockReturnValue(
+        Promise.resolve([
+          {
+            id: 'logs-endpoint.events.security',
+            type: ElasticsearchAssetType.indexTemplate,
+          },
+          {
+            id: 'metrics-endpoint.metadata-current-default-0.16.0-dev.0',
+            type: ElasticsearchAssetType.transform,
+          },
+        ])
+      );
+      endpointAppContextService.start({ ...startContract, packageService: mockPackageService });
+      mockAgentService = startContract.agentService!;
 
-      mockAgentService.getAgentStatusById = jest.fn().mockImplementation(() => {
-        SavedObjectsErrorHelpers.createGenericNotFoundError();
+      registerEndpointRoutes(routerMock, {
+        logFactory: loggingSystemMock.create(),
+        service: endpointAppContextService,
+        config: () => Promise.resolve(createMockConfig()),
       });
+    });
 
-      mockAgentService.getAgent = jest.fn().mockImplementation(() => {
-        SavedObjectsErrorHelpers.createGenericNotFoundError();
-      });
+    afterEach(() => endpointAppContextService.stop());
 
+    it('test find the latest of all endpoints', async () => {
+      const mockRequest = httpServerMock.createKibanaRequest({});
+      const response = createV2SearchResponse(new EndpointDocGenerator().generateHostMetadata());
       mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
-
-      [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
-        path.startsWith('/api/endpoint/metadata')
+      [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+        path.startsWith(`${METADATA_REQUEST_ROUTE}`)
       )!;
-
+      mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
+      mockAgentService.listAgents = jest.fn().mockReturnValue(noUnenrolledAgent);
       await routeHandler(
         createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
         mockRequest,
@@ -332,25 +213,37 @@ describe('test endpoint route', () => {
         tags: ['access:securitySolution'],
       });
       expect(mockResponse.ok).toBeCalled();
-      const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
-      expect(result.host_status).toEqual(HostStatus.ERROR);
+      const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
+      expect(endpointResultList.hosts.length).toEqual(1);
+      expect(endpointResultList.total).toEqual(1);
+      expect(endpointResultList.request_page_index).toEqual(0);
+      expect(endpointResultList.request_page_size).toEqual(10);
+      expect(endpointResultList.query_strategy_version).toEqual(
+        MetadataQueryStrategyVersions.VERSION_2
+      );
     });
 
-    it('should return a single endpoint with status error when status is not offline, online or enrolling', async () => {
-      const response = createSearchResponse(new EndpointDocGenerator().generateHostMetadata());
-
+    it('test find the latest of all endpoints with paging properties', async () => {
       const mockRequest = httpServerMock.createKibanaRequest({
-        params: { id: response.hits.hits[0]._id },
+        body: {
+          paging_properties: [
+            {
+              page_size: 10,
+            },
+            {
+              page_index: 1,
+            },
+          ],
+        },
       });
 
-      mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('warning');
-      mockAgentService.getAgent = jest.fn().mockReturnValue(({
-        active: true,
-      } as unknown) as Agent);
-      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
-
-      [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
-        path.startsWith('/api/endpoint/metadata')
+      mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
+      mockAgentService.listAgents = jest.fn().mockReturnValue(noUnenrolledAgent);
+      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
+        Promise.resolve(createV2SearchResponse(new EndpointDocGenerator().generateHostMetadata()))
+      );
+      [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+        path.startsWith(`${METADATA_REQUEST_ROUTE}`)
       )!;
 
       await routeHandler(
@@ -360,28 +253,56 @@ describe('test endpoint route', () => {
       );
 
       expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+      expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body?.query).toEqual({
+        bool: {
+          must_not: {
+            terms: {
+              'HostDetails.elastic.agent.id': [
+                '00000000-0000-0000-0000-000000000000',
+                '11111111-1111-1111-1111-111111111111',
+              ],
+            },
+          },
+        },
+      });
       expect(routeConfig.options).toEqual({
         authRequired: true,
         tags: ['access:securitySolution'],
       });
       expect(mockResponse.ok).toBeCalled();
-      const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
-      expect(result.host_status).toEqual(HostStatus.ERROR);
+      const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
+      expect(endpointResultList.hosts.length).toEqual(1);
+      expect(endpointResultList.total).toEqual(1);
+      expect(endpointResultList.request_page_index).toEqual(10);
+      expect(endpointResultList.request_page_size).toEqual(10);
+      expect(endpointResultList.query_strategy_version).toEqual(
+        MetadataQueryStrategyVersions.VERSION_2
+      );
     });
 
-    it('should throw error when endpoint agent is not active', async () => {
-      const response = createSearchResponse(new EndpointDocGenerator().generateHostMetadata());
-
+    it('test find the latest of all endpoints with paging and filters properties', async () => {
       const mockRequest = httpServerMock.createKibanaRequest({
-        params: { id: response.hits.hits[0]._id },
+        body: {
+          paging_properties: [
+            {
+              page_size: 10,
+            },
+            {
+              page_index: 1,
+            },
+          ],
+
+          filters: { kql: 'not host.ip:10.140.73.246' },
+        },
       });
-      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
-      mockAgentService.getAgent = jest.fn().mockReturnValue(({
-        active: false,
-      } as unknown) as Agent);
 
-      [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
-        path.startsWith('/api/endpoint/metadata')
+      mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
+      mockAgentService.listAgents = jest.fn().mockReturnValue(noUnenrolledAgent);
+      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
+        Promise.resolve(createV2SearchResponse(new EndpointDocGenerator().generateHostMetadata()))
+      );
+      [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+        path.startsWith(`${METADATA_REQUEST_ROUTE}`)
       )!;
 
       await routeHandler(
@@ -390,93 +311,216 @@ describe('test endpoint route', () => {
         mockResponse
       );
 
-      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
-      expect(mockResponse.customError).toBeCalled();
+      expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+      expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body?.query).toEqual({
+        bool: {
+          must: [
+            {
+              bool: {
+                must_not: {
+                  terms: {
+                    'HostDetails.elastic.agent.id': [
+                      '00000000-0000-0000-0000-000000000000',
+                      '11111111-1111-1111-1111-111111111111',
+                    ],
+                  },
+                },
+              },
+            },
+            {
+              bool: {
+                must_not: {
+                  bool: {
+                    should: [
+                      {
+                        match: {
+                          'host.ip': '10.140.73.246',
+                        },
+                      },
+                    ],
+                    minimum_should_match: 1,
+                  },
+                },
+              },
+            },
+          ],
+        },
+      });
+      expect(routeConfig.options).toEqual({
+        authRequired: true,
+        tags: ['access:securitySolution'],
+      });
+      expect(mockResponse.ok).toBeCalled();
+      const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
+      expect(endpointResultList.hosts.length).toEqual(1);
+      expect(endpointResultList.total).toEqual(1);
+      expect(endpointResultList.request_page_index).toEqual(10);
+      expect(endpointResultList.request_page_size).toEqual(10);
+      expect(endpointResultList.query_strategy_version).toEqual(
+        MetadataQueryStrategyVersions.VERSION_2
+      );
     });
-  });
-});
 
-describe('Filters Schema Test', () => {
-  it('accepts a single host status', () => {
-    expect(
-      endpointFilters.validate({
-        host_status: ['error'],
-      })
-    ).toBeTruthy();
-  });
-
-  it('accepts multiple host status filters', () => {
-    expect(
-      endpointFilters.validate({
-        host_status: ['offline', 'unenrolling'],
-      })
-    ).toBeTruthy();
-  });
+    describe('Endpoint Details route', () => {
+      it('should return 404 on no results', async () => {
+        const mockRequest = httpServerMock.createKibanaRequest({ params: { id: 'BADID' } });
+
+        mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
+          Promise.resolve(createV2SearchResponse())
+        );
+
+        mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
+        mockAgentService.getAgent = jest.fn().mockReturnValue(({
+          active: true,
+        } as unknown) as Agent);
+
+        [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+          path.startsWith(`${METADATA_REQUEST_ROUTE}`)
+        )!;
+        await routeHandler(
+          createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+          mockRequest,
+          mockResponse
+        );
+
+        expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+        expect(routeConfig.options).toEqual({
+          authRequired: true,
+          tags: ['access:securitySolution'],
+        });
+        expect(mockResponse.notFound).toBeCalled();
+        const message = mockResponse.notFound.mock.calls[0][0]?.body;
+        expect(message).toEqual('Endpoint Not Found');
+      });
 
-  it('rejects invalid statuses', () => {
-    expect(() =>
-      endpointFilters.validate({
-        host_status: ['foobar'],
-      })
-    ).toThrowError();
-  });
+      it('should return a single endpoint with status online', async () => {
+        const response = createV2SearchResponse(new EndpointDocGenerator().generateHostMetadata());
+        const mockRequest = httpServerMock.createKibanaRequest({
+          params: { id: response.hits.hits[0]._id },
+        });
+
+        mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('online');
+        mockAgentService.getAgent = jest.fn().mockReturnValue(({
+          active: true,
+        } as unknown) as Agent);
+        mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+
+        [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+          path.startsWith(`${METADATA_REQUEST_ROUTE}`)
+        )!;
+
+        await routeHandler(
+          createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+          mockRequest,
+          mockResponse
+        );
+
+        expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+        expect(routeConfig.options).toEqual({
+          authRequired: true,
+          tags: ['access:securitySolution'],
+        });
+        expect(mockResponse.ok).toBeCalled();
+        const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
+        expect(result).toHaveProperty('metadata.Endpoint');
+        expect(result.host_status).toEqual(HostStatus.ONLINE);
+        expect(result.query_strategy_version).toEqual(MetadataQueryStrategyVersions.VERSION_2);
+      });
 
-  it('accepts a KQL string', () => {
-    expect(
-      endpointFilters.validate({
-        kql: 'whatever.field',
-      })
-    ).toBeTruthy();
-  });
+      it('should return a single endpoint with status error when AgentService throw 404', async () => {
+        const response = createV2SearchResponse(new EndpointDocGenerator().generateHostMetadata());
+
+        const mockRequest = httpServerMock.createKibanaRequest({
+          params: { id: response.hits.hits[0]._id },
+        });
+
+        mockAgentService.getAgentStatusById = jest.fn().mockImplementation(() => {
+          SavedObjectsErrorHelpers.createGenericNotFoundError();
+        });
+
+        mockAgentService.getAgent = jest.fn().mockImplementation(() => {
+          SavedObjectsErrorHelpers.createGenericNotFoundError();
+        });
+
+        mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+
+        [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+          path.startsWith(`${METADATA_REQUEST_ROUTE}`)
+        )!;
+
+        await routeHandler(
+          createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+          mockRequest,
+          mockResponse
+        );
+
+        expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+        expect(routeConfig.options).toEqual({
+          authRequired: true,
+          tags: ['access:securitySolution'],
+        });
+        expect(mockResponse.ok).toBeCalled();
+        const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
+        expect(result.host_status).toEqual(HostStatus.ERROR);
+      });
 
-  it('accepts KQL + status', () => {
-    expect(
-      endpointFilters.validate({
-        kql: 'thing.var',
-        host_status: ['online'],
-      })
-    ).toBeTruthy();
-  });
+      it('should return a single endpoint with status error when status is not offline, online or enrolling', async () => {
+        const response = createV2SearchResponse(new EndpointDocGenerator().generateHostMetadata());
+
+        const mockRequest = httpServerMock.createKibanaRequest({
+          params: { id: response.hits.hits[0]._id },
+        });
+
+        mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('warning');
+        mockAgentService.getAgent = jest.fn().mockReturnValue(({
+          active: true,
+        } as unknown) as Agent);
+        mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+
+        [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+          path.startsWith(`${METADATA_REQUEST_ROUTE}`)
+        )!;
+
+        await routeHandler(
+          createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+          mockRequest,
+          mockResponse
+        );
+
+        expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+        expect(routeConfig.options).toEqual({
+          authRequired: true,
+          tags: ['access:securitySolution'],
+        });
+        expect(mockResponse.ok).toBeCalled();
+        const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
+        expect(result.host_status).toEqual(HostStatus.ERROR);
+      });
 
-  it('accepts no filters', () => {
-    expect(endpointFilters.validate({})).toBeTruthy();
+      it('should throw error when endpoint agent is not active', async () => {
+        const response = createV2SearchResponse(new EndpointDocGenerator().generateHostMetadata());
+
+        const mockRequest = httpServerMock.createKibanaRequest({
+          params: { id: response.hits.hits[0]._id },
+        });
+        mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+        mockAgentService.getAgent = jest.fn().mockReturnValue(({
+          active: false,
+        } as unknown) as Agent);
+
+        [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+          path.startsWith(`${METADATA_REQUEST_ROUTE}`)
+        )!;
+
+        await routeHandler(
+          createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+          mockRequest,
+          mockResponse
+        );
+
+        expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+        expect(mockResponse.customError).toBeCalled();
+      });
+    });
   });
 });
-
-function createSearchResponse(hostMetadata?: HostMetadata): SearchResponse<HostMetadataDetails> {
-  return ({
-    took: 15,
-    timed_out: false,
-    _shards: {
-      total: 1,
-      successful: 1,
-      skipped: 0,
-      failed: 0,
-    },
-    hits: {
-      total: {
-        value: 1,
-        relation: 'eq',
-      },
-      max_score: null,
-      hits: hostMetadata
-        ? [
-            {
-              _index: 'metrics-endpoint.metadata-default',
-              _id: '8FhM0HEBYyRTvb6lOQnw',
-              _score: null,
-              _source: {
-                agent: {
-                  id: '1e3472bb-5c20-4946-b469-b5af1a809e4f',
-                },
-                HostDetails: {
-                  ...hostMetadata,
-                },
-              },
-              sort: [1588337587997],
-            },
-          ]
-        : [],
-    },
-  } as unknown) as SearchResponse<HostMetadataDetails>;
-}
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts
new file mode 100644
index 0000000000000..568917c804733
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts
@@ -0,0 +1,412 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import {
+  ILegacyClusterClient,
+  IRouter,
+  ILegacyScopedClusterClient,
+  KibanaResponseFactory,
+  RequestHandler,
+  RouteConfig,
+  SavedObjectsClientContract,
+} from 'kibana/server';
+import { SavedObjectsErrorHelpers } from '../../../../../../../src/core/server/';
+import {
+  elasticsearchServiceMock,
+  httpServerMock,
+  httpServiceMock,
+  loggingSystemMock,
+  savedObjectsClientMock,
+} from '../../../../../../../src/core/server/mocks';
+import {
+  HostInfo,
+  HostResultList,
+  HostStatus,
+  MetadataQueryStrategyVersions,
+} from '../../../../common/endpoint/types';
+import { registerEndpointRoutes, METADATA_REQUEST_V1_ROUTE } from './index';
+import {
+  createMockEndpointAppContextServiceStartContract,
+  createMockPackageService,
+  createRouteHandlerContext,
+} from '../../mocks';
+import { EndpointAppContextService } from '../../endpoint_app_context_services';
+import { createMockConfig } from '../../../lib/detection_engine/routes/__mocks__';
+import { EndpointDocGenerator } from '../../../../common/endpoint/generate_data';
+import { Agent, EsAssetReference } from '../../../../../ingest_manager/common/types/models';
+import { createV1SearchResponse } from './support/test_support';
+import { PackageService } from '../../../../../ingest_manager/server/services';
+
+describe('test endpoint route v1', () => {
+  let routerMock: jest.Mocked<IRouter>;
+  let mockResponse: jest.Mocked<KibanaResponseFactory>;
+  let mockClusterClient: jest.Mocked<ILegacyClusterClient>;
+  let mockScopedClient: jest.Mocked<ILegacyScopedClusterClient>;
+  let mockSavedObjectClient: jest.Mocked<SavedObjectsClientContract>;
+  let mockPackageService: jest.Mocked<PackageService>;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  let routeHandler: RequestHandler<any, any, any>;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  let routeConfig: RouteConfig<any, any, any, any>;
+  // tests assume that ingestManager is enabled, and thus agentService is available
+  let mockAgentService: Required<
+    ReturnType<typeof createMockEndpointAppContextServiceStartContract>
+  >['agentService'];
+  let endpointAppContextService: EndpointAppContextService;
+  const noUnenrolledAgent = {
+    agents: [],
+    total: 0,
+    page: 1,
+    perPage: 1,
+  };
+
+  beforeEach(() => {
+    mockClusterClient = elasticsearchServiceMock.createLegacyClusterClient() as jest.Mocked<
+      ILegacyClusterClient
+    >;
+    mockScopedClient = elasticsearchServiceMock.createLegacyScopedClusterClient();
+    mockSavedObjectClient = savedObjectsClientMock.create();
+    mockClusterClient.asScoped.mockReturnValue(mockScopedClient);
+    routerMock = httpServiceMock.createRouter();
+    mockResponse = httpServerMock.createResponseFactory();
+    endpointAppContextService = new EndpointAppContextService();
+    mockPackageService = createMockPackageService();
+    mockPackageService.getInstalledEsAssetReferences.mockReturnValue(
+      Promise.resolve(([] as unknown) as EsAssetReference[])
+    );
+    const startContract = createMockEndpointAppContextServiceStartContract();
+    endpointAppContextService.start({ ...startContract, packageService: mockPackageService });
+    mockAgentService = startContract.agentService!;
+
+    registerEndpointRoutes(routerMock, {
+      logFactory: loggingSystemMock.create(),
+      service: endpointAppContextService,
+      config: () => Promise.resolve(createMockConfig()),
+    });
+  });
+
+  afterEach(() => endpointAppContextService.stop());
+
+  it('test find the latest of all endpoints', async () => {
+    const mockRequest = httpServerMock.createKibanaRequest({});
+    const response = createV1SearchResponse(new EndpointDocGenerator().generateHostMetadata());
+    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+    [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+      path.startsWith(`${METADATA_REQUEST_V1_ROUTE}`)
+    )!;
+    mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
+    mockAgentService.listAgents = jest.fn().mockReturnValue(noUnenrolledAgent);
+    await routeHandler(
+      createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+      mockRequest,
+      mockResponse
+    );
+
+    expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+    expect(routeConfig.options).toEqual({ authRequired: true, tags: ['access:securitySolution'] });
+    expect(mockResponse.ok).toBeCalled();
+    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
+    expect(endpointResultList.hosts.length).toEqual(1);
+    expect(endpointResultList.total).toEqual(1);
+    expect(endpointResultList.request_page_index).toEqual(0);
+    expect(endpointResultList.request_page_size).toEqual(10);
+    expect(endpointResultList.query_strategy_version).toEqual(
+      MetadataQueryStrategyVersions.VERSION_1
+    );
+  });
+
+  it('test find the latest of all endpoints with paging properties', async () => {
+    const mockRequest = httpServerMock.createKibanaRequest({
+      body: {
+        paging_properties: [
+          {
+            page_size: 10,
+          },
+          {
+            page_index: 1,
+          },
+        ],
+      },
+    });
+
+    mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
+    mockAgentService.listAgents = jest.fn().mockReturnValue(noUnenrolledAgent);
+    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
+      Promise.resolve(createV1SearchResponse(new EndpointDocGenerator().generateHostMetadata()))
+    );
+    [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+      path.startsWith(`${METADATA_REQUEST_V1_ROUTE}`)
+    )!;
+
+    await routeHandler(
+      createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+      mockRequest,
+      mockResponse
+    );
+
+    expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body?.query).toEqual({
+      bool: {
+        must_not: {
+          terms: {
+            'elastic.agent.id': [
+              '00000000-0000-0000-0000-000000000000',
+              '11111111-1111-1111-1111-111111111111',
+            ],
+          },
+        },
+      },
+    });
+    expect(routeConfig.options).toEqual({ authRequired: true, tags: ['access:securitySolution'] });
+    expect(mockResponse.ok).toBeCalled();
+    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
+    expect(endpointResultList.hosts.length).toEqual(1);
+    expect(endpointResultList.total).toEqual(1);
+    expect(endpointResultList.request_page_index).toEqual(10);
+    expect(endpointResultList.request_page_size).toEqual(10);
+    expect(endpointResultList.query_strategy_version).toEqual(
+      MetadataQueryStrategyVersions.VERSION_1
+    );
+  });
+
+  it('test find the latest of all endpoints with paging and filters properties', async () => {
+    const mockRequest = httpServerMock.createKibanaRequest({
+      body: {
+        paging_properties: [
+          {
+            page_size: 10,
+          },
+          {
+            page_index: 1,
+          },
+        ],
+
+        filters: { kql: 'not host.ip:10.140.73.246' },
+      },
+    });
+
+    mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
+    mockAgentService.listAgents = jest.fn().mockReturnValue(noUnenrolledAgent);
+    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
+      Promise.resolve(createV1SearchResponse(new EndpointDocGenerator().generateHostMetadata()))
+    );
+    [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+      path.startsWith(`${METADATA_REQUEST_V1_ROUTE}`)
+    )!;
+
+    await routeHandler(
+      createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+      mockRequest,
+      mockResponse
+    );
+
+    expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body?.query).toEqual({
+      bool: {
+        must: [
+          {
+            bool: {
+              must_not: {
+                terms: {
+                  'elastic.agent.id': [
+                    '00000000-0000-0000-0000-000000000000',
+                    '11111111-1111-1111-1111-111111111111',
+                  ],
+                },
+              },
+            },
+          },
+          {
+            bool: {
+              must_not: {
+                bool: {
+                  should: [
+                    {
+                      match: {
+                        'host.ip': '10.140.73.246',
+                      },
+                    },
+                  ],
+                  minimum_should_match: 1,
+                },
+              },
+            },
+          },
+        ],
+      },
+    });
+    expect(routeConfig.options).toEqual({ authRequired: true, tags: ['access:securitySolution'] });
+    expect(mockResponse.ok).toBeCalled();
+    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
+    expect(endpointResultList.hosts.length).toEqual(1);
+    expect(endpointResultList.total).toEqual(1);
+    expect(endpointResultList.request_page_index).toEqual(10);
+    expect(endpointResultList.request_page_size).toEqual(10);
+    expect(endpointResultList.query_strategy_version).toEqual(
+      MetadataQueryStrategyVersions.VERSION_1
+    );
+  });
+
+  describe('Endpoint Details route', () => {
+    it('should return 404 on no results', async () => {
+      const mockRequest = httpServerMock.createKibanaRequest({ params: { id: 'BADID' } });
+
+      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
+        Promise.resolve(createV1SearchResponse())
+      );
+
+      mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('error');
+      mockAgentService.getAgent = jest.fn().mockReturnValue(({
+        active: true,
+      } as unknown) as Agent);
+
+      [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+        path.startsWith(`${METADATA_REQUEST_V1_ROUTE}`)
+      )!;
+      await routeHandler(
+        createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+        mockRequest,
+        mockResponse
+      );
+
+      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+      expect(routeConfig.options).toEqual({
+        authRequired: true,
+        tags: ['access:securitySolution'],
+      });
+      expect(mockResponse.notFound).toBeCalled();
+      const message = mockResponse.notFound.mock.calls[0][0]?.body;
+      expect(message).toEqual('Endpoint Not Found');
+    });
+
+    it('should return a single endpoint with status online', async () => {
+      const response = createV1SearchResponse(new EndpointDocGenerator().generateHostMetadata());
+      const mockRequest = httpServerMock.createKibanaRequest({
+        params: { id: response.hits.hits[0]._id },
+      });
+
+      mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('online');
+      mockAgentService.getAgent = jest.fn().mockReturnValue(({
+        active: true,
+      } as unknown) as Agent);
+      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+
+      [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+        path.startsWith(`${METADATA_REQUEST_V1_ROUTE}`)
+      )!;
+
+      await routeHandler(
+        createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+        mockRequest,
+        mockResponse
+      );
+
+      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+      expect(routeConfig.options).toEqual({
+        authRequired: true,
+        tags: ['access:securitySolution'],
+      });
+      expect(mockResponse.ok).toBeCalled();
+      const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
+      expect(result).toHaveProperty('metadata.Endpoint');
+      expect(result.host_status).toEqual(HostStatus.ONLINE);
+    });
+
+    it('should return a single endpoint with status error when AgentService throw 404', async () => {
+      const response = createV1SearchResponse(new EndpointDocGenerator().generateHostMetadata());
+
+      const mockRequest = httpServerMock.createKibanaRequest({
+        params: { id: response.hits.hits[0]._id },
+      });
+
+      mockAgentService.getAgentStatusById = jest.fn().mockImplementation(() => {
+        SavedObjectsErrorHelpers.createGenericNotFoundError();
+      });
+
+      mockAgentService.getAgent = jest.fn().mockImplementation(() => {
+        SavedObjectsErrorHelpers.createGenericNotFoundError();
+      });
+
+      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+
+      [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+        path.startsWith(`${METADATA_REQUEST_V1_ROUTE}`)
+      )!;
+
+      await routeHandler(
+        createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+        mockRequest,
+        mockResponse
+      );
+
+      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+      expect(routeConfig.options).toEqual({
+        authRequired: true,
+        tags: ['access:securitySolution'],
+      });
+      expect(mockResponse.ok).toBeCalled();
+      const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
+      expect(result.host_status).toEqual(HostStatus.ERROR);
+    });
+
+    it('should return a single endpoint with status error when status is not offline, online or enrolling', async () => {
+      const response = createV1SearchResponse(new EndpointDocGenerator().generateHostMetadata());
+
+      const mockRequest = httpServerMock.createKibanaRequest({
+        params: { id: response.hits.hits[0]._id },
+      });
+
+      mockAgentService.getAgentStatusById = jest.fn().mockReturnValue('warning');
+      mockAgentService.getAgent = jest.fn().mockReturnValue(({
+        active: true,
+      } as unknown) as Agent);
+      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+
+      [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+        path.startsWith(`${METADATA_REQUEST_V1_ROUTE}`)
+      )!;
+
+      await routeHandler(
+        createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+        mockRequest,
+        mockResponse
+      );
+
+      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+      expect(routeConfig.options).toEqual({
+        authRequired: true,
+        tags: ['access:securitySolution'],
+      });
+      expect(mockResponse.ok).toBeCalled();
+      const result = mockResponse.ok.mock.calls[0][0]?.body as HostInfo;
+      expect(result.host_status).toEqual(HostStatus.ERROR);
+    });
+
+    it('should throw error when endpoint agent is not active', async () => {
+      const response = createV1SearchResponse(new EndpointDocGenerator().generateHostMetadata());
+
+      const mockRequest = httpServerMock.createKibanaRequest({
+        params: { id: response.hits.hits[0]._id },
+      });
+      mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+      mockAgentService.getAgent = jest.fn().mockReturnValue(({
+        active: false,
+      } as unknown) as Agent);
+
+      [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+        path.startsWith(`${METADATA_REQUEST_V1_ROUTE}`)
+      )!;
+
+      await routeHandler(
+        createRouteHandlerContext(mockScopedClient, mockSavedObjectClient),
+        mockRequest,
+        mockResponse
+      );
+
+      expect(mockScopedClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+      expect(mockResponse.customError).toBeCalled();
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.test.ts
index 84da4a0960820..cb79263ef6b3c 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.test.ts
@@ -8,6 +8,7 @@ import { kibanaRequestToMetadataListESQuery, getESQueryHostMetadataByID } from '
 import { EndpointAppContextService } from '../../endpoint_app_context_services';
 import { createMockConfig } from '../../../lib/detection_engine/routes/__mocks__';
 import { metadataCurrentIndexPattern } from '../../../../common/endpoint/constants';
+import { metadataQueryStrategyV2 } from './support/query_strategies';
 
 describe('query builder', () => {
   describe('MetadataListESQuery', () => {
@@ -22,7 +23,7 @@ describe('query builder', () => {
           service: new EndpointAppContextService(),
           config: () => Promise.resolve(createMockConfig()),
         },
-        metadataCurrentIndexPattern
+        metadataQueryStrategyV2()
       );
       expect(query).toEqual({
         body: {
@@ -59,7 +60,7 @@ describe('query builder', () => {
             service: new EndpointAppContextService(),
             config: () => Promise.resolve(createMockConfig()),
           },
-          metadataCurrentIndexPattern,
+          metadataQueryStrategyV2(),
           {
             unenrolledAgentIds: [unenrolledElasticAgentId],
           }
@@ -107,7 +108,7 @@ describe('query builder', () => {
           service: new EndpointAppContextService(),
           config: () => Promise.resolve(createMockConfig()),
         },
-        metadataCurrentIndexPattern
+        metadataQueryStrategyV2()
       );
 
       expect(query).toEqual({
@@ -166,7 +167,7 @@ describe('query builder', () => {
             service: new EndpointAppContextService(),
             config: () => Promise.resolve(createMockConfig()),
           },
-          metadataCurrentIndexPattern,
+          metadataQueryStrategyV2(),
           {
             unenrolledAgentIds: [unenrolledElasticAgentId],
           }
@@ -225,7 +226,7 @@ describe('query builder', () => {
   describe('MetadataGetQuery', () => {
     it('searches for the correct ID', () => {
       const mockID = 'AABBCCDD-0011-2233-AA44-DEADBEEF8899';
-      const query = getESQueryHostMetadataByID(mockID, metadataCurrentIndexPattern);
+      const query = getESQueryHostMetadataByID(mockID, metadataQueryStrategyV2());
 
       expect(query).toEqual({
         body: {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.ts
index 9002d328efbe3..0b166e097af94 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders.ts
@@ -5,7 +5,7 @@
  */
 import { KibanaRequest } from 'kibana/server';
 import { esKuery } from '../../../../../../../src/plugins/data/server';
-import { EndpointAppContext } from '../../types';
+import { EndpointAppContext, MetadataQueryStrategy } from '../../types';
 
 export interface QueryBuilderOptions {
   unenrolledAgentIds?: string[];
@@ -16,29 +16,26 @@ export async function kibanaRequestToMetadataListESQuery(
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   request: KibanaRequest<any, any, any>,
   endpointAppContext: EndpointAppContext,
-  index: string,
+  metadataQueryStrategy: MetadataQueryStrategy,
   queryBuilderOptions?: QueryBuilderOptions
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
 ): Promise<Record<string, any>> {
   const pagingProperties = await getPagingProperties(request, endpointAppContext);
+
   return {
     body: {
       query: buildQueryBody(
         request,
+        metadataQueryStrategy,
         queryBuilderOptions?.unenrolledAgentIds!,
         queryBuilderOptions?.statusAgentIDs!
       ),
-      sort: [
-        {
-          'HostDetails.event.created': {
-            order: 'desc',
-          },
-        },
-      ],
+      ...metadataQueryStrategy.extraBodyProperties,
+      sort: metadataQueryStrategy.sortProperty,
     },
     from: pagingProperties.pageIndex * pagingProperties.pageSize,
     size: pagingProperties.pageSize,
-    index,
+    index: metadataQueryStrategy.index,
   };
 }
 
@@ -66,6 +63,7 @@ async function getPagingProperties(
 function buildQueryBody(
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   request: KibanaRequest<any, any, any>,
+  metadataQueryStrategy: MetadataQueryStrategy,
   unerolledAgentIds: string[] | undefined,
   statusAgentIDs: string[] | undefined
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -75,7 +73,7 @@ function buildQueryBody(
       ? {
           must_not: {
             terms: {
-              'HostDetails.elastic.agent.id': unerolledAgentIds,
+              [metadataQueryStrategy.elasticAgentIdProperty]: unerolledAgentIds,
             },
           },
         }
@@ -84,7 +82,7 @@ function buildQueryBody(
     ? {
         must: {
           terms: {
-            'HostDetails.elastic.agent.id': statusAgentIDs,
+            [metadataQueryStrategy.elasticAgentIdProperty]: statusAgentIDs,
           },
         },
       }
@@ -117,23 +115,20 @@ function buildQueryBody(
       };
 }
 
-export function getESQueryHostMetadataByID(hostID: string, index: string) {
+export function getESQueryHostMetadataByID(
+  hostID: string,
+  metadataQueryStrategy: MetadataQueryStrategy
+) {
   return {
     body: {
       query: {
         match: {
-          'HostDetails.host.id': hostID,
+          [metadataQueryStrategy.hostIdProperty]: hostID,
         },
       },
-      sort: [
-        {
-          'HostDetails.event.created': {
-            order: 'desc',
-          },
-        },
-      ],
+      sort: metadataQueryStrategy.sortProperty,
       size: 1,
     },
-    index,
+    index: metadataQueryStrategy.index,
   };
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders_v1.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders_v1.test.ts
new file mode 100644
index 0000000000000..899fe4b880acd
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/query_builders_v1.test.ts
@@ -0,0 +1,300 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { httpServerMock, loggingSystemMock } from '../../../../../../../src/core/server/mocks';
+import { kibanaRequestToMetadataListESQuery, getESQueryHostMetadataByID } from './query_builders';
+import { EndpointAppContextService } from '../../endpoint_app_context_services';
+import { createMockConfig } from '../../../lib/detection_engine/routes/__mocks__';
+import { metadataIndexPattern } from '../../../../common/endpoint/constants';
+import { metadataQueryStrategyV1 } from './support/query_strategies';
+
+describe('query builder v1', () => {
+  describe('MetadataListESQuery', () => {
+    it('test default query params for all endpoints metadata when no params or body is provided', async () => {
+      const mockRequest = httpServerMock.createKibanaRequest({
+        body: {},
+      });
+      const query = await kibanaRequestToMetadataListESQuery(
+        mockRequest,
+        {
+          logFactory: loggingSystemMock.create(),
+          service: new EndpointAppContextService(),
+          config: () => Promise.resolve(createMockConfig()),
+        },
+        metadataQueryStrategyV1()
+      );
+      expect(query).toEqual({
+        body: {
+          query: {
+            match_all: {},
+          },
+          collapse: {
+            field: 'host.id',
+            inner_hits: {
+              name: 'most_recent',
+              size: 1,
+              sort: [{ 'event.created': 'desc' }],
+            },
+          },
+          aggs: {
+            total: {
+              cardinality: {
+                field: 'host.id',
+              },
+            },
+          },
+          sort: [
+            {
+              'event.created': {
+                order: 'desc',
+              },
+            },
+          ],
+        },
+        from: 0,
+        size: 10,
+        index: metadataIndexPattern,
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      } as Record<string, any>);
+    });
+
+    it(
+      'test default query params for all endpoints metadata when no params or body is provided ' +
+        'with unenrolled host ids excluded',
+      async () => {
+        const unenrolledElasticAgentId = '1fdca33f-799f-49f4-939c-ea4383c77672';
+        const mockRequest = httpServerMock.createKibanaRequest({
+          body: {},
+        });
+        const query = await kibanaRequestToMetadataListESQuery(
+          mockRequest,
+          {
+            logFactory: loggingSystemMock.create(),
+            service: new EndpointAppContextService(),
+            config: () => Promise.resolve(createMockConfig()),
+          },
+          metadataQueryStrategyV1(),
+          {
+            unenrolledAgentIds: [unenrolledElasticAgentId],
+          }
+        );
+        expect(query).toEqual({
+          body: {
+            query: {
+              bool: {
+                must_not: {
+                  terms: {
+                    'elastic.agent.id': [unenrolledElasticAgentId],
+                  },
+                },
+              },
+            },
+            collapse: {
+              field: 'host.id',
+              inner_hits: {
+                name: 'most_recent',
+                size: 1,
+                sort: [{ 'event.created': 'desc' }],
+              },
+            },
+            aggs: {
+              total: {
+                cardinality: {
+                  field: 'host.id',
+                },
+              },
+            },
+            sort: [
+              {
+                'event.created': {
+                  order: 'desc',
+                },
+              },
+            ],
+          },
+          from: 0,
+          size: 10,
+          index: metadataIndexPattern,
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        } as Record<string, any>);
+      }
+    );
+  });
+
+  describe('test query builder with kql filter', () => {
+    it('test default query params for all endpoints metadata when body filter is provided', async () => {
+      const mockRequest = httpServerMock.createKibanaRequest({
+        body: {
+          filters: { kql: 'not host.ip:10.140.73.246' },
+        },
+      });
+      const query = await kibanaRequestToMetadataListESQuery(
+        mockRequest,
+        {
+          logFactory: loggingSystemMock.create(),
+          service: new EndpointAppContextService(),
+          config: () => Promise.resolve(createMockConfig()),
+        },
+        metadataQueryStrategyV1()
+      );
+
+      expect(query).toEqual({
+        body: {
+          query: {
+            bool: {
+              must: [
+                {
+                  bool: {
+                    must_not: {
+                      bool: {
+                        should: [
+                          {
+                            match: {
+                              'host.ip': '10.140.73.246',
+                            },
+                          },
+                        ],
+                        minimum_should_match: 1,
+                      },
+                    },
+                  },
+                },
+              ],
+            },
+          },
+          collapse: {
+            field: 'host.id',
+            inner_hits: {
+              name: 'most_recent',
+              size: 1,
+              sort: [{ 'event.created': 'desc' }],
+            },
+          },
+          aggs: {
+            total: {
+              cardinality: {
+                field: 'host.id',
+              },
+            },
+          },
+          sort: [
+            {
+              'event.created': {
+                order: 'desc',
+              },
+            },
+          ],
+        },
+        from: 0,
+        size: 10,
+        index: metadataIndexPattern,
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      } as Record<string, any>);
+    });
+
+    it(
+      'test default query params for all endpoints endpoint metadata excluding unerolled endpoint ' +
+        'and when body filter is provided',
+      async () => {
+        const unenrolledElasticAgentId = '1fdca33f-799f-49f4-939c-ea4383c77672';
+        const mockRequest = httpServerMock.createKibanaRequest({
+          body: {
+            filters: { kql: 'not host.ip:10.140.73.246' },
+          },
+        });
+        const query = await kibanaRequestToMetadataListESQuery(
+          mockRequest,
+          {
+            logFactory: loggingSystemMock.create(),
+            service: new EndpointAppContextService(),
+            config: () => Promise.resolve(createMockConfig()),
+          },
+          metadataQueryStrategyV1(),
+          {
+            unenrolledAgentIds: [unenrolledElasticAgentId],
+          }
+        );
+
+        expect(query).toEqual({
+          body: {
+            query: {
+              bool: {
+                must: [
+                  {
+                    bool: {
+                      must_not: {
+                        terms: {
+                          'elastic.agent.id': [unenrolledElasticAgentId],
+                        },
+                      },
+                    },
+                  },
+                  {
+                    bool: {
+                      must_not: {
+                        bool: {
+                          should: [
+                            {
+                              match: {
+                                'host.ip': '10.140.73.246',
+                              },
+                            },
+                          ],
+                          minimum_should_match: 1,
+                        },
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            collapse: {
+              field: 'host.id',
+              inner_hits: {
+                name: 'most_recent',
+                size: 1,
+                sort: [{ 'event.created': 'desc' }],
+              },
+            },
+            aggs: {
+              total: {
+                cardinality: {
+                  field: 'host.id',
+                },
+              },
+            },
+            sort: [
+              {
+                'event.created': {
+                  order: 'desc',
+                },
+              },
+            ],
+          },
+          from: 0,
+          size: 10,
+          index: metadataIndexPattern,
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        } as Record<string, any>);
+      }
+    );
+  });
+
+  describe('MetadataGetQuery', () => {
+    it('searches for the correct ID', () => {
+      const mockID = 'AABBCCDD-0011-2233-AA44-DEADBEEF8899';
+      const query = getESQueryHostMetadataByID(mockID, metadataQueryStrategyV1());
+
+      expect(query).toEqual({
+        body: {
+          query: { match: { 'host.id': mockID } },
+          sort: [{ 'event.created': { order: 'desc' } }],
+          size: 1,
+        },
+        index: metadataIndexPattern,
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/route_schema_test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/route_schema_test.ts
new file mode 100644
index 0000000000000..851c51618c79b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/route_schema_test.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { endpointFilters } from './index';
+
+describe('Filters Schema Test', () => {
+  it('accepts a single host status', () => {
+    expect(
+      endpointFilters.validate({
+        host_status: ['error'],
+      })
+    ).toBeTruthy();
+  });
+
+  it('accepts multiple host status filters', () => {
+    expect(
+      endpointFilters.validate({
+        host_status: ['offline', 'unenrolling'],
+      })
+    ).toBeTruthy();
+  });
+
+  it('rejects invalid statuses', () => {
+    expect(() =>
+      endpointFilters.validate({
+        host_status: ['foobar'],
+      })
+    ).toThrowError();
+  });
+
+  it('accepts a KQL string', () => {
+    expect(
+      endpointFilters.validate({
+        kql: 'whatever.field',
+      })
+    ).toBeTruthy();
+  });
+
+  it('accepts KQL + status', () => {
+    expect(
+      endpointFilters.validate({
+        kql: 'thing.var',
+        host_status: ['online'],
+      })
+    ).toBeTruthy();
+  });
+
+  it('accepts no filters', () => {
+    expect(endpointFilters.validate({})).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/query_strategies.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/query_strategies.ts
new file mode 100644
index 0000000000000..df4c377262466
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/query_strategies.ts
@@ -0,0 +1,115 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { SearchResponse } from 'elasticsearch';
+import {
+  metadataCurrentIndexPattern,
+  metadataIndexPattern,
+} from '../../../../../common/endpoint/constants';
+import {
+  HostMetadata,
+  HostMetadataDetails,
+  MetadataQueryStrategyVersions,
+} from '../../../../../common/endpoint/types';
+import { HostListQueryResult, HostQueryResult, MetadataQueryStrategy } from '../../../types';
+
+interface HitSource {
+  _source: HostMetadata;
+}
+
+export function metadataQueryStrategyV1(): MetadataQueryStrategy {
+  return {
+    index: metadataIndexPattern,
+    elasticAgentIdProperty: 'elastic.agent.id',
+    hostIdProperty: 'host.id',
+    sortProperty: [
+      {
+        'event.created': {
+          order: 'desc',
+        },
+      },
+    ],
+    extraBodyProperties: {
+      collapse: {
+        field: 'host.id',
+        inner_hits: {
+          name: 'most_recent',
+          size: 1,
+          sort: [{ 'event.created': 'desc' }],
+        },
+      },
+      aggs: {
+        total: {
+          cardinality: {
+            field: 'host.id',
+          },
+        },
+      },
+    },
+    queryResponseToHostListResult: (
+      searchResponse: SearchResponse<HostMetadata | HostMetadataDetails>
+    ): HostListQueryResult => {
+      const response = searchResponse as SearchResponse<HostMetadata>;
+      return {
+        resultLength: response?.aggregations?.total?.value || 0,
+        resultList: response.hits.hits
+          .map((hit) => hit.inner_hits.most_recent.hits.hits)
+          .flatMap((data) => data as HitSource)
+          .map((entry) => entry._source),
+        queryStrategyVersion: MetadataQueryStrategyVersions.VERSION_1,
+      };
+    },
+    queryResponseToHostResult: (
+      searchResponse: SearchResponse<HostMetadata | HostMetadataDetails>
+    ): HostQueryResult => {
+      const response = searchResponse as SearchResponse<HostMetadata>;
+      return {
+        resultLength: response.hits.hits.length,
+        result: response.hits.hits.length > 0 ? response.hits.hits[0]._source : undefined,
+        queryStrategyVersion: MetadataQueryStrategyVersions.VERSION_1,
+      };
+    },
+  };
+}
+
+export function metadataQueryStrategyV2(): MetadataQueryStrategy {
+  return {
+    index: metadataCurrentIndexPattern,
+    elasticAgentIdProperty: 'HostDetails.elastic.agent.id',
+    hostIdProperty: 'HostDetails.host.id',
+    sortProperty: [
+      {
+        'HostDetails.event.created': {
+          order: 'desc',
+        },
+      },
+    ],
+    queryResponseToHostListResult: (
+      searchResponse: SearchResponse<HostMetadata | HostMetadataDetails>
+    ): HostListQueryResult => {
+      const response = searchResponse as SearchResponse<HostMetadataDetails>;
+      return {
+        resultLength:
+          ((response.hits?.total as unknown) as { value: number; relation: string }).value || 0,
+        resultList:
+          response.hits.hits.length > 0
+            ? response.hits.hits.map((entry) => entry._source.HostDetails)
+            : [],
+        queryStrategyVersion: MetadataQueryStrategyVersions.VERSION_2,
+      };
+    },
+    queryResponseToHostResult: (
+      searchResponse: SearchResponse<HostMetadata | HostMetadataDetails>
+    ): HostQueryResult => {
+      const response = searchResponse as SearchResponse<HostMetadataDetails>;
+      return {
+        resultLength: response.hits.hits.length,
+        result:
+          response.hits.hits.length > 0 ? response.hits.hits[0]._source.HostDetails : undefined,
+        queryStrategyVersion: MetadataQueryStrategyVersions.VERSION_2,
+      };
+    },
+  };
+}
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/test_support.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/test_support.ts
new file mode 100644
index 0000000000000..ac6ee380c8b06
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/test_support.ts
@@ -0,0 +1,103 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { SearchResponse } from 'elasticsearch';
+import { HostMetadata, HostMetadataDetails } from '../../../../../common/endpoint/types';
+
+export function createV1SearchResponse(hostMetadata?: HostMetadata): SearchResponse<HostMetadata> {
+  return ({
+    took: 15,
+    timed_out: false,
+    _shards: {
+      total: 1,
+      successful: 1,
+      skipped: 0,
+      failed: 0,
+    },
+    hits: {
+      total: {
+        value: 5,
+        relation: 'eq',
+      },
+      max_score: null,
+      hits: hostMetadata
+        ? [
+            {
+              _index: 'metrics-endpoint.metadata-default',
+              _id: '8FhM0HEBYyRTvb6lOQnw',
+              _score: null,
+              _source: hostMetadata,
+              sort: [1588337587997],
+              inner_hits: {
+                most_recent: {
+                  hits: {
+                    total: {
+                      value: 2,
+                      relation: 'eq',
+                    },
+                    max_score: null,
+                    hits: [
+                      {
+                        _index: 'metrics-endpoint.metadata-default',
+                        _id: 'W6Vo1G8BYQH1gtPUgYkC',
+                        _score: null,
+                        _source: hostMetadata,
+                        sort: [1579816615336],
+                      },
+                    ],
+                  },
+                },
+              },
+            },
+          ]
+        : [],
+    },
+    aggregations: {
+      total: {
+        value: 1,
+      },
+    },
+  } as unknown) as SearchResponse<HostMetadata>;
+}
+
+export function createV2SearchResponse(
+  hostMetadata?: HostMetadata
+): SearchResponse<HostMetadataDetails> {
+  return ({
+    took: 15,
+    timed_out: false,
+    _shards: {
+      total: 1,
+      successful: 1,
+      skipped: 0,
+      failed: 0,
+    },
+    hits: {
+      total: {
+        value: 1,
+        relation: 'eq',
+      },
+      max_score: null,
+      hits: hostMetadata
+        ? [
+            {
+              _index: 'metrics-endpoint.metadata-default',
+              _id: '8FhM0HEBYyRTvb6lOQnw',
+              _score: null,
+              _source: {
+                agent: {
+                  id: '1e3472bb-5c20-4946-b469-b5af1a809e4f',
+                },
+                HostDetails: {
+                  ...hostMetadata,
+                },
+              },
+              sort: [1588337587997],
+            },
+          ]
+        : [],
+    },
+  } as unknown) as SearchResponse<HostMetadataDetails>;
+}
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts
index 8c7daf9451217..4c7be9b8d5a24 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts
@@ -4,15 +4,59 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { SearchResponse } from 'elasticsearch';
-import { SafeResolverEvent } from '../../../../../common/endpoint/types';
+import { ECSField } from '../../../../../common/endpoint/types';
 import { ResolverQuery } from './base';
 import { ChildrenPaginationBuilder } from '../utils/children_pagination';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
 
+/**
+ * This type represents the document returned from ES for a legacy event when using the ChildrenQuery to fetch legacy events.
+ * It contains only the necessary fields that the children api needs to process the results before
+ * it requests the full lifecycle information for the children in a later query.
+ */
+export type LegacyChildEvent = Partial<{
+  '@timestamp': ECSField<number>;
+  event: Partial<{
+    type: ECSField<string>;
+    action: ECSField<string>;
+  }>;
+  endgame: Partial<{
+    serial_event_id: ECSField<number>;
+    unique_pid: ECSField<number>;
+    unique_ppid: ECSField<number>;
+  }>;
+}>;
+
+/**
+ * This type represents the document returned from ES for an event when using the ChildrenQuery to fetch legacy events.
+ * It contains only the necessary fields that the children api needs to process the results before
+ * it requests the full lifecycle information for the children in a later query.
+ */
+export type EndpointChildEvent = Partial<{
+  '@timestamp': ECSField<number>;
+  event: Partial<{
+    type: ECSField<string>;
+    sequence: ECSField<number>;
+  }>;
+  process: Partial<{
+    entity_id: ECSField<string>;
+    parent: Partial<{
+      entity_id: ECSField<string>;
+    }>;
+    Ext: Partial<{
+      ancestry: ECSField<string>;
+    }>;
+  }>;
+}>;
+
+export type ChildEvent = EndpointChildEvent | LegacyChildEvent;
+
 /**
  * Builds a query for retrieving descendants of a node.
+ * The first type `ChildEvent[]` represents the final formatted result. The second type `ChildEvent` defines the type
+ * used in the `SearchResponse<T>` field returned from the ES query.
  */
-export class ChildrenQuery extends ResolverQuery<SafeResolverEvent[]> {
+export class ChildrenQuery extends ResolverQuery<ChildEvent[], ChildEvent> {
   constructor(
     private readonly pagination: ChildrenPaginationBuilder,
     indexPattern: string | string[],
@@ -24,6 +68,14 @@ export class ChildrenQuery extends ResolverQuery<SafeResolverEvent[]> {
   protected legacyQuery(endpointID: string, uniquePIDs: string[]): JsonObject {
     const paginationFields = this.pagination.buildQueryFields('endgame.serial_event_id');
     return {
+      _source: [
+        '@timestamp',
+        'endgame.serial_event_id',
+        'endgame.unique_pid',
+        'endgame.unique_ppid',
+        'event.type',
+        'event.action',
+      ],
       collapse: {
         field: 'endgame.unique_pid',
       },
@@ -64,8 +116,18 @@ export class ChildrenQuery extends ResolverQuery<SafeResolverEvent[]> {
   }
 
   protected query(entityIDs: string[]): JsonObject {
+    // we don't have to include the `event.id` in the source response because it is not needed for processing
+    // the data returned by ES, it is only used for breaking ties when ES is doing the search
     const paginationFields = this.pagination.buildQueryFields('event.id');
     return {
+      _source: [
+        '@timestamp',
+        'event.type',
+        'event.sequence',
+        'process.entity_id',
+        'process.parent.entity_id',
+        'process.Ext.ancestry',
+      ],
       /**
        * Using collapse here will only return a single event per occurrence of a process.entity_id. The events are sorted
        * based on timestamp in ascending order so it will be the first event that ocurred. The actual type of event that
@@ -126,7 +188,7 @@ export class ChildrenQuery extends ResolverQuery<SafeResolverEvent[]> {
     };
   }
 
-  formatResponse(response: SearchResponse<SafeResolverEvent>): SafeResolverEvent[] {
+  formatResponse(response: SearchResponse<ChildEvent>): ChildEvent[] {
     return this.getResults(response);
   }
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts
index e9174548898dd..f54472141c1de 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts
@@ -17,6 +17,7 @@ import {
 } from '../../../../../common/endpoint/types';
 import { createChild } from './node';
 import { ChildrenPaginationBuilder } from './children_pagination';
+import { ChildEvent } from '../queries/children';
 
 /**
  * This class helps construct the children structure when building a resolver tree.
@@ -86,15 +87,12 @@ export class ChildrenNodesHelper {
    * @param queriedNodes the entity_ids of the nodes that returned these start events
    * @param startEvents an array of start events returned by ES
    */
-  addStartEvents(
-    queriedNodes: Set<string>,
-    startEvents: SafeResolverEvent[]
-  ): Set<string> | undefined {
+  addStartEvents(queriedNodes: Set<string>, startEvents: ChildEvent[]): Set<string> | undefined {
     let largestAncestryArray = 0;
     const nodesToQueryNext: Map<number, Set<string>> = new Map();
     const nonLeafNodes: Set<SafeResolverChildNode> = new Set();
 
-    const isDistantGrandchild = (event: SafeResolverEvent) => {
+    const isDistantGrandchild = (event: ChildEvent) => {
       const ancestry = getAncestryAsArray(event);
       return ancestry.length > 0 && queriedNodes.has(ancestry[ancestry.length - 1]);
     };
@@ -161,7 +159,7 @@ export class ChildrenNodesHelper {
     return nodesToQueryNext.get(largestAncestryArray);
   }
 
-  private setPaginationForNodes(nodes: Set<string>, startEvents: SafeResolverEvent[]) {
+  private setPaginationForNodes(nodes: Set<string>, startEvents: ChildEvent[]) {
     for (const nodeEntityID of nodes.values()) {
       const cachedNode = this.entityToNodeCache.get(nodeEntityID);
       if (cachedNode) {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts
index 4cc8aaf42d12b..e202124554873 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts
@@ -4,10 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SafeResolverEvent } from '../../../../../common/endpoint/types';
 import { eventSequence, timestampSafeVersion } from '../../../../../common/endpoint/models/event';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
 import { urlEncodeCursor, SortFields, urlDecodeCursor } from './pagination';
+import { ChildEvent } from '../queries/children';
 
 /**
  * Pagination information for the children class.
@@ -65,7 +65,7 @@ export class ChildrenPaginationBuilder {
    *
    * @param results the events that were returned by the ES query
    */
-  static buildCursor(results: SafeResolverEvent[]): string | null {
+  static buildCursor(results: ChildEvent[]): string | null {
     const lastResult = results[results.length - 1];
     const sequence = eventSequence(lastResult);
     const cursor = {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts
index 327be8d3696fd..9f5f085d5b80d 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts
@@ -6,8 +6,7 @@
 
 import { SearchResponse } from 'elasticsearch';
 import { ILegacyScopedClusterClient } from 'kibana/server';
-import { SafeResolverEvent } from '../../../../../common/endpoint/types';
-import { ChildrenQuery } from '../queries/children';
+import { ChildEvent, ChildrenQuery } from '../queries/children';
 import { QueryInfo } from '../queries/multi_searcher';
 import { QueryHandler } from './fetch';
 import { ChildrenNodesHelper } from './children_helper';
@@ -46,7 +45,7 @@ export class ChildrenStartQueryHandler implements QueryHandler<ChildrenNodesHelp
     this.limitLeft = 0;
   }
 
-  private handleResponse = (response: SearchResponse<SafeResolverEvent>) => {
+  private handleResponse = (response: SearchResponse<ChildEvent>) => {
     const results = this.query.formatResponse(response);
     this.nodesToQuery = this.childrenHelper.addStartEvents(this.nodesToQuery, results) ?? new Set();
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/trusted_apps.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/trusted_apps.test.ts
index eeee2d99bf26d..35d0bf1116148 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/trusted_apps.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/trusted_apps.test.ts
@@ -144,7 +144,7 @@ describe('when invoking endpoint trusted apps route handlers', () => {
       os: 'windows',
       entries: [
         {
-          field: 'path',
+          field: 'process.path',
           type: 'match',
           operator: 'included',
           value: 'c:/programs files/Anti-Virus',
@@ -197,7 +197,7 @@ describe('when invoking endpoint trusted apps route handlers', () => {
         description: 'this one is ok',
         entries: [
           {
-            field: 'path',
+            field: 'process.path',
             operator: 'included',
             type: 'match',
             value: 'c:/programs files/Anti-Virus',
@@ -224,7 +224,7 @@ describe('when invoking endpoint trusted apps route handlers', () => {
             description: 'this one is ok',
             entries: [
               {
-                field: 'path',
+                field: 'process.path',
                 operator: 'included',
                 type: 'match',
                 value: 'c:/programs files/Anti-Virus',
diff --git a/x-pack/plugins/security_solution/server/endpoint/types.ts b/x-pack/plugins/security_solution/server/endpoint/types.ts
index 3c6630db8ebd8..2328c86f78a35 100644
--- a/x-pack/plugins/security_solution/server/endpoint/types.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/types.ts
@@ -4,8 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { LoggerFactory } from 'kibana/server';
+import { SearchResponse } from 'elasticsearch';
 import { ConfigType } from '../config';
 import { EndpointAppContextService } from './endpoint_app_context_services';
+import { JsonObject } from '../../../infra/common/typed_json';
+import {
+  HostMetadata,
+  HostMetadataDetails,
+  MetadataQueryStrategyVersions,
+} from '../../common/endpoint/types';
 
 /**
  * The context for Endpoint apps.
@@ -19,3 +26,29 @@ export interface EndpointAppContext {
    */
   service: EndpointAppContextService;
 }
+
+export interface HostListQueryResult {
+  resultLength: number;
+  resultList: HostMetadata[];
+  queryStrategyVersion: MetadataQueryStrategyVersions;
+}
+
+export interface HostQueryResult {
+  resultLength: number;
+  result: HostMetadata | undefined;
+  queryStrategyVersion: MetadataQueryStrategyVersions;
+}
+
+export interface MetadataQueryStrategy {
+  index: string;
+  elasticAgentIdProperty: string;
+  hostIdProperty: string;
+  sortProperty: JsonObject[];
+  extraBodyProperties?: JsonObject;
+  queryResponseToHostListResult: (
+    searchResponse: SearchResponse<HostMetadata | HostMetadataDetails>
+  ) => HostListQueryResult;
+  queryResponseToHostResult: (
+    searchResponse: SearchResponse<HostMetadata | HostMetadataDetails>
+  ) => HostQueryResult;
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.test.ts
index 81c9387c6f39c..a033c16cd5e99 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.test.ts
@@ -55,6 +55,18 @@ describe('import_rules_route', () => {
       expect(response.status).toEqual(200);
     });
 
+    test('returns 500 if more than 10,000 rules are imported', async () => {
+      const ruleIds = new Array(10001).fill(undefined).map((_, index) => `rule-${index}`);
+      const multiRequest = getImportRulesRequest(buildHapiStream(ruleIdsToNdJsonString(ruleIds)));
+      const response = await server.inject(multiRequest, context);
+
+      expect(response.status).toEqual(500);
+      expect(response.body).toEqual({
+        message: "Can't import more than 10000 rules",
+        status_code: 500,
+      });
+    });
+
     test('returns 404 if alertClient is not available on the route', async () => {
       context.alerting!.getAlertsClient = jest.fn();
       const response = await server.inject(request, context);
@@ -229,6 +241,19 @@ describe('import_rules_route', () => {
       });
     });
 
+    test('returns 200 if many rules are imported successfully', async () => {
+      const ruleIds = new Array(9999).fill(undefined).map((_, index) => `rule-${index}`);
+      const multiRequest = getImportRulesRequest(buildHapiStream(ruleIdsToNdJsonString(ruleIds)));
+      const response = await server.inject(multiRequest, context);
+
+      expect(response.status).toEqual(200);
+      expect(response.body).toEqual({
+        errors: [],
+        success: true,
+        success_count: 9999,
+      });
+    });
+
     test('returns 200 with errors if all rules are missing rule_ids and import fails on validation', async () => {
       const rulesWithoutRuleIds = ['rule-1', 'rule-2'].map((ruleId) =>
         getImportRulesWithIdSchemaMock(ruleId)
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
index 60bb8c79243d7..0f44b50d4bc74 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -6,13 +6,12 @@
 
 import { chunk } from 'lodash/fp';
 import { extname } from 'path';
+import { schema } from '@kbn/config-schema';
 
 import { validate } from '../../../../../common/validate';
 import {
   importRulesQuerySchema,
   ImportRulesQuerySchemaDecoded,
-  importRulesPayloadSchema,
-  ImportRulesPayloadSchemaDecoded,
   ImportRulesSchemaDecoded,
 } from '../../../../../common/detection_engine/schemas/request/import_rules_schema';
 import {
@@ -48,7 +47,7 @@ import { PartialFilter } from '../../types';
 
 type PromiseFromStreams = ImportRulesSchemaDecoded | Error;
 
-const CHUNK_PARSED_OBJECT_SIZE = 10;
+const CHUNK_PARSED_OBJECT_SIZE = 50;
 
 export const importRulesRoute = (router: IRouter, config: ConfigType, ml: SetupPlugins['ml']) => {
   router.post(
@@ -58,10 +57,7 @@ export const importRulesRoute = (router: IRouter, config: ConfigType, ml: SetupP
         query: buildRouteValidation<typeof importRulesQuerySchema, ImportRulesQuerySchemaDecoded>(
           importRulesQuerySchema
         ),
-        body: buildRouteValidation<
-          typeof importRulesPayloadSchema,
-          ImportRulesPayloadSchemaDecoded
-        >(importRulesPayloadSchema),
+        body: schema.any(), // validation on file object is accomplished later in the handler.
       },
       options: {
         tags: ['access:securitySolution'],
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
index 58dcd7f6bd1c1..0cf0c3880fc98 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
@@ -559,7 +559,7 @@ describe('searchAfterAndBulkCreate', () => {
     // I don't like testing log statements since logs change but this is the best
     // way I can think of to ensure this section is getting hit with this test case.
     expect(((mockLogger.debug as unknown) as jest.Mock).mock.calls[15][0]).toContain(
-      'sortIds was empty on filteredEvents'
+      'sortIds was empty on searchResult name: "fake name" id: "fake id" rule id: "fake rule id" signals index: "fakeindex"'
     );
   });
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
index e90e5996877f8..be1c44de593a4 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
@@ -3,8 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-/* eslint-disable complexity */
-
 import moment from 'moment';
 
 import { AlertServices } from '../../../../../alerts/server';
@@ -25,7 +23,7 @@ interface SearchAfterAndBulkCreateParams {
   previousStartedAt: Date | null | undefined;
   ruleParams: RuleTypeParams;
   services: AlertServices;
-  listClient: ListClient | undefined; // TODO: undefined is for temporary development, remove before merged
+  listClient: ListClient;
   exceptionsList: ExceptionListItemSchema[];
   logger: Logger;
   id: string;
@@ -91,7 +89,7 @@ export const searchAfterAndBulkCreate = async ({
   };
 
   // sortId tells us where to start our next consecutive search_after query
-  let sortId;
+  let sortId: string | undefined;
 
   // signalsCreatedCount keeps track of how many signals we have created,
   // to ensure we don't exceed maxSignals
@@ -155,7 +153,7 @@ export const searchAfterAndBulkCreate = async ({
         // yields zero hits, but there were hits using the previous
         // sortIds.
         // e.g. totalHits was 156, index 50 of 100 results, do another search-after
-        // this time with a new sortId, index 22 of the remainding 56, get another sortId
+        // this time with a new sortId, index 22 of the remaining 56, get another sortId
         // search with that sortId, total is still 156 but the hits.hits array is empty.
         if (totalHits === 0 || searchResult.hits.hits.length === 0) {
           logger.debug(
@@ -178,16 +176,13 @@ export const searchAfterAndBulkCreate = async ({
         // filter out the search results that match with the values found in the list.
         // the resulting set are signals to be indexed, given they are not duplicates
         // of signals already present in the signals index.
-        const filteredEvents: SignalSearchResponse =
-          listClient != null
-            ? await filterEventsAgainstList({
-                listClient,
-                exceptionsList,
-                logger,
-                eventSearchResult: searchResult,
-                buildRuleMessage,
-              })
-            : searchResult;
+        const filteredEvents: SignalSearchResponse = await filterEventsAgainstList({
+          listClient,
+          exceptionsList,
+          logger,
+          eventSearchResult: searchResult,
+          buildRuleMessage,
+        });
 
         // only bulk create if there are filteredEvents leftover
         // if there isn't anything after going through the value list filter
@@ -234,33 +229,18 @@ export const searchAfterAndBulkCreate = async ({
           logger.debug(
             buildRuleMessage(`filteredEvents.hits.hits: ${filteredEvents.hits.hits.length}`)
           );
+        }
 
-          if (
-            filteredEvents.hits.hits[0].sort != null &&
-            filteredEvents.hits.hits[0].sort.length !== 0
-          ) {
-            sortId = filteredEvents.hits.hits[0].sort
-              ? filteredEvents.hits.hits[0].sort[0]
-              : undefined;
-          } else {
-            logger.debug(buildRuleMessage('sortIds was empty on filteredEvents'));
-            toReturn.success = true;
-            break;
-          }
+        // we are guaranteed to have searchResult hits at this point
+        // because we check before if the totalHits or
+        // searchResult.hits.hits.length is 0
+        const lastSortId = searchResult.hits.hits[searchResult.hits.hits.length - 1].sort;
+        if (lastSortId != null && lastSortId.length !== 0) {
+          sortId = lastSortId[0];
         } else {
-          // we are guaranteed to have searchResult hits at this point
-          // because we check before if the totalHits or
-          // searchResult.hits.hits.length is 0
-          if (
-            searchResult.hits.hits[0].sort != null &&
-            searchResult.hits.hits[0].sort.length !== 0
-          ) {
-            sortId = searchResult.hits.hits[0].sort ? searchResult.hits.hits[0].sort[0] : undefined;
-          } else {
-            logger.debug(buildRuleMessage('sortIds was empty on searchResult'));
-            toReturn.success = true;
-            break;
-          }
+          logger.debug(buildRuleMessage('sortIds was empty on searchResult'));
+          toReturn.success = true;
+          break;
         }
       } catch (exc) {
         logger.error(buildRuleMessage(`[-] search_after and bulk threw an error ${exc}`));
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 2b6587300a581..d48b5b434c9c0 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -159,7 +159,7 @@ export const signalRulesAlertType = ({
         }
       }
       try {
-        const { listClient, exceptionsClient } = await getListsClient({
+        const { listClient, exceptionsClient } = getListsClient({
           services,
           updatedByUser,
           spaceId,
@@ -168,7 +168,7 @@ export const signalRulesAlertType = ({
         });
         const exceptionItems = await getExceptions({
           client: exceptionsClient,
-          lists: exceptionsList,
+          lists: exceptionsList ?? [],
         });
 
         if (isMlRule(type)) {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.test.ts
index d053a8e1089ad..9d22ba9dcc02b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.test.ts
@@ -558,7 +558,7 @@ describe('utils', () => {
     });
 
     test('it successfully returns list and exceptions list client', async () => {
-      const { listClient, exceptionsClient } = await getListsClient({
+      const { listClient, exceptionsClient } = getListsClient({
         services: alertServices,
         savedObjectClient: alertServices.savedObjectsClient,
         updatedByUser: 'some_user',
@@ -569,18 +569,6 @@ describe('utils', () => {
       expect(listClient).toBeDefined();
       expect(exceptionsClient).toBeDefined();
     });
-
-    test('it throws if "lists" is undefined', async () => {
-      await expect(() =>
-        getListsClient({
-          services: alertServices,
-          savedObjectClient: alertServices.savedObjectsClient,
-          updatedByUser: 'some_user',
-          spaceId: '',
-          lists: undefined,
-        })
-      ).rejects.toThrowError('lists plugin unavailable during rule execution');
-    });
   });
 
   describe('getSignalTimeTuples', () => {
@@ -743,24 +731,6 @@ describe('utils', () => {
       expect(exceptions).toEqual([getExceptionListItemSchemaMock()]);
     });
 
-    test('it throws if "client" is undefined', async () => {
-      await expect(() =>
-        getExceptions({
-          client: undefined,
-          lists: getListArrayMock(),
-        })
-      ).rejects.toThrowError('lists plugin unavailable during rule execution');
-    });
-
-    test('it returns empty array if "lists" is undefined', async () => {
-      const exceptions = await getExceptions({
-        client: listMock.getExceptionListClient(),
-        lists: undefined,
-      });
-
-      expect(exceptions).toEqual([]);
-    });
-
     test('it throws if "getExceptionListClient" fails', async () => {
       const err = new Error('error fetching list');
       listMock.getExceptionListClient = () =>
@@ -799,7 +769,7 @@ describe('utils', () => {
 
       const exceptions = await getExceptions({
         client: listMock.getExceptionListClient(),
-        lists: undefined,
+        lists: [],
       });
 
       expect(exceptions).toEqual([]);
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
index dc09c6d5386fc..4a6ea96e1854b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
@@ -11,7 +11,7 @@ import { Logger, SavedObjectsClientContract } from '../../../../../../../src/cor
 import { AlertServices, parseDuration } from '../../../../../alerts/server';
 import { ExceptionListClient, ListClient, ListPluginSetup } from '../../../../../lists/server';
 import { ExceptionListItemSchema } from '../../../../../lists/common/schemas';
-import { ListArrayOrUndefined } from '../../../../common/detection_engine/schemas/types/lists';
+import { ListArray } from '../../../../common/detection_engine/schemas/types/lists';
 import { BulkResponse, BulkResponseErrorAggregation, isValidUnit } from './types';
 import { BuildRuleMessage } from './rule_messages';
 import { parseScheduleDates } from '../../../../common/detection_engine/parse_schedule_dates';
@@ -118,7 +118,7 @@ export const getGapMaxCatchupRatio = ({
   };
 };
 
-export const getListsClient = async ({
+export const getListsClient = ({
   lists,
   spaceId,
   updatedByUser,
@@ -130,20 +130,16 @@ export const getListsClient = async ({
   updatedByUser: string | null;
   services: AlertServices;
   savedObjectClient: SavedObjectsClientContract;
-}): Promise<{
-  listClient: ListClient | undefined;
-  exceptionsClient: ExceptionListClient | undefined;
-}> => {
+}): {
+  listClient: ListClient;
+  exceptionsClient: ExceptionListClient;
+} => {
   if (lists == null) {
     throw new Error('lists plugin unavailable during rule execution');
   }
 
-  const listClient = await lists.getListClient(
-    services.callCluster,
-    spaceId,
-    updatedByUser ?? 'elastic'
-  );
-  const exceptionsClient = await lists.getExceptionListClient(
+  const listClient = lists.getListClient(services.callCluster, spaceId, updatedByUser ?? 'elastic');
+  const exceptionsClient = lists.getExceptionListClient(
     savedObjectClient,
     updatedByUser ?? 'elastic'
   );
@@ -155,14 +151,10 @@ export const getExceptions = async ({
   client,
   lists,
 }: {
-  client: ExceptionListClient | undefined;
-  lists: ListArrayOrUndefined;
+  client: ExceptionListClient;
+  lists: ListArray;
 }): Promise<ExceptionListItemSchema[] | undefined> => {
-  if (client == null) {
-    throw new Error('lists plugin unavailable during rule execution');
-  }
-
-  if (lists != null && lists.length > 0) {
+  if (lists.length > 0) {
     try {
       const listIds = lists.map(({ list_id: listId }) => listId);
       const namespaceTypes = lists.map(({ namespace_type: namespaceType }) => namespaceType);
diff --git a/x-pack/plugins/security_solution/server/lib/hosts/elasticsearch_adapter.test.ts b/x-pack/plugins/security_solution/server/lib/hosts/elasticsearch_adapter.test.ts
index 766fbd5dca031..6abff93d6cd5c 100644
--- a/x-pack/plugins/security_solution/server/lib/hosts/elasticsearch_adapter.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/hosts/elasticsearch_adapter.test.ts
@@ -30,7 +30,12 @@ import { HostAggEsItem } from './types';
 import { EndpointAppContext } from '../../endpoint/types';
 import { mockLogger } from '../detection_engine/signals/__mocks__/es_results';
 import { EndpointAppContextService } from '../../endpoint/endpoint_app_context_services';
-import { createMockEndpointAppContextServiceStartContract } from '../../endpoint/mocks';
+import {
+  createMockEndpointAppContextServiceStartContract,
+  createMockPackageService,
+} from '../../endpoint/mocks';
+import { PackageService } from '../../../../ingest_manager/server/services';
+import { ElasticsearchAssetType } from '../../../../ingest_manager/common/types/models';
 
 jest.mock('./query.hosts.dsl', () => {
   return {
@@ -49,7 +54,7 @@ jest.mock('./query.last_first_seen_host.dsl', () => {
     buildLastFirstSeenHostQuery: jest.fn(() => mockGetHostLastFirstSeenDsl),
   };
 });
-jest.mock('../../endpoint/routes/metadata', () => {
+jest.mock('../../endpoint/routes/metadata/handlers', () => {
   return {
     getHostData: jest.fn(() => mockEndpointMetadata),
   };
@@ -167,8 +172,16 @@ describe('hosts elasticsearch_adapter', () => {
 
   const endpointAppContextService = new EndpointAppContextService();
   const startContract = createMockEndpointAppContextServiceStartContract();
-  endpointAppContextService.start(startContract);
-
+  const mockPackageService: jest.Mocked<PackageService> = createMockPackageService();
+  mockPackageService.getInstalledEsAssetReferences.mockReturnValue(
+    Promise.resolve([
+      {
+        id: 'metrics-endpoint.metadata-current-default-0.16.0-dev.0',
+        type: ElasticsearchAssetType.transform,
+      },
+    ])
+  );
+  endpointAppContextService.start({ ...startContract, packageService: mockPackageService });
   const endpointContext: EndpointAppContext = {
     logFactory: mockLogger,
     service: endpointAppContextService,
diff --git a/x-pack/plugins/security_solution/server/lib/hosts/elasticsearch_adapter.ts b/x-pack/plugins/security_solution/server/lib/hosts/elasticsearch_adapter.ts
index 142d2a68faed0..ff2796e6852d0 100644
--- a/x-pack/plugins/security_solution/server/lib/hosts/elasticsearch_adapter.ts
+++ b/x-pack/plugins/security_solution/server/lib/hosts/elasticsearch_adapter.ts
@@ -8,11 +8,11 @@ import { set } from '@elastic/safer-lodash-set/fp';
 import { get, getOr, has, head } from 'lodash/fp';
 
 import {
+  EndpointFields,
   FirstLastSeenHost,
   HostItem,
   HostsData,
   HostsEdges,
-  EndpointFields,
 } from '../../graphql/types';
 import { inspectStringifyObject } from '../../utils/build_query';
 import { hostFieldsMap } from '../ecs_fields';
@@ -25,16 +25,16 @@ import {
   HostAggEsData,
   HostAggEsItem,
   HostBuckets,
-  HostOverviewRequestOptions,
   HostEsData,
   HostLastFirstSeenRequestOptions,
+  HostOverviewRequestOptions,
   HostsAdapter,
   HostsRequestOptions,
   HostValue,
 } from './types';
 import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../common/constants';
 import { EndpointAppContext } from '../../endpoint/types';
-import { getHostData } from '../../endpoint/routes/metadata';
+import { getHostData } from '../../endpoint/routes/metadata/handlers';
 
 export class ElasticsearchHostsAdapter implements HostsAdapter {
   constructor(
@@ -116,12 +116,12 @@ export class ElasticsearchHostsAdapter implements HostsAdapter {
         throw new Error('agentService not available');
       }
       const metadataRequestContext = {
-        agentService,
+        endpointAppContextService: this.endpointContext.service,
         logger,
         requestHandlerContext: request.context,
       };
       const endpointData =
-        hostId != null && metadataRequestContext.agentService != null
+        hostId != null && metadataRequestContext.endpointAppContextService.getAgentService() != null
           ? await getHostData(metadataRequestContext, hostId)
           : null;
       return endpointData != null && endpointData.metadata
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index d203c6dcc48c4..f0e7372a208fb 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -315,6 +315,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
 
     this.endpointAppContextService.start({
       agentService: plugins.ingestManager?.agentService,
+      packageService: plugins.ingestManager?.packageService,
       logger: this.logger,
       manifestManager,
       registerIngestCallback,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/helpers/to_array.ts b/x-pack/plugins/security_solution/server/search_strategy/helpers/to_array.ts
index 4da319d5b1e42..f7d9f408c5e2d 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/helpers/to_array.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/helpers/to_array.ts
@@ -5,4 +5,4 @@
  */
 
 export const toArray = <T = string>(value: T | T[] | null) =>
-  Array.isArray(value) ? value : value == null ? [] : [value];
+  Array.isArray(value) ? value : value == null ? [] : [`${value}`];
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/index.ts
index aacfc227a36ad..7967ef2af4132 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/index.ts
@@ -52,7 +52,7 @@ export const allHosts: SecuritySolutionFactory<HostsQueries.hosts> = {
       edges,
       totalCount,
       pageInfo: {
-        activePage: activePage ? activePage : 0,
+        activePage: activePage ?? 0,
         fakeTotalCount,
         showMorePagesIndicator,
       },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
index 93390c314a637..b257d9cfee418 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { isEmpty, isString } from 'lodash/fp';
+import { isEmpty } from 'lodash/fp';
 import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common';
 import {
   Direction,
@@ -24,7 +24,7 @@ export const buildHostsQuery = ({
   timerange: { from, to },
 }: HostsRequestOptions): ISearchRequestParams => {
   const filter = [
-    ...createQueryFilterClauses(isString(filterQuery) ? JSON.parse(filterQuery) : filterQuery),
+    ...createQueryFilterClauses(filterQuery),
     {
       range: {
         '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
index 65343dc721fd7..d1c63651997c7 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
@@ -3,12 +3,14 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
 import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/data/common';
+
 import {
   AuthenticationHit,
   Direction,
-  HostsQueries,
   HostAuthenticationsRequestOptions,
+  HostsQueries,
 } from '../../../../../../../common/search_strategy';
 
 export const mockOptions: HostAuthenticationsRequestOptions = {
@@ -2143,7 +2145,80 @@ export const formattedSearchStrategyResponse = {
   loaded: 21,
   inspect: {
     dsl: [
-      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "user_count": {\n        "cardinality": {\n          "field": "user.name"\n        }\n      },\n      "group_by_users": {\n        "terms": {\n          "size": 10,\n          "field": "user.name",\n          "order": [\n            {\n              "successes.doc_count": "desc"\n            },\n            {\n              "failures.doc_count": "desc"\n            }\n          ]\n        },\n        "aggs": {\n          "failures": {\n            "filter": {\n              "term": {\n                "event.outcome": "failure"\n              }\n            },\n            "aggs": {\n              "lastFailure": {\n                "top_hits": {\n                  "size": 1,\n                  "_source": [],\n                  "sort": [\n                    {\n                      "@timestamp": {\n                        "order": "desc"\n                      }\n                    }\n                  ]\n                }\n              }\n            }\n          },\n          "successes": {\n            "filter": {\n              "term": {\n                "event.outcome": "success"\n              }\n            },\n            "aggs": {\n              "lastSuccess": {\n                "top_hits": {\n                  "size": 1,\n                  "_source": [],\n                  "sort": [\n                    {\n                      "@timestamp": {\n                        "order": "desc"\n                      }\n                    }\n                  ]\n                }\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "term": {\n              "event.category": "authentication"\n            }\n          },\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-02T15:17:13.678Z",\n                "lte": "2020-09-03T15:17:13.678Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0\n  },\n  "track_total_hits": false\n}',
+      JSON.stringify(
+        {
+          allowNoIndices: true,
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              user_count: { cardinality: { field: 'user.name' } },
+              group_by_users: {
+                terms: {
+                  size: 10,
+                  field: 'user.name',
+                  order: [{ 'successes.doc_count': 'desc' }, { 'failures.doc_count': 'desc' }],
+                },
+                aggs: {
+                  failures: {
+                    filter: { term: { 'event.outcome': 'failure' } },
+                    aggs: {
+                      lastFailure: {
+                        top_hits: {
+                          size: 1,
+                          _source: [],
+                          sort: [{ '@timestamp': { order: 'desc' } }],
+                        },
+                      },
+                    },
+                  },
+                  successes: {
+                    filter: { term: { 'event.outcome': 'success' } },
+                    aggs: {
+                      lastSuccess: {
+                        top_hits: {
+                          size: 1,
+                          _source: [],
+                          sort: [{ '@timestamp': { order: 'desc' } }],
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
+                  { term: { 'event.category': 'authentication' } },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-02T15:17:13.678Z',
+                        lte: '2020-09-03T15:17:13.678Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            size: 0,
+          },
+          track_total_hits: false,
+        },
+        null,
+        2
+      ),
     ],
   },
   edges: [
@@ -2335,7 +2410,7 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
           { term: { 'event.category': 'authentication' } },
           {
             range: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx
index d5bdeac38cee5..a43f53880587a 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx
@@ -55,7 +55,7 @@ export const authentications: SecuritySolutionFactory<HostsQueries.authenticatio
       edges,
       totalCount,
       pageInfo: {
-        activePage: activePage ? activePage : 0,
+        activePage: activePage ?? 0,
         fakeTotalCount,
         showMorePagesIndicator,
       },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts
index c017f39842ba1..b1f9b04daa1c1 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts
@@ -3,10 +3,12 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
 import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/data/common';
+
 import {
-  HostsQueries,
   HostOverviewRequestOptions,
+  HostsQueries,
 } from '../../../../../../../common/search_strategy';
 
 export const mockOptions: HostOverviewRequestOptions = {
@@ -111,7 +113,197 @@ export const formattedSearchStrategyResponse = {
   loaded: 21,
   inspect: {
     dsl: [
-      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "auditd_count": {\n        "filter": {\n          "term": {\n            "event.module": "auditd"\n          }\n        }\n      },\n      "endgame_module": {\n        "filter": {\n          "bool": {\n            "should": [\n              {\n                "term": {\n                  "event.module": "endpoint"\n                }\n              },\n              {\n                "term": {\n                  "event.module": "endgame"\n                }\n              }\n            ]\n          }\n        },\n        "aggs": {\n          "dns_event_count": {\n            "filter": {\n              "bool": {\n                "should": [\n                  {\n                    "bool": {\n                      "filter": [\n                        {\n                          "term": {\n                            "network.protocol": "dns"\n                          }\n                        },\n                        {\n                          "term": {\n                            "event.category": "network"\n                          }\n                        }\n                      ]\n                    }\n                  },\n                  {\n                    "term": {\n                      "endgame.event_type_full": "dns_event"\n                    }\n                  }\n                ]\n              }\n            }\n          },\n          "file_event_count": {\n            "filter": {\n              "bool": {\n                "should": [\n                  {\n                    "term": {\n                      "event.category": "file"\n                    }\n                  },\n                  {\n                    "term": {\n                      "endgame.event_type_full": "file_event"\n                    }\n                  }\n                ]\n              }\n            }\n          },\n          "image_load_event_count": {\n            "filter": {\n              "bool": {\n                "should": [\n                  {\n                    "bool": {\n                      "should": [\n                        {\n                          "term": {\n                            "event.category": "library"\n                          }\n                        },\n                        {\n                          "term": {\n                            "event.category": "driver"\n                          }\n                        }\n                      ]\n                    }\n                  },\n                  {\n                    "term": {\n                      "endgame.event_type_full": "image_load_event"\n                    }\n                  }\n                ]\n              }\n            }\n          },\n          "network_event_count": {\n            "filter": {\n              "bool": {\n                "should": [\n                  {\n                    "bool": {\n                      "filter": [\n                        {\n                          "bool": {\n                            "must_not": {\n                              "term": {\n                                "network.protocol": "dns"\n                              }\n                            }\n                          }\n                        },\n                        {\n                          "term": {\n                            "event.category": "network"\n                          }\n                        }\n                      ]\n                    }\n                  },\n                  {\n                    "term": {\n                      "endgame.event_type_full": "network_event"\n                    }\n                  }\n                ]\n              }\n            }\n          },\n          "process_event_count": {\n            "filter": {\n              "bool": {\n                "should": [\n                  {\n                    "term": {\n                      "event.category": "process"\n                    }\n                  },\n                  {\n                    "term": {\n                      "endgame.event_type_full": "process_event"\n                    }\n                  }\n                ]\n              }\n            }\n          },\n          "registry_event": {\n            "filter": {\n              "bool": {\n                "should": [\n                  {\n                    "term": {\n                      "event.category": "registry"\n                    }\n                  },\n                  {\n                    "term": {\n                      "endgame.event_type_full": "registry_event"\n                    }\n                  }\n                ]\n              }\n            }\n          },\n          "security_event_count": {\n            "filter": {\n              "bool": {\n                "should": [\n                  {\n                    "bool": {\n                      "filter": [\n                        {\n                          "term": {\n                            "event.category": "session"\n                          }\n                        },\n                        {\n                          "term": {\n                            "event.category": "authentication"\n                          }\n                        }\n                      ]\n                    }\n                  },\n                  {\n                    "term": {\n                      "endgame.event_type_full": "security_event"\n                    }\n                  }\n                ]\n              }\n            }\n          }\n        }\n      },\n      "fim_count": {\n        "filter": {\n          "term": {\n            "event.module": "file_integrity"\n          }\n        }\n      },\n      "winlog_module": {\n        "filter": {\n          "term": {\n            "agent.type": "winlogbeat"\n          }\n        },\n        "aggs": {\n          "mwsysmon_operational_event_count": {\n            "filter": {\n              "term": {\n                "winlog.channel": "Microsoft-Windows-Sysmon/Operational"\n              }\n            }\n          },\n          "security_event_count": {\n            "filter": {\n              "term": {\n                "winlog.channel": "Security"\n              }\n            }\n          }\n        }\n      },\n      "system_module": {\n        "filter": {\n          "term": {\n            "event.module": "system"\n          }\n        },\n        "aggs": {\n          "login_count": {\n            "filter": {\n              "term": {\n                "event.dataset": "login"\n              }\n            }\n          },\n          "package_count": {\n            "filter": {\n              "term": {\n                "event.dataset": "package"\n              }\n            }\n          },\n          "process_count": {\n            "filter": {\n              "term": {\n                "event.dataset": "process"\n              }\n            }\n          },\n          "user_count": {\n            "filter": {\n              "term": {\n                "event.dataset": "user"\n              }\n            }\n          },\n          "filebeat_count": {\n            "filter": {\n              "term": {\n                "agent.type": "filebeat"\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}},{\\"bool\\":{\\"filter\\":[{\\"bool\\":{\\"should\\":[{\\"exists\\":{\\"field\\":\\"host.name\\"}}],\\"minimum_should_match\\":1}}]}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-07T09:47:28.606Z",\n                "lte": "2020-09-08T09:47:28.606Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": false\n  }\n}',
+      JSON.stringify(
+        {
+          allowNoIndices: true,
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              auditd_count: { filter: { term: { 'event.module': 'auditd' } } },
+              endgame_module: {
+                filter: {
+                  bool: {
+                    should: [
+                      { term: { 'event.module': 'endpoint' } },
+                      { term: { 'event.module': 'endgame' } },
+                    ],
+                  },
+                },
+                aggs: {
+                  dns_event_count: {
+                    filter: {
+                      bool: {
+                        should: [
+                          {
+                            bool: {
+                              filter: [
+                                { term: { 'network.protocol': 'dns' } },
+                                { term: { 'event.category': 'network' } },
+                              ],
+                            },
+                          },
+                          { term: { 'endgame.event_type_full': 'dns_event' } },
+                        ],
+                      },
+                    },
+                  },
+                  file_event_count: {
+                    filter: {
+                      bool: {
+                        should: [
+                          { term: { 'event.category': 'file' } },
+                          { term: { 'endgame.event_type_full': 'file_event' } },
+                        ],
+                      },
+                    },
+                  },
+                  image_load_event_count: {
+                    filter: {
+                      bool: {
+                        should: [
+                          {
+                            bool: {
+                              should: [
+                                { term: { 'event.category': 'library' } },
+                                { term: { 'event.category': 'driver' } },
+                              ],
+                            },
+                          },
+                          { term: { 'endgame.event_type_full': 'image_load_event' } },
+                        ],
+                      },
+                    },
+                  },
+                  network_event_count: {
+                    filter: {
+                      bool: {
+                        should: [
+                          {
+                            bool: {
+                              filter: [
+                                { bool: { must_not: { term: { 'network.protocol': 'dns' } } } },
+                                { term: { 'event.category': 'network' } },
+                              ],
+                            },
+                          },
+                          { term: { 'endgame.event_type_full': 'network_event' } },
+                        ],
+                      },
+                    },
+                  },
+                  process_event_count: {
+                    filter: {
+                      bool: {
+                        should: [
+                          { term: { 'event.category': 'process' } },
+                          { term: { 'endgame.event_type_full': 'process_event' } },
+                        ],
+                      },
+                    },
+                  },
+                  registry_event: {
+                    filter: {
+                      bool: {
+                        should: [
+                          { term: { 'event.category': 'registry' } },
+                          { term: { 'endgame.event_type_full': 'registry_event' } },
+                        ],
+                      },
+                    },
+                  },
+                  security_event_count: {
+                    filter: {
+                      bool: {
+                        should: [
+                          {
+                            bool: {
+                              filter: [
+                                { term: { 'event.category': 'session' } },
+                                { term: { 'event.category': 'authentication' } },
+                              ],
+                            },
+                          },
+                          { term: { 'endgame.event_type_full': 'security_event' } },
+                        ],
+                      },
+                    },
+                  },
+                },
+              },
+              fim_count: { filter: { term: { 'event.module': 'file_integrity' } } },
+              winlog_module: {
+                filter: { term: { 'agent.type': 'winlogbeat' } },
+                aggs: {
+                  mwsysmon_operational_event_count: {
+                    filter: { term: { 'winlog.channel': 'Microsoft-Windows-Sysmon/Operational' } },
+                  },
+                  security_event_count: { filter: { term: { 'winlog.channel': 'Security' } } },
+                },
+              },
+              system_module: {
+                filter: { term: { 'event.module': 'system' } },
+                aggs: {
+                  login_count: { filter: { term: { 'event.dataset': 'login' } } },
+                  package_count: { filter: { term: { 'event.dataset': 'package' } } },
+                  process_count: { filter: { term: { 'event.dataset': 'process' } } },
+                  user_count: { filter: { term: { 'event.dataset': 'user' } } },
+                  filebeat_count: { filter: { term: { 'agent.type': 'filebeat' } } },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  {
+                    bool: {
+                      must: [],
+                      filter: [
+                        { match_all: {} },
+                        {
+                          bool: {
+                            filter: [
+                              {
+                                bool: {
+                                  should: [{ exists: { field: 'host.name' } }],
+                                  minimum_should_match: 1,
+                                },
+                              },
+                            ],
+                          },
+                        },
+                      ],
+                      should: [],
+                      must_not: [],
+                    },
+                  },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-07T09:47:28.606Z',
+                        lte: '2020-09-08T09:47:28.606Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            size: 0,
+            track_total_hits: false,
+          },
+        },
+        null,
+        2
+      ),
     ],
   },
   overviewHost: {
@@ -283,7 +475,28 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"filter":[{"bool":{"should":[{"exists":{"field":"host.name"}}],"minimum_should_match":1}}]}}],"should":[],"must_not":[]}}',
+          {
+            bool: {
+              must: [],
+              filter: [
+                { match_all: {} },
+                {
+                  bool: {
+                    filter: [
+                      {
+                        bool: {
+                          should: [{ exists: { field: 'host.name' } }],
+                          minimum_should_match: 1,
+                        },
+                      },
+                    ],
+                  },
+                },
+              ],
+              should: [],
+              must_not: [],
+            },
+          },
           {
             range: {
               '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts
index 5f0e2af8ae921..1c0b44bdfc4f6 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SortField, HostsQueries } from '../../../../../../../common/search_strategy';
+import { HostsQueries, SortField } from '../../../../../../../common/search_strategy';
 
 export const mockOptions = {
   defaultIndex: [
@@ -4260,7 +4260,7 @@ export const formattedSearchStrategyResponse = {
           },
         ],
         user: {
-          id: [0],
+          id: ['0'],
           name: ['root'],
         },
       },
@@ -4284,7 +4284,7 @@ export const formattedSearchStrategyResponse = {
           },
         ],
         user: {
-          id: [0],
+          id: ['0'],
           name: ['root'],
         },
       },
@@ -4296,7 +4296,131 @@ export const formattedSearchStrategyResponse = {
   ],
   inspect: {
     dsl: [
-      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "process_count": {\n        "cardinality": {\n          "field": "process.name"\n        }\n      },\n      "group_by_process": {\n        "terms": {\n          "size": 10,\n          "field": "process.name",\n          "order": [\n            {\n              "host_count": "asc"\n            },\n            {\n              "_count": "asc"\n            },\n            {\n              "_key": "asc"\n            }\n          ]\n        },\n        "aggregations": {\n          "process": {\n            "top_hits": {\n              "size": 1,\n              "sort": [\n                {\n                  "@timestamp": {\n                    "order": "desc"\n                  }\n                }\n              ],\n              "_source": [\n                "process.args",\n                "process.name",\n                "user.id",\n                "user.name"\n              ]\n            }\n          },\n          "host_count": {\n            "cardinality": {\n              "field": "host.name"\n            }\n          },\n          "hosts": {\n            "terms": {\n              "field": "host.name"\n            },\n            "aggregations": {\n              "host": {\n                "top_hits": {\n                  "size": 1,\n                  "_source": []\n                }\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "should": [\n          {\n            "bool": {\n              "filter": [\n                {\n                  "term": {\n                    "agent.type": "auditbeat"\n                  }\n                },\n                {\n                  "term": {\n                    "event.module": "auditd"\n                  }\n                },\n                {\n                  "term": {\n                    "event.action": "executed"\n                  }\n                }\n              ]\n            }\n          },\n          {\n            "bool": {\n              "filter": [\n                {\n                  "term": {\n                    "agent.type": "auditbeat"\n                  }\n                },\n                {\n                  "term": {\n                    "event.module": "system"\n                  }\n                },\n                {\n                  "term": {\n                    "event.dataset": "process"\n                  }\n                },\n                {\n                  "term": {\n                    "event.action": "process_started"\n                  }\n                }\n              ]\n            }\n          },\n          {\n            "bool": {\n              "filter": [\n                {\n                  "term": {\n                    "agent.type": "winlogbeat"\n                  }\n                },\n                {\n                  "term": {\n                    "event.code": "4688"\n                  }\n                }\n              ]\n            }\n          },\n          {\n            "bool": {\n              "filter": [\n                {\n                  "term": {\n                    "winlog.event_id": 1\n                  }\n                },\n                {\n                  "term": {\n                    "winlog.channel": "Microsoft-Windows-Sysmon/Operational"\n                  }\n                }\n              ]\n            }\n          },\n          {\n            "bool": {\n              "filter": [\n                {\n                  "term": {\n                    "event.type": "process_start"\n                  }\n                },\n                {\n                  "term": {\n                    "event.category": "process"\n                  }\n                }\n              ]\n            }\n          },\n          {\n            "bool": {\n              "filter": [\n                {\n                  "term": {\n                    "event.category": "process"\n                  }\n                },\n                {\n                  "term": {\n                    "event.type": "start"\n                  }\n                }\n              ]\n            }\n          }\n        ],\n        "minimum_should_match": 1,\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}},{\\"match_phrase\\":{\\"host.name\\":{\\"query\\":\\"siem-kibana\\"}}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-06T15:23:52.757Z",\n                "lte": "2020-09-07T15:23:52.757Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    }\n  },\n  "size": 0,\n  "track_total_hits": false\n}',
+      JSON.stringify(
+        {
+          allowNoIndices: true,
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              process_count: { cardinality: { field: 'process.name' } },
+              group_by_process: {
+                terms: {
+                  size: 10,
+                  field: 'process.name',
+                  order: [{ host_count: 'asc' }, { _count: 'asc' }, { _key: 'asc' }],
+                },
+                aggregations: {
+                  process: {
+                    top_hits: {
+                      size: 1,
+                      sort: [{ '@timestamp': { order: 'desc' } }],
+                      _source: ['process.args', 'process.name', 'user.id', 'user.name'],
+                    },
+                  },
+                  host_count: { cardinality: { field: 'host.name' } },
+                  hosts: {
+                    terms: { field: 'host.name' },
+                    aggregations: { host: { top_hits: { size: 1, _source: [] } } },
+                  },
+                },
+              },
+            },
+            query: {
+              bool: {
+                should: [
+                  {
+                    bool: {
+                      filter: [
+                        { term: { 'agent.type': 'auditbeat' } },
+                        { term: { 'event.module': 'auditd' } },
+                        { term: { 'event.action': 'executed' } },
+                      ],
+                    },
+                  },
+                  {
+                    bool: {
+                      filter: [
+                        { term: { 'agent.type': 'auditbeat' } },
+                        { term: { 'event.module': 'system' } },
+                        { term: { 'event.dataset': 'process' } },
+                        { term: { 'event.action': 'process_started' } },
+                      ],
+                    },
+                  },
+                  {
+                    bool: {
+                      filter: [
+                        { term: { 'agent.type': 'winlogbeat' } },
+                        { term: { 'event.code': '4688' } },
+                      ],
+                    },
+                  },
+                  {
+                    bool: {
+                      filter: [
+                        { term: { 'winlog.event_id': 1 } },
+                        { term: { 'winlog.channel': 'Microsoft-Windows-Sysmon/Operational' } },
+                      ],
+                    },
+                  },
+                  {
+                    bool: {
+                      filter: [
+                        { term: { 'event.type': 'process_start' } },
+                        { term: { 'event.category': 'process' } },
+                      ],
+                    },
+                  },
+                  {
+                    bool: {
+                      filter: [
+                        { term: { 'event.category': 'process' } },
+                        { term: { 'event.type': 'start' } },
+                      ],
+                    },
+                  },
+                ],
+                minimum_should_match: 1,
+                filter: [
+                  {
+                    bool: {
+                      must: [],
+                      filter: [
+                        { match_all: {} },
+                        { match_phrase: { 'host.name': { query: 'siem-kibana' } } },
+                      ],
+                      should: [],
+                      must_not: [],
+                    },
+                  },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-06T15:23:52.757Z',
+                        lte: '2020-09-07T15:23:52.757Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+          },
+          size: 0,
+          track_total_hits: false,
+        },
+        null,
+        2
+      ),
     ],
   },
   pageInfo: {
@@ -4401,7 +4525,17 @@ export const expectedDsl = {
         ],
         minimum_should_match: 1,
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}},{"match_phrase":{"host.name":{"query":"siem-kibana"}}}],"should":[],"must_not":[]}}',
+          {
+            bool: {
+              must: [],
+              filter: [
+                { match_all: {} },
+                { match_phrase: { 'host.name': { query: 'siem-kibana' } } },
+              ],
+              should: [],
+              must_not: [],
+            },
+          },
           {
             range: {
               '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts
index fcc76eebe4cf5..5682e63b50ed0 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts
@@ -58,7 +58,7 @@ export const uncommonProcesses: SecuritySolutionFactory<HostsQueries.uncommonPro
       edges,
       inspect,
       pageInfo: {
-        activePage: activePage ? activePage : 0,
+        activePage: activePage ?? 0,
         fakeTotalCount,
         showMorePagesIndicator,
       },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
index 73cf74087aad6..c1c4db53ba4e3 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
@@ -28,7 +28,96 @@ export const formattedAlertsSearchStrategyResponse: MatrixHistogramStrategyRespo
   ...mockAlertsSearchStrategyResponse,
   inspect: {
     dsl: [
-      '{\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "allowNoIndices": true,\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "alertsGroup": {\n        "terms": {\n          "field": "event.module",\n          "missing": "All others",\n          "order": {\n            "_count": "desc"\n          },\n          "size": 10\n        },\n        "aggs": {\n          "alerts": {\n            "date_histogram": {\n              "field": "@timestamp",\n              "fixed_interval": "2700000ms",\n              "min_doc_count": 0,\n              "extended_bounds": {\n                "min": 1599574984482,\n                "max": 1599661384482\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}},{\\"bool\\":{\\"filter\\":[{\\"bool\\":{\\"should\\":[{\\"exists\\":{\\"field\\":\\"host.name\\"}}],\\"minimum_should_match\\":1}}]}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "bool": {\n              "filter": [\n                {\n                  "bool": {\n                    "should": [\n                      {\n                        "match": {\n                          "event.kind": "alert"\n                        }\n                      }\n                    ],\n                    "minimum_should_match": 1\n                  }\n                }\n              ]\n            }\n          },\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-08T14:23:04.482Z",\n                "lte": "2020-09-09T14:23:04.482Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": true\n  }\n}',
+      JSON.stringify(
+        {
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          allowNoIndices: true,
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              alertsGroup: {
+                terms: {
+                  field: 'event.module',
+                  missing: 'All others',
+                  order: { _count: 'desc' },
+                  size: 10,
+                },
+                aggs: {
+                  alerts: {
+                    date_histogram: {
+                      field: '@timestamp',
+                      fixed_interval: '2700000ms',
+                      min_doc_count: 0,
+                      extended_bounds: { min: 1599574984482, max: 1599661384482 },
+                    },
+                  },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  {
+                    bool: {
+                      must: [],
+                      filter: [
+                        { match_all: {} },
+                        {
+                          bool: {
+                            filter: [
+                              {
+                                bool: {
+                                  should: [{ exists: { field: 'host.name' } }],
+                                  minimum_should_match: 1,
+                                },
+                              },
+                            ],
+                          },
+                        },
+                      ],
+                      should: [],
+                      must_not: [],
+                    },
+                  },
+                  {
+                    bool: {
+                      filter: [
+                        {
+                          bool: {
+                            should: [{ match: { 'event.kind': 'alert' } }],
+                            minimum_should_match: 1,
+                          },
+                        },
+                      ],
+                    },
+                  },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-08T14:23:04.482Z',
+                        lte: '2020-09-09T14:23:04.482Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            size: 0,
+            track_total_hits: true,
+          },
+        },
+        null,
+        2
+      ),
     ],
   },
   matrixHistogramData: [],
@@ -105,7 +194,75 @@ export const formattedAnomaliesSearchStrategyResponse: MatrixHistogramStrategyRe
   ...mockAnomaliesSearchStrategyResponse,
   inspect: {
     dsl: [
-      '{\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "allowNoIndices": true,\n  "ignoreUnavailable": true,\n  "body": {\n    "aggs": {\n      "anomalyActionGroup": {\n        "terms": {\n          "field": "job_id",\n          "order": {\n            "_count": "desc"\n          },\n          "size": 10\n        },\n        "aggs": {\n          "anomalies": {\n            "date_histogram": {\n              "field": "timestamp",\n              "fixed_interval": "2700000ms",\n              "min_doc_count": 0,\n              "extended_bounds": {\n                "min": 1599578075566,\n                "max": 1599664475566\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}},{\\"bool\\":{\\"should\\":[],\\"minimum_should_match\\":1}},{\\"match_phrase\\":{\\"result_type\\":\\"record\\"}},null,{\\"range\\":{\\"record_score\\":{\\"gte\\":50}}}],\\"should\\":[{\\"exists\\":{\\"field\\":\\"source.ip\\"}},{\\"exists\\":{\\"field\\":\\"destination.ip\\"}}],\\"must_not\\":[],\\"minimum_should_match\\":1}}",\n          {\n            "range": {\n              "timestamp": {\n                "gte": "2020-09-08T15:14:35.566Z",\n                "lte": "2020-09-09T15:14:35.566Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": true\n  }\n}',
+      JSON.stringify(
+        {
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          allowNoIndices: true,
+          ignoreUnavailable: true,
+          body: {
+            aggs: {
+              anomalyActionGroup: {
+                terms: { field: 'job_id', order: { _count: 'desc' }, size: 10 },
+                aggs: {
+                  anomalies: {
+                    date_histogram: {
+                      field: 'timestamp',
+                      fixed_interval: '2700000ms',
+                      min_doc_count: 0,
+                      extended_bounds: { min: 1599578075566, max: 1599664475566 },
+                    },
+                  },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  {
+                    bool: {
+                      must: [],
+                      filter: [
+                        { match_all: {} },
+                        { bool: { should: [], minimum_should_match: 1 } },
+                        { match_phrase: { result_type: 'record' } },
+                        null,
+                        { range: { record_score: { gte: 50 } } },
+                      ],
+                      should: [
+                        { exists: { field: 'source.ip' } },
+                        { exists: { field: 'destination.ip' } },
+                      ],
+                      must_not: [],
+                      minimum_should_match: 1,
+                    },
+                  },
+                  {
+                    range: {
+                      timestamp: {
+                        gte: '2020-09-08T15:14:35.566Z',
+                        lte: '2020-09-09T15:14:35.566Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            size: 0,
+            track_total_hits: true,
+          },
+        },
+        null,
+        2
+      ),
     ],
   },
   matrixHistogramData: [],
@@ -219,7 +376,64 @@ export const formattedAuthenticationsSearchStrategyResponse: MatrixHistogramStra
   ...mockAuthenticationsSearchStrategyResponse,
   inspect: {
     dsl: [
-      '{\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "allowNoIndices": true,\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "eventActionGroup": {\n        "terms": {\n          "field": "event.outcome",\n          "include": [\n            "success",\n            "failure"\n          ],\n          "order": {\n            "_count": "desc"\n          },\n          "size": 2\n        },\n        "aggs": {\n          "events": {\n            "date_histogram": {\n              "field": "@timestamp",\n              "fixed_interval": "2700000ms",\n              "min_doc_count": 0,\n              "extended_bounds": {\n                "min": 1599578520325,\n                "max": 1599664920325\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "bool": {\n              "must": [\n                {\n                  "term": {\n                    "event.category": "authentication"\n                  }\n                }\n              ]\n            }\n          },\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-08T15:22:00.325Z",\n                "lte": "2020-09-09T15:22:00.325Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": true\n  }\n}',
+      JSON.stringify(
+        {
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          allowNoIndices: true,
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              eventActionGroup: {
+                terms: {
+                  field: 'event.outcome',
+                  include: ['success', 'failure'],
+                  order: { _count: 'desc' },
+                  size: 2,
+                },
+                aggs: {
+                  events: {
+                    date_histogram: {
+                      field: '@timestamp',
+                      fixed_interval: '2700000ms',
+                      min_doc_count: 0,
+                      extended_bounds: { min: 1599578520325, max: 1599664920325 },
+                    },
+                  },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
+                  { bool: { must: [{ term: { 'event.category': 'authentication' } }] } },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-08T15:22:00.325Z',
+                        lte: '2020-09-09T15:22:00.325Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            size: 0,
+            track_total_hits: true,
+          },
+        },
+        null,
+        2
+      ),
     ],
   },
   matrixHistogramData: [
@@ -728,7 +942,63 @@ export const formattedEventsSearchStrategyResponse: MatrixHistogramStrategyRespo
   ...mockEventsSearchStrategyResponse,
   inspect: {
     dsl: [
-      '{\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "allowNoIndices": true,\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "eventActionGroup": {\n        "terms": {\n          "field": "event.action",\n          "missing": "All others",\n          "order": {\n            "_count": "desc"\n          },\n          "size": 10\n        },\n        "aggs": {\n          "events": {\n            "date_histogram": {\n              "field": "@timestamp",\n              "fixed_interval": "2700000ms",\n              "min_doc_count": 0,\n              "extended_bounds": {\n                "min": 1599581486215,\n                "max": 1599667886215\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-08T16:11:26.215Z",\n                "lte": "2020-09-09T16:11:26.215Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": true\n  }\n}',
+      JSON.stringify(
+        {
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          allowNoIndices: true,
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              eventActionGroup: {
+                terms: {
+                  field: 'event.action',
+                  missing: 'All others',
+                  order: { _count: 'desc' },
+                  size: 10,
+                },
+                aggs: {
+                  events: {
+                    date_histogram: {
+                      field: '@timestamp',
+                      fixed_interval: '2700000ms',
+                      min_doc_count: 0,
+                      extended_bounds: { min: 1599581486215, max: 1599667886215 },
+                    },
+                  },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-08T16:11:26.215Z',
+                        lte: '2020-09-09T16:11:26.215Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            size: 0,
+            track_total_hits: true,
+          },
+        },
+        null,
+        2
+      ),
     ],
   },
   totalCount: 0,
@@ -1294,7 +1564,58 @@ export const formattedDnsSearchStrategyResponse: MatrixHistogramStrategyResponse
   ...mockDnsSearchStrategyResponse,
   inspect: {
     dsl: [
-      '{\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "allowNoIndices": true,\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "NetworkDns": {\n        "date_histogram": {\n          "field": "@timestamp",\n          "fixed_interval": "2700000ms"\n        },\n        "aggs": {\n          "dns": {\n            "terms": {\n              "field": "dns.question.registered_domain",\n              "order": {\n                "orderAgg": "desc"\n              },\n              "size": 10\n            },\n            "aggs": {\n              "orderAgg": {\n                "cardinality": {\n                  "field": "dns.question.name"\n                }\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-08T15:41:15.528Z",\n                "lte": "2020-09-09T15:41:15.529Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": true\n  }\n}',
+      JSON.stringify(
+        {
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          allowNoIndices: true,
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              NetworkDns: {
+                date_histogram: { field: '@timestamp', fixed_interval: '2700000ms' },
+                aggs: {
+                  dns: {
+                    terms: {
+                      field: 'dns.question.registered_domain',
+                      order: { orderAgg: 'desc' },
+                      size: 10,
+                    },
+                    aggs: { orderAgg: { cardinality: { field: 'dns.question.name' } } },
+                  },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-08T15:41:15.528Z',
+                        lte: '2020-09-09T15:41:15.529Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            size: 0,
+            track_total_hits: true,
+          },
+        },
+        null,
+        2
+      ),
     ],
   },
   matrixHistogramData: [
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
index 8b2e666ad0103..df304552f9fc2 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
@@ -59,7 +59,28 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"filter":[{"bool":{"should":[{"exists":{"field":"host.name"}}],"minimum_should_match":1}}]}}],"should":[],"must_not":[]}}',
+          {
+            bool: {
+              must: [],
+              filter: [
+                { match_all: {} },
+                {
+                  bool: {
+                    filter: [
+                      {
+                        bool: {
+                          should: [{ exists: { field: 'host.name' } }],
+                          minimum_should_match: 1,
+                        },
+                      },
+                    ],
+                  },
+                },
+              ],
+              should: [],
+              must_not: [],
+            },
+          },
           {
             bool: {
               filter: [
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
index 6ca3c785e2e75..de0fcd8e22207 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
@@ -54,7 +54,21 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"should":[],"minimum_should_match":1}},{"match_phrase":{"result_type":"record"}},null,{"range":{"record_score":{"gte":50}}}],"should":[{"exists":{"field":"source.ip"}},{"exists":{"field":"destination.ip"}}],"must_not":[],"minimum_should_match":1}}',
+          {
+            bool: {
+              must: [],
+              filter: [
+                { match_all: {} },
+                { bool: { should: [], minimum_should_match: 1 } },
+                { match_phrase: { result_type: 'record' } },
+                null,
+                { range: { record_score: { gte: 50 } } },
+              ],
+              should: [{ exists: { field: 'source.ip' } }, { exists: { field: 'destination.ip' } }],
+              must_not: [],
+              minimum_should_match: 1,
+            },
+          },
           {
             range: {
               timestamp: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
index 1fd420dbb94cb..136c9964717c3 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
@@ -58,7 +58,7 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
           { bool: { must: [{ term: { 'event.category': 'authentication' } }] } },
           {
             range: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
index 94ba20327a404..3a769127bbe85 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
@@ -53,7 +53,7 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
           {
             range: {
               '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
index 09b710ab33c76..61f672203e45f 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
@@ -63,7 +63,7 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
           {
             range: {
               '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts
index f0605c5523fd9..d3625a96c6db9 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts
@@ -127,7 +127,59 @@ export const formattedSearchStrategyResponse = {
   ],
   inspect: {
     dsl: [
-      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "dns_count": {\n        "cardinality": {\n          "field": "dns.question.registered_domain"\n        }\n      },\n      "dns_name_query_count": {\n        "terms": {\n          "field": "dns.question.registered_domain",\n          "size": 10,\n          "order": {\n            "unique_domains": "desc"\n          }\n        },\n        "aggs": {\n          "unique_domains": {\n            "cardinality": {\n              "field": "dns.question.name"\n            }\n          },\n          "dns_bytes_in": {\n            "sum": {\n              "field": "source.bytes"\n            }\n          },\n          "dns_bytes_out": {\n            "sum": {\n              "field": "destination.bytes"\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-13T09:00:43.249Z",\n                "lte": "2020-09-14T09:00:43.249Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ],\n        "must_not": [\n          {\n            "term": {\n              "dns.question.type": {\n                "value": "PTR"\n              }\n            }\n          }\n        ]\n      }\n    }\n  },\n  "size": 0,\n  "track_total_hits": false\n}',
+      JSON.stringify(
+        {
+          allowNoIndices: true,
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              dns_count: { cardinality: { field: 'dns.question.registered_domain' } },
+              dns_name_query_count: {
+                terms: {
+                  field: 'dns.question.registered_domain',
+                  size: 10,
+                  order: { unique_domains: 'desc' },
+                },
+                aggs: {
+                  unique_domains: { cardinality: { field: 'dns.question.name' } },
+                  dns_bytes_in: { sum: { field: 'source.bytes' } },
+                  dns_bytes_out: { sum: { field: 'destination.bytes' } },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-13T09:00:43.249Z',
+                        lte: '2020-09-14T09:00:43.249Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+                must_not: [{ term: { 'dns.question.type': { value: 'PTR' } } }],
+              },
+            },
+          },
+          size: 0,
+          track_total_hits: false,
+        },
+        null,
+        2
+      ),
     ],
   },
   pageInfo: { activePage: 0, fakeTotalCount: 2, showMorePagesIndicator: false },
@@ -165,7 +217,7 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
           {
             range: {
               '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/index.ts
index 8e734ca9d1179..ca7743126df4c 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/index.ts
@@ -48,7 +48,7 @@ export const networkDns: SecuritySolutionFactory<NetworkQueries.dns> = {
       edges,
       inspect,
       pageInfo: {
-        activePage: activePage ? activePage : 0,
+        activePage: activePage ?? 0,
         fakeTotalCount,
         showMorePagesIndicator,
       },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
index 9991d267707b7..d105cb621cf46 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
@@ -615,7 +615,58 @@ export const formattedSearchStrategyResponse = {
   ],
   inspect: {
     dsl: [
-      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "http_count": {\n        "cardinality": {\n          "field": "url.path"\n        }\n      },\n      "url": {\n        "terms": {\n          "field": "url.path",\n          "size": 10,\n          "order": {\n            "_count": "desc"\n          }\n        },\n        "aggs": {\n          "methods": {\n            "terms": {\n              "field": "http.request.method",\n              "size": 4\n            }\n          },\n          "domains": {\n            "terms": {\n              "field": "url.domain",\n              "size": 4\n            }\n          },\n          "status": {\n            "terms": {\n              "field": "http.response.status_code",\n              "size": 4\n            }\n          },\n          "source": {\n            "top_hits": {\n              "size": 1,\n              "_source": {\n                "includes": [\n                  "host.name",\n                  "source.ip"\n                ]\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-13T09:00:43.249Z",\n                "lte": "2020-09-14T09:00:43.249Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          },\n          {\n            "exists": {\n              "field": "http.request.method"\n            }\n          }\n        ]\n      }\n    }\n  },\n  "size": 0,\n  "track_total_hits": false\n}',
+      JSON.stringify(
+        {
+          allowNoIndices: true,
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              http_count: { cardinality: { field: 'url.path' } },
+              url: {
+                terms: { field: 'url.path', size: 10, order: { _count: 'desc' } },
+                aggs: {
+                  methods: { terms: { field: 'http.request.method', size: 4 } },
+                  domains: { terms: { field: 'url.domain', size: 4 } },
+                  status: { terms: { field: 'http.response.status_code', size: 4 } },
+                  source: {
+                    top_hits: { size: 1, _source: { includes: ['host.name', 'source.ip'] } },
+                  },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-13T09:00:43.249Z',
+                        lte: '2020-09-14T09:00:43.249Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                  { exists: { field: 'http.request.method' } },
+                ],
+              },
+            },
+          },
+          size: 0,
+          track_total_hits: false,
+        },
+        null,
+        2
+      ),
     ],
   },
   pageInfo: { activePage: 0, fakeTotalCount: 50, showMorePagesIndicator: true },
@@ -650,7 +701,7 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
           {
             range: {
               '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/index.ts
index c0205ccce63cc..6ad4ac9cb8e33 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/index.ts
@@ -48,7 +48,7 @@ export const networkHttp: SecuritySolutionFactory<NetworkQueries.http> = {
       edges,
       inspect,
       pageInfo: {
-        activePage: activePage ? activePage : 0,
+        activePage: activePage ?? 0,
         fakeTotalCount,
         showMorePagesIndicator,
       },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts
index 8f34d31e49e1d..2c3eb37e25453 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts
@@ -97,7 +97,96 @@ export const formattedSearchStrategyResponse = {
   ...mockSearchStrategyResponse,
   inspect: {
     dsl: [
-      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "unique_flow_count": {\n        "filter": {\n          "term": {\n            "type": "flow"\n          }\n        }\n      },\n      "unique_dns_count": {\n        "filter": {\n          "term": {\n            "type": "dns"\n          }\n        }\n      },\n      "unique_suricata_count": {\n        "filter": {\n          "term": {\n            "service.type": "suricata"\n          }\n        }\n      },\n      "unique_zeek_count": {\n        "filter": {\n          "term": {\n            "service.type": "zeek"\n          }\n        }\n      },\n      "unique_socket_count": {\n        "filter": {\n          "term": {\n            "event.dataset": "socket"\n          }\n        }\n      },\n      "unique_filebeat_count": {\n        "filter": {\n          "term": {\n            "agent.type": "filebeat"\n          }\n        },\n        "aggs": {\n          "unique_netflow_count": {\n            "filter": {\n              "term": {\n                "input.type": "netflow"\n              }\n            }\n          },\n          "unique_panw_count": {\n            "filter": {\n              "term": {\n                "event.module": "panw"\n              }\n            }\n          },\n          "unique_cisco_count": {\n            "filter": {\n              "term": {\n                "event.module": "cisco"\n              }\n            }\n          }\n        }\n      },\n      "unique_packetbeat_count": {\n        "filter": {\n          "term": {\n            "agent.type": "packetbeat"\n          }\n        },\n        "aggs": {\n          "unique_tls_count": {\n            "filter": {\n              "term": {\n                "network.protocol": "tls"\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}},{\\"bool\\":{\\"filter\\":[{\\"bool\\":{\\"should\\":[{\\"bool\\":{\\"should\\":[{\\"exists\\":{\\"field\\":\\"source.ip\\"}}],\\"minimum_should_match\\":1}},{\\"bool\\":{\\"should\\":[{\\"exists\\":{\\"field\\":\\"destination.ip\\"}}],\\"minimum_should_match\\":1}}],\\"minimum_should_match\\":1}}]}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-13T12:54:24.685Z",\n                "lte": "2020-09-14T12:54:24.685Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": false\n  }\n}',
+      JSON.stringify(
+        {
+          allowNoIndices: true,
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              unique_flow_count: { filter: { term: { type: 'flow' } } },
+              unique_dns_count: { filter: { term: { type: 'dns' } } },
+              unique_suricata_count: { filter: { term: { 'service.type': 'suricata' } } },
+              unique_zeek_count: { filter: { term: { 'service.type': 'zeek' } } },
+              unique_socket_count: { filter: { term: { 'event.dataset': 'socket' } } },
+              unique_filebeat_count: {
+                filter: { term: { 'agent.type': 'filebeat' } },
+                aggs: {
+                  unique_netflow_count: { filter: { term: { 'input.type': 'netflow' } } },
+                  unique_panw_count: { filter: { term: { 'event.module': 'panw' } } },
+                  unique_cisco_count: { filter: { term: { 'event.module': 'cisco' } } },
+                },
+              },
+              unique_packetbeat_count: {
+                filter: { term: { 'agent.type': 'packetbeat' } },
+                aggs: { unique_tls_count: { filter: { term: { 'network.protocol': 'tls' } } } },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  {
+                    bool: {
+                      must: [],
+                      filter: [
+                        { match_all: {} },
+                        {
+                          bool: {
+                            filter: [
+                              {
+                                bool: {
+                                  should: [
+                                    {
+                                      bool: {
+                                        should: [{ exists: { field: 'source.ip' } }],
+                                        minimum_should_match: 1,
+                                      },
+                                    },
+                                    {
+                                      bool: {
+                                        should: [{ exists: { field: 'destination.ip' } }],
+                                        minimum_should_match: 1,
+                                      },
+                                    },
+                                  ],
+                                  minimum_should_match: 1,
+                                },
+                              },
+                            ],
+                          },
+                        },
+                      ],
+                      should: [],
+                      must_not: [],
+                    },
+                  },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-13T12:54:24.685Z',
+                        lte: '2020-09-14T12:54:24.685Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            size: 0,
+            track_total_hits: false,
+          },
+        },
+        null,
+        2
+      ),
     ],
   },
   overviewNetwork: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts
index 15e2ac3cc0f69..50a263572edb8 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts
@@ -8,10 +8,10 @@ import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/dat
 
 import {
   Direction,
+  FlowTargetSourceDest,
+  NetworkQueries,
   NetworkTlsFields,
   NetworkTlsRequestOptions,
-  NetworkQueries,
-  FlowTargetSourceDest,
 } from '../../../../../../../common/search_strategy';
 
 export const mockOptions: NetworkTlsRequestOptions = {
@@ -55,7 +55,55 @@ export const formattedSearchStrategyResponse = {
   edges: [],
   inspect: {
     dsl: [
-      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggs": {\n      "count": {\n        "cardinality": {\n          "field": "tls.server.hash.sha1"\n        }\n      },\n      "sha1": {\n        "terms": {\n          "field": "tls.server.hash.sha1",\n          "size": 10,\n          "order": {\n            "_key": "desc"\n          }\n        },\n        "aggs": {\n          "issuers": {\n            "terms": {\n              "field": "tls.server.issuer"\n            }\n          },\n          "subjects": {\n            "terms": {\n              "field": "tls.server.subject"\n            }\n          },\n          "not_after": {\n            "terms": {\n              "field": "tls.server.not_after"\n            }\n          },\n          "ja3": {\n            "terms": {\n              "field": "tls.server.ja3s"\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-13T09:58:58.637Z",\n                "lte": "2020-09-14T09:58:58.637Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": false\n  }\n}',
+      JSON.stringify(
+        {
+          allowNoIndices: true,
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          ignoreUnavailable: true,
+          body: {
+            aggs: {
+              count: { cardinality: { field: 'tls.server.hash.sha1' } },
+              sha1: {
+                terms: { field: 'tls.server.hash.sha1', size: 10, order: { _key: 'desc' } },
+                aggs: {
+                  issuers: { terms: { field: 'tls.server.issuer' } },
+                  subjects: { terms: { field: 'tls.server.subject' } },
+                  not_after: { terms: { field: 'tls.server.not_after' } },
+                  ja3: { terms: { field: 'tls.server.ja3s' } },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-13T09:58:58.637Z',
+                        lte: '2020-09-14T09:58:58.637Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            size: 0,
+            track_total_hits: false,
+          },
+        },
+        null,
+        2
+      ),
     ],
   },
   pageInfo: { activePage: 0, fakeTotalCount: 0, showMorePagesIndicator: false },
@@ -90,7 +138,7 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
           {
             range: {
               '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/index.ts
index 46556f46d3a50..7ada299a513bb 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/index.ts
@@ -48,7 +48,7 @@ export const networkTls: SecuritySolutionFactory<NetworkQueries.tls> = {
       edges,
       inspect,
       pageInfo: {
-        activePage: activePage ? activePage : 0,
+        activePage: activePage ?? 0,
         fakeTotalCount,
         showMorePagesIndicator,
       },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts
index 0578d99accbf5..dfa2722b142ea 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts
@@ -8,9 +8,9 @@ import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/dat
 
 import {
   Direction,
-  NetworkTopCountriesRequestOptions,
-  NetworkQueries,
   FlowTargetSourceDest,
+  NetworkQueries,
+  NetworkTopCountriesRequestOptions,
   NetworkTopTablesFields,
 } from '../../../../../../../common/search_strategy';
 
@@ -54,7 +54,60 @@ export const formattedSearchStrategyResponse = {
   edges: [],
   inspect: {
     dsl: [
-      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "top_countries_count": {\n        "cardinality": {\n          "field": "destination.geo.country_iso_code"\n        }\n      },\n      "destination": {\n        "terms": {\n          "field": "destination.geo.country_iso_code",\n          "size": 10,\n          "order": {\n            "bytes_in": "desc"\n          }\n        },\n        "aggs": {\n          "bytes_in": {\n            "sum": {\n              "field": "source.bytes"\n            }\n          },\n          "bytes_out": {\n            "sum": {\n              "field": "destination.bytes"\n            }\n          },\n          "flows": {\n            "cardinality": {\n              "field": "network.community_id"\n            }\n          },\n          "source_ips": {\n            "cardinality": {\n              "field": "source.ip"\n            }\n          },\n          "destination_ips": {\n            "cardinality": {\n              "field": "destination.ip"\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-13T09:58:58.637Z",\n                "lte": "2020-09-14T09:58:58.637Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    }\n  },\n  "size": 0,\n  "track_total_hits": false\n}',
+      JSON.stringify(
+        {
+          allowNoIndices: true,
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              top_countries_count: { cardinality: { field: 'destination.geo.country_iso_code' } },
+              destination: {
+                terms: {
+                  field: 'destination.geo.country_iso_code',
+                  size: 10,
+                  order: { bytes_in: 'desc' },
+                },
+                aggs: {
+                  bytes_in: { sum: { field: 'source.bytes' } },
+                  bytes_out: { sum: { field: 'destination.bytes' } },
+                  flows: { cardinality: { field: 'network.community_id' } },
+                  source_ips: { cardinality: { field: 'source.ip' } },
+                  destination_ips: { cardinality: { field: 'destination.ip' } },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-13T09:58:58.637Z',
+                        lte: '2020-09-14T09:58:58.637Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+          },
+          size: 0,
+          track_total_hits: false,
+        },
+        null,
+        2
+      ),
     ],
   },
   pageInfo: { activePage: 0, fakeTotalCount: 0, showMorePagesIndicator: false },
@@ -90,7 +143,7 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
           {
             range: {
               '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/index.ts
index ba4565b068eb4..ad698046cc030 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/index.ts
@@ -51,7 +51,7 @@ export const networkTopCountries: SecuritySolutionFactory<NetworkQueries.topCoun
       edges,
       inspect,
       pageInfo: {
-        activePage: activePage ? activePage : 0,
+        activePage: activePage ?? 0,
         fakeTotalCount,
         showMorePagesIndicator,
       },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts
index 84c1ca129ecac..b1470b17eea5d 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts
@@ -8,10 +8,10 @@ import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/dat
 
 import {
   Direction,
-  NetworkTopNFlowRequestOptions,
+  FlowTargetSourceDest,
   NetworkQueries,
+  NetworkTopNFlowRequestOptions,
   NetworkTopTablesFields,
-  FlowTargetSourceDest,
 } from '../../../../../../../common/search_strategy';
 
 export const mockOptions: NetworkTopNFlowRequestOptions = {
@@ -781,7 +781,67 @@ export const formattedSearchStrategyResponse = {
   ],
   inspect: {
     dsl: [
-      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "top_n_flow_count": {\n        "cardinality": {\n          "field": "source.ip"\n        }\n      },\n      "source": {\n        "terms": {\n          "field": "source.ip",\n          "size": 10,\n          "order": {\n            "bytes_out": "desc"\n          }\n        },\n        "aggs": {\n          "bytes_in": {\n            "sum": {\n              "field": "destination.bytes"\n            }\n          },\n          "bytes_out": {\n            "sum": {\n              "field": "source.bytes"\n            }\n          },\n          "domain": {\n            "terms": {\n              "field": "source.domain",\n              "order": {\n                "timestamp": "desc"\n              }\n            },\n            "aggs": {\n              "timestamp": {\n                "max": {\n                  "field": "@timestamp"\n                }\n              }\n            }\n          },\n          "location": {\n            "filter": {\n              "exists": {\n                "field": "source.geo"\n              }\n            },\n            "aggs": {\n              "top_geo": {\n                "top_hits": {\n                  "_source": "source.geo.*",\n                  "size": 1\n                }\n              }\n            }\n          },\n          "autonomous_system": {\n            "filter": {\n              "exists": {\n                "field": "source.as"\n              }\n            },\n            "aggs": {\n              "top_as": {\n                "top_hits": {\n                  "_source": "source.as.*",\n                  "size": 1\n                }\n              }\n            }\n          },\n          "flows": {\n            "cardinality": {\n              "field": "network.community_id"\n            }\n          },\n          "destination_ips": {\n            "cardinality": {\n              "field": "destination.ip"\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-13T10:16:46.870Z",\n                "lte": "2020-09-14T10:16:46.870Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    }\n  },\n  "size": 0,\n  "track_total_hits": false\n}',
+      JSON.stringify(
+        {
+          allowNoIndices: true,
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          ignoreUnavailable: true,
+          body: {
+            aggregations: {
+              top_n_flow_count: { cardinality: { field: 'source.ip' } },
+              source: {
+                terms: { field: 'source.ip', size: 10, order: { bytes_out: 'desc' } },
+                aggs: {
+                  bytes_in: { sum: { field: 'destination.bytes' } },
+                  bytes_out: { sum: { field: 'source.bytes' } },
+                  domain: {
+                    terms: { field: 'source.domain', order: { timestamp: 'desc' } },
+                    aggs: { timestamp: { max: { field: '@timestamp' } } },
+                  },
+                  location: {
+                    filter: { exists: { field: 'source.geo' } },
+                    aggs: { top_geo: { top_hits: { _source: 'source.geo.*', size: 1 } } },
+                  },
+                  autonomous_system: {
+                    filter: { exists: { field: 'source.as' } },
+                    aggs: { top_as: { top_hits: { _source: 'source.as.*', size: 1 } } },
+                  },
+                  flows: { cardinality: { field: 'network.community_id' } },
+                  destination_ips: { cardinality: { field: 'destination.ip' } },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-13T10:16:46.870Z',
+                        lte: '2020-09-14T10:16:46.870Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+          },
+          size: 0,
+          track_total_hits: false,
+        },
+        null,
+        2
+      ),
     ],
   },
   pageInfo: { activePage: 0, fakeTotalCount: 50, showMorePagesIndicator: true },
@@ -828,7 +888,7 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
           {
             range: {
               '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/index.ts
index 198368d981800..60ae4069e8f9c 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/index.ts
@@ -48,7 +48,7 @@ export const networkTopNFlow: SecuritySolutionFactory<NetworkQueries.topNFlow> =
       edges,
       inspect,
       pageInfo: {
-        activePage: activePage ? activePage : 0,
+        activePage: activePage ?? 0,
         fakeTotalCount,
         showMorePagesIndicator,
       },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts
index 3f57de7c78d1a..d9591ca3640ab 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts
@@ -8,10 +8,10 @@ import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/dat
 
 import {
   Direction,
-  NetworkUsersRequestOptions,
+  FlowTarget,
   NetworkQueries,
   NetworkUsersFields,
-  FlowTarget,
+  NetworkUsersRequestOptions,
 } from '../../../../../../../common/search_strategy';
 
 export const mockOptions: NetworkUsersRequestOptions = {
@@ -115,7 +115,56 @@ export const formattedSearchStrategyResponse = {
   ],
   inspect: {
     dsl: [
-      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggs": {\n      "user_count": {\n        "cardinality": {\n          "field": "user.name"\n        }\n      },\n      "users": {\n        "terms": {\n          "field": "user.name",\n          "size": 10,\n          "order": {\n            "_key": "asc"\n          }\n        },\n        "aggs": {\n          "id": {\n            "terms": {\n              "field": "user.id"\n            }\n          },\n          "groupId": {\n            "terms": {\n              "field": "user.group.id"\n            }\n          },\n          "groupName": {\n            "terms": {\n              "field": "user.group.name"\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-13T10:16:46.870Z",\n                "lte": "2020-09-14T10:16:46.870Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          },\n          {\n            "term": {\n              "source.ip": "10.142.0.7"\n            }\n          }\n        ],\n        "must_not": [\n          {\n            "term": {\n              "event.category": "authentication"\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": false\n  }\n}',
+      JSON.stringify(
+        {
+          allowNoIndices: true,
+          index: [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ],
+          ignoreUnavailable: true,
+          body: {
+            aggs: {
+              user_count: { cardinality: { field: 'user.name' } },
+              users: {
+                terms: { field: 'user.name', size: 10, order: { _key: 'asc' } },
+                aggs: {
+                  id: { terms: { field: 'user.id' } },
+                  groupId: { terms: { field: 'user.group.id' } },
+                  groupName: { terms: { field: 'user.group.name' } },
+                },
+              },
+            },
+            query: {
+              bool: {
+                filter: [
+                  { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: '2020-09-13T10:16:46.870Z',
+                        lte: '2020-09-14T10:16:46.870Z',
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                  { term: { 'source.ip': '10.142.0.7' } },
+                ],
+                must_not: [{ term: { 'event.category': 'authentication' } }],
+              },
+            },
+            size: 0,
+            track_total_hits: false,
+          },
+        },
+        null,
+        2
+      ),
     ],
   },
   pageInfo: { activePage: 0, fakeTotalCount: 3, showMorePagesIndicator: false },
@@ -139,7 +188,7 @@ export const expectedDsl = {
     query: {
       bool: {
         filter: [
-          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [], filter: [{ match_all: {} }], should: [], must_not: [] } },
           {
             range: {
               '@timestamp': {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/index.ts
index f9b9a2fd2747f..a5ceb447f7bc0 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/index.ts
@@ -47,7 +47,7 @@ export const networkUsers: SecuritySolutionFactory<NetworkQueries.users> = {
       edges,
       inspect,
       pageInfo: {
-        activePage: activePage ? activePage : 0,
+        activePage: activePage ?? 0,
         fakeTotalCount,
         showMorePagesIndicator,
       },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/constants.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/constants.ts
new file mode 100644
index 0000000000000..924426e56361f
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/constants.ts
@@ -0,0 +1,219 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const TIMELINE_EVENTS_FIELDS = [
+  '@timestamp',
+  'signal.status',
+  'signal.original_time',
+  'signal.rule.filters',
+  'signal.rule.from',
+  'signal.rule.language',
+  'signal.rule.query',
+  'signal.rule.name',
+  'signal.rule.to',
+  'signal.rule.id',
+  'signal.rule.index',
+  'signal.rule.type',
+  'signal.original_event.kind',
+  'signal.original_event.module',
+  'file.path',
+  'file.Ext.code_signature.subject_name',
+  'file.Ext.code_signature.trusted',
+  'file.hash.sha256',
+  'host.os.family',
+  'event.code',
+  'signal.rule.version',
+  'signal.rule.severity',
+  'signal.rule.risk_score',
+  'event.module',
+  'event.action',
+  'event.category',
+  'host.name',
+  'user.name',
+  'source.ip',
+  'destination.ip',
+  'message',
+  'system.auth.ssh.signature',
+  'system.auth.ssh.method',
+  'system.audit.package.arch',
+  'system.audit.package.entity_id',
+  'system.audit.package.name',
+  'system.audit.package.size',
+  'system.audit.package.summary',
+  'system.audit.package.version',
+  'event.created',
+  'event.dataset',
+  'event.duration',
+  'event.end',
+  'event.hash',
+  'event.id',
+  'event.kind',
+  'event.original',
+  'event.outcome',
+  'event.risk_score',
+  'event.risk_score_norm',
+  'event.severity',
+  'event.start',
+  'event.timezone',
+  'event.type',
+  'agent.type',
+  'auditd.result',
+  'auditd.session',
+  'auditd.data.acct',
+  'auditd.data.terminal',
+  'auditd.data.op',
+  'auditd.summary.actor.primary',
+  'auditd.summary.actor.secondary',
+  'auditd.summary.object.primary',
+  'auditd.summary.object.secondary',
+  'auditd.summary.object.type',
+  'auditd.summary.how',
+  'auditd.summary.message_type',
+  'auditd.summary.sequence',
+  'file.name',
+  'file.target_path',
+  'file.extension',
+  'file.type',
+  'file.device',
+  'file.inode',
+  'file.uid',
+  'file.owner',
+  'file.gid',
+  'file.group',
+  'file.mode',
+  'file.size',
+  'file.mtime',
+  'file.ctime',
+  'host.id',
+  'host.ip',
+  'rule.reference',
+  'source.bytes',
+  'source.packets',
+  'source.port',
+  'source.geo.continent_name',
+  'source.geo.country_name',
+  'source.geo.country_iso_code',
+  'source.geo.city_name',
+  'source.geo.region_iso_code',
+  'source.geo.region_name',
+  'destination.bytes',
+  'destination.packets',
+  'destination.port',
+  'destination.geo.continent_name',
+  'destination.geo.country_name',
+  'destination.geo.country_iso_code',
+  'destination.geo.city_name',
+  'destination.geo.region_iso_code',
+  'destination.geo.region_name',
+  'dns.question.name',
+  'dns.question.type',
+  'dns.resolved_ip',
+  'dns.response_code',
+  'endgame.exit_code',
+  'endgame.file_name',
+  'endgame.file_path',
+  'endgame.logon_type',
+  'endgame.parent_process_name',
+  'endgame.pid',
+  'endgame.process_name',
+  'endgame.subject_domain_name',
+  'endgame.subject_logon_id',
+  'endgame.subject_user_name',
+  'endgame.target_domain_name',
+  'endgame.target_logon_id',
+  'endgame.target_user_name',
+  'signal.rule.saved_id',
+  'signal.rule.timeline_id',
+  'signal.rule.timeline_title',
+  'signal.rule.output_index',
+  'signal.rule.note',
+  'signal.rule.threshold',
+  'signal.rule.exceptions_list',
+  'suricata.eve.proto',
+  'suricata.eve.flow_id',
+  'suricata.eve.alert.signature',
+  'suricata.eve.alert.signature_id',
+  'network.bytes',
+  'network.community_id',
+  'network.direction',
+  'network.packets',
+  'network.protocol',
+  'network.transport',
+  'http.version',
+  'http.request.method',
+  'http.request.body.bytes',
+  'http.request.body.content',
+  'http.request.referrer',
+  'http.response.status_code',
+  'http.response.body.bytes',
+  'http.response.body.content',
+  'tls.client_certificate.fingerprint.sha1',
+  'tls.fingerprints.ja3.hash',
+  'tls.server_certificate.fingerprint.sha1',
+  'user.domain',
+  'winlog.event_id',
+  'process.hash.md5',
+  'process.hash.sha1',
+  'process.hash.sha256',
+  'process.pid',
+  'process.name',
+  'process.ppid',
+  'process.args',
+  'process.entity_id',
+  'process.executable',
+  'process.title',
+  'process.working_directory',
+  'zeek.session_id',
+  'zeek.connection.local_resp',
+  'zeek.connection.local_orig',
+  'zeek.connection.missed_bytes',
+  'zeek.connection.state',
+  'zeek.connection.history',
+  'zeek.notice.suppress_for',
+  'zeek.notice.msg',
+  'zeek.notice.note',
+  'zeek.notice.sub',
+  'zeek.notice.dst',
+  'zeek.notice.dropped',
+  'zeek.notice.peer_descr',
+  'zeek.dns.AA',
+  'zeek.dns.qclass_name',
+  'zeek.dns.RD',
+  'zeek.dns.qtype_name',
+  'zeek.dns.qtype',
+  'zeek.dns.query',
+  'zeek.dns.trans_id',
+  'zeek.dns.qclass',
+  'zeek.dns.RA',
+  'zeek.dns.TC',
+  'zeek.http.resp_mime_types',
+  'zeek.http.trans_depth',
+  'zeek.http.status_msg',
+  'zeek.http.resp_fuids',
+  'zeek.http.tags',
+  'zeek.files.session_ids',
+  'zeek.files.timedout',
+  'zeek.files.local_orig',
+  'zeek.files.tx_host',
+  'zeek.files.source',
+  'zeek.files.is_orig',
+  'zeek.files.overflow_bytes',
+  'zeek.files.sha1',
+  'zeek.files.duration',
+  'zeek.files.depth',
+  'zeek.files.analyzers',
+  'zeek.files.mime_type',
+  'zeek.files.rx_host',
+  'zeek.files.total_bytes',
+  'zeek.files.fuid',
+  'zeek.files.seen_bytes',
+  'zeek.files.missing_bytes',
+  'zeek.files.md5',
+  'zeek.ssl.cipher',
+  'zeek.ssl.established',
+  'zeek.ssl.resumed',
+  'zeek.ssl.version',
+];
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/helpers.ts
new file mode 100644
index 0000000000000..edff22766cc54
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/helpers.ts
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get, has, merge, uniq } from 'lodash/fp';
+import { EventHit, TimelineEdges } from '../../../../../../common/search_strategy';
+import { toArray } from '../../../../helpers/to_array';
+
+export const formatTimelineData = (
+  dataFields: readonly string[],
+  ecsFields: readonly string[],
+  hit: EventHit,
+  fieldMap: Readonly<Record<string, string>>
+) =>
+  uniq([...ecsFields, ...dataFields]).reduce<TimelineEdges>(
+    (flattenedFields, fieldName) => {
+      flattenedFields.node._id = hit._id;
+      flattenedFields.node._index = hit._index;
+      flattenedFields.node.ecs._id = hit._id;
+      flattenedFields.node.ecs._index = hit._index;
+      if (hit.sort && hit.sort.length > 1) {
+        flattenedFields.cursor.value = hit.sort[0];
+        flattenedFields.cursor.tiebreaker = hit.sort[1];
+      }
+      return mergeTimelineFieldsWithHit(
+        fieldName,
+        flattenedFields,
+        fieldMap,
+        hit,
+        dataFields,
+        ecsFields
+      );
+    },
+    {
+      node: { ecs: { _id: '' }, data: [], _id: '', _index: '' },
+      cursor: {
+        value: '',
+        tiebreaker: null,
+      },
+    }
+  );
+
+const specialFields = ['_id', '_index', '_type', '_score'];
+
+const mergeTimelineFieldsWithHit = <T>(
+  fieldName: string,
+  flattenedFields: T,
+  fieldMap: Readonly<Record<string, string>>,
+  hit: { _source: {} },
+  dataFields: readonly string[],
+  ecsFields: readonly string[]
+) => {
+  if (fieldMap[fieldName] != null || dataFields.includes(fieldName)) {
+    const esField = dataFields.includes(fieldName) ? fieldName : fieldMap[fieldName];
+    if (has(esField, hit._source) || specialFields.includes(esField)) {
+      const objectWithProperty = {
+        node: {
+          ...get('node', flattenedFields),
+          data: dataFields.includes(fieldName)
+            ? [
+                ...get('node.data', flattenedFields),
+                {
+                  field: fieldName,
+                  value: specialFields.includes(esField)
+                    ? toArray(get(esField, hit))
+                    : toArray(get(esField, hit._source)),
+                },
+              ]
+            : get('node.data', flattenedFields),
+          ecs: ecsFields.includes(fieldName)
+            ? {
+                ...get('node.ecs', flattenedFields),
+                // @ts-expect-error
+                ...fieldName.split('.').reduceRight(
+                  // @ts-expect-error
+                  (obj, next) => ({ [next]: obj }),
+                  toArray<string>(get(esField, hit._source))
+                ),
+              }
+            : get('node.ecs', flattenedFields),
+        },
+      };
+      return merge(flattenedFields, objectWithProperty);
+    } else {
+      return flattenedFields;
+    }
+  } else {
+    return flattenedFields;
+  }
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/index.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/index.ts
new file mode 100644
index 0000000000000..12729eb88a666
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/index.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { cloneDeep, getOr, uniq } from 'lodash/fp';
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  TimelineEventsQueries,
+  TimelineEventsAllStrategyResponse,
+  TimelineEventsAllRequestOptions,
+  TimelineEdges,
+} from '../../../../../../common/search_strategy/timeline';
+import { inspectStringifyObject, reduceFields } from '../../../../../utils/build_query';
+import { SecuritySolutionTimelineFactory } from '../../types';
+import { buildTimelineEventsAllQuery } from './query.events_all.dsl';
+import { eventFieldsMap } from '../../../../../lib/ecs_fields';
+import { TIMELINE_EVENTS_FIELDS } from './constants';
+import { formatTimelineData } from './helpers';
+
+export const timelineEventsAll: SecuritySolutionTimelineFactory<TimelineEventsQueries.all> = {
+  buildDsl: (options: TimelineEventsAllRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+    const { fieldRequested, ...queryOptions } = cloneDeep(options);
+    queryOptions.fields = uniq([
+      ...fieldRequested,
+      ...reduceFields(TIMELINE_EVENTS_FIELDS, eventFieldsMap),
+    ]);
+    return buildTimelineEventsAllQuery(queryOptions);
+  },
+  parse: async (
+    options: TimelineEventsAllRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<TimelineEventsAllStrategyResponse> => {
+    const { fieldRequested, ...queryOptions } = cloneDeep(options);
+    queryOptions.fields = uniq([
+      ...fieldRequested,
+      ...reduceFields(TIMELINE_EVENTS_FIELDS, eventFieldsMap),
+    ]);
+    const { activePage, querySize } = options.pagination;
+
+    const totalCount = getOr(0, 'hits.total.value', response.rawResponse);
+    const hits = response.rawResponse.hits.hits;
+    const edges: TimelineEdges[] = hits.map((hit) =>
+      // @ts-expect-error
+      formatTimelineData(options.fieldRequested, TIMELINE_EVENTS_FIELDS, hit, eventFieldsMap)
+    );
+    const inspect = {
+      dsl: [inspectStringifyObject(buildTimelineEventsAllQuery(queryOptions))],
+    };
+
+    return {
+      ...response,
+      inspect,
+      edges,
+      totalCount,
+      pageInfo: {
+        activePage: activePage ?? 0,
+        totalPages: Math.ceil(totalCount / querySize),
+      },
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts
new file mode 100644
index 0000000000000..261a27b0110e8
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { isEmpty } from 'lodash/fp';
+
+import {
+  SortField,
+  TimerangeFilter,
+  TimerangeInput,
+  TimelineEventsAllRequestOptions,
+} from '../../../../../../common/search_strategy';
+import { createQueryFilterClauses } from '../../../../../utils/build_query';
+import { TIMELINE_EVENTS_FIELDS } from './constants';
+
+export const buildTimelineEventsAllQuery = ({
+  defaultIndex,
+  docValueFields,
+  filterQuery,
+  pagination: { activePage, querySize },
+  sort,
+  timerange,
+}: Omit<TimelineEventsAllRequestOptions, 'fieldRequested'>) => {
+  const filterClause = [...createQueryFilterClauses(filterQuery)];
+
+  const getTimerangeFilter = (timerangeOption: TimerangeInput | undefined): TimerangeFilter[] => {
+    if (timerangeOption) {
+      const { to, from } = timerangeOption;
+      return [
+        {
+          range: {
+            '@timestamp': {
+              gte: from,
+              lte: to,
+              format: 'strict_date_optional_time',
+            },
+          },
+        },
+      ];
+    }
+    return [];
+  };
+
+  const filter = [...filterClause, ...getTimerangeFilter(timerange), { match_all: {} }];
+
+  const getSortField = (sortField: SortField) => {
+    if (sortField.field) {
+      const field: string = sortField.field === 'timestamp' ? '@timestamp' : sortField.field;
+
+      return [{ [field]: sortField.direction }];
+    }
+    return [];
+  };
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      ...(isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      from: activePage * querySize,
+      size: querySize,
+      track_total_hits: true,
+      sort: getSortField(sort),
+      _source: TIMELINE_EVENTS_FIELDS,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/helpers.ts
similarity index 81%
rename from x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/helpers.ts
rename to x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/helpers.ts
index b772dec773dce..3b0935db9a5d6 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/helpers.ts
@@ -6,8 +6,8 @@
 
 import { get, isEmpty, isNumber, isObject, isString } from 'lodash/fp';
 
-import { DetailItem } from '../../../../../common/search_strategy/timeline';
-import { baseCategoryFields } from '../../../../utils/beat_schema/8.0.0';
+import { TimelineEventsDetailsItem } from '../../../../../../common/search_strategy/timeline';
+import { baseCategoryFields } from '../../../../../utils/beat_schema/8.0.0';
 
 export const getFieldCategory = (field: string): string => {
   const fieldCategory = field.split('.')[0];
@@ -21,8 +21,8 @@ export const getDataFromHits = (
   sources: EventSource,
   category?: string,
   path?: string
-): DetailItem[] =>
-  Object.keys(sources).reduce<DetailItem[]>((accumulator, source) => {
+): TimelineEventsDetailsItem[] =>
+  Object.keys(sources).reduce<TimelineEventsDetailsItem[]>((accumulator, source) => {
     const item: EventSource = get(source, sources);
     if (Array.isArray(item) || isString(item) || isNumber(item)) {
       const field = path ? `${path}.${source}` : source;
@@ -43,7 +43,7 @@ export const getDataFromHits = (
               })
             : [item],
           originalValue: item,
-        } as DetailItem,
+        } as TimelineEventsDetailsItem,
       ];
     } else if (isObject(item)) {
       return [
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/index.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/index.ts
similarity index 58%
rename from x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/index.ts
rename to x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/index.ts
index e1fabe2b4d586..54e138c1e9d6f 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/index.ts
@@ -6,26 +6,26 @@
 
 import { getOr, merge } from 'lodash/fp';
 
-import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
 import {
-  TimelineQueries,
-  TimelineDetailsStrategyResponse,
-  TimelineDetailsRequestOptions,
-} from '../../../../../common/search_strategy/timeline';
-import { inspectStringifyObject } from '../../../../utils/build_query';
-import { SecuritySolutionTimelineFactory } from '../types';
-import { buildTimelineDetailsQuery } from './query.timeline_details.dsl';
+  TimelineEventsQueries,
+  TimelineEventsDetailsStrategyResponse,
+  TimelineEventsDetailsRequestOptions,
+} from '../../../../../../common/search_strategy/timeline';
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionTimelineFactory } from '../../types';
+import { buildTimelineDetailsQuery } from './query.events_details.dsl';
 import { getDataFromHits } from './helpers';
 
-export const timelineDetails: SecuritySolutionTimelineFactory<TimelineQueries.details> = {
-  buildDsl: (options: TimelineDetailsRequestOptions) => {
+export const timelineEventsDetails: SecuritySolutionTimelineFactory<TimelineEventsQueries.details> = {
+  buildDsl: (options: TimelineEventsDetailsRequestOptions) => {
     const { indexName, eventId, docValueFields = [] } = options;
     return buildTimelineDetailsQuery(indexName, eventId, docValueFields);
   },
   parse: async (
-    options: TimelineDetailsRequestOptions,
+    options: TimelineEventsDetailsRequestOptions,
     response: IEsSearchResponse<unknown>
-  ): Promise<TimelineDetailsStrategyResponse> => {
+  ): Promise<TimelineEventsDetailsStrategyResponse> => {
     const { indexName, eventId, docValueFields = [] } = options;
     const sourceData = getOr({}, 'hits.hits.0._source', response.rawResponse);
     const hitsData = getOr({}, 'hits.hits.0', response.rawResponse);
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/query.timeline_details.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts
similarity index 88%
rename from x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/query.timeline_details.dsl.ts
rename to x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts
index 4f003c1c27ef2..216e8f947d261 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/query.timeline_details.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { DocValueFields } from '../../../../../common/search_strategy';
+import { DocValueFields } from '../../../../../../common/search_strategy';
 
 export const buildTimelineDetailsQuery = (
   indexName: string,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/index.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/index.ts
new file mode 100644
index 0000000000000..a4e2c168a41d9
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/index.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  TimelineFactoryQueryTypes,
+  TimelineEventsQueries,
+} from '../../../../../common/search_strategy/timeline';
+
+import { SecuritySolutionTimelineFactory } from '../types';
+import { timelineEventsAll } from './all';
+import { timelineEventsDetails } from './details';
+import { timelineEventsLastEventTime } from './last_event_time';
+
+export const timelineEventsFactory: Record<
+  TimelineEventsQueries,
+  SecuritySolutionTimelineFactory<TimelineFactoryQueryTypes>
+> = {
+  [TimelineEventsQueries.all]: timelineEventsAll,
+  [TimelineEventsQueries.details]: timelineEventsDetails,
+  [TimelineEventsQueries.lastEventTime]: timelineEventsLastEventTime,
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/last_event_time/index.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/last_event_time/index.ts
new file mode 100644
index 0000000000000..97d7383fa831a
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/last_event_time/index.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  TimelineEventsQueries,
+  TimelineEventsLastEventTimeStrategyResponse,
+  TimelineEventsLastEventTimeRequestOptions,
+} from '../../../../../../common/search_strategy/timeline';
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionTimelineFactory } from '../../types';
+import { buildLastEventTimeQuery } from './query.events_last_event_time.dsl';
+
+export const timelineEventsLastEventTime: SecuritySolutionTimelineFactory<TimelineEventsQueries.lastEventTime> = {
+  buildDsl: (options: TimelineEventsLastEventTimeRequestOptions) =>
+    buildLastEventTimeQuery(options),
+  parse: async (
+    options: TimelineEventsLastEventTimeRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<TimelineEventsLastEventTimeStrategyResponse> => {
+    const inspect = {
+      dsl: [inspectStringifyObject(buildLastEventTimeQuery(options))],
+    };
+
+    return {
+      ...response,
+      lastSeen: getOr(null, 'aggregations.last_seen_event.value_as_string', response.rawResponse),
+      inspect,
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/last_event_time/query.events_last_event_time.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/last_event_time/query.events_last_event_time.dsl.ts
new file mode 100644
index 0000000000000..0f4eabf692919
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/last_event_time/query.events_last_event_time.dsl.ts
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { isEmpty } from 'lodash/fp';
+import {
+  TimelineEventsLastEventTimeRequestOptions,
+  LastEventIndexKey,
+} from '../../../../../../common/search_strategy';
+
+import { assertUnreachable } from '../../../../../../common/utility_types';
+
+interface EventIndices {
+  [key: string]: string[];
+}
+
+export const buildLastEventTimeQuery = ({
+  indexKey,
+  details,
+  defaultIndex,
+  docValueFields,
+}: TimelineEventsLastEventTimeRequestOptions) => {
+  const indicesToQuery: EventIndices = {
+    hosts: defaultIndex,
+    network: defaultIndex,
+  };
+  const getHostDetailsFilter = (hostName: string) => [{ term: { 'host.name': hostName } }];
+  const getIpDetailsFilter = (ip: string) => [
+    { term: { 'source.ip': ip } },
+    { term: { 'destination.ip': ip } },
+  ];
+  const getQuery = (eventIndexKey: LastEventIndexKey) => {
+    switch (eventIndexKey) {
+      case LastEventIndexKey.ipDetails:
+        if (details.ip) {
+          return {
+            allowNoIndices: true,
+            index: indicesToQuery.network,
+            ignoreUnavailable: true,
+            body: {
+              ...(isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
+              aggregations: {
+                last_seen_event: { max: { field: '@timestamp' } },
+              },
+              query: { bool: { should: getIpDetailsFilter(details.ip) } },
+              size: 0,
+              track_total_hits: false,
+            },
+          };
+        }
+        throw new Error('buildLastEventTimeQuery - no IP argument provided');
+      case LastEventIndexKey.hostDetails:
+        if (details.hostName) {
+          return {
+            allowNoIndices: true,
+            index: indicesToQuery.hosts,
+            ignoreUnavailable: true,
+            body: {
+              ...(isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
+              aggregations: {
+                last_seen_event: { max: { field: '@timestamp' } },
+              },
+              query: { bool: { filter: getHostDetailsFilter(details.hostName) } },
+              size: 0,
+              track_total_hits: false,
+            },
+          };
+        }
+        throw new Error('buildLastEventTimeQuery - no hostName argument provided');
+      case LastEventIndexKey.hosts:
+      case LastEventIndexKey.network:
+        return {
+          allowNoIndices: true,
+          index: indicesToQuery[indexKey],
+          ignoreUnavailable: true,
+          body: {
+            ...(isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
+            aggregations: {
+              last_seen_event: { max: { field: '@timestamp' } },
+            },
+            query: { match_all: {} },
+            size: 0,
+            track_total_hits: false,
+          },
+        };
+      default:
+        return assertUnreachable(eventIndexKey);
+    }
+  };
+  return getQuery(indexKey);
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/index.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/index.ts
index aa4cdaeedb131..cf2c3c552f30d 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/index.ts
@@ -4,17 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  TimelineFactoryQueryTypes,
-  TimelineQueries,
-} from '../../../../common/search_strategy/timeline';
-
-import { timelineDetails } from './details';
+import { TimelineFactoryQueryTypes } from '../../../../common/search_strategy/timeline';
 import { SecuritySolutionTimelineFactory } from './types';
+import { timelineEventsFactory } from './events';
 
 export const securitySolutionTimelineFactory: Record<
   TimelineFactoryQueryTypes,
   SecuritySolutionTimelineFactory<TimelineFactoryQueryTypes>
 > = {
-  [TimelineQueries.details]: timelineDetails,
+  ...timelineEventsFactory,
 };
diff --git a/x-pack/plugins/security_solution/server/utils/build_query/filters.ts b/x-pack/plugins/security_solution/server/utils/build_query/filters.ts
index ac736e8cb51ee..bde03be3f5edc 100644
--- a/x-pack/plugins/security_solution/server/utils/build_query/filters.ts
+++ b/x-pack/plugins/security_solution/server/utils/build_query/filters.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { isEmpty } from 'lodash/fp';
+import { isEmpty, isString } from 'lodash/fp';
 
 import { ESQuery } from '../../../common/typed_json';
 
 export const createQueryFilterClauses = (filterQuery: ESQuery | string | undefined) =>
-  !isEmpty(filterQuery) ? [filterQuery] : [];
+  !isEmpty(filterQuery) ? [isString(filterQuery) ? JSON.parse(filterQuery) : filterQuery] : [];
diff --git a/x-pack/plugins/security_solution/server/utils/build_query/index.ts b/x-pack/plugins/security_solution/server/utils/build_query/index.ts
index f0f4ba07ab2ae..b7d96c3224c39 100644
--- a/x-pack/plugins/security_solution/server/utils/build_query/index.ts
+++ b/x-pack/plugins/security_solution/server/utils/build_query/index.ts
@@ -8,6 +8,7 @@ export * from './fields';
 export * from './filters';
 export * from './merge_fields_with_hits';
 export * from './calculate_timeseries_interval';
+export * from './reduce_fields';
 
 export const inspectStringifyObject = (obj: unknown) => {
   try {
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_xpack.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_xpack.ts
index 9b69540007e5f..0ff75717c8b65 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_xpack.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_xpack.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { LegacyAPICaller } from 'kibana/server';
 import { TIMEOUT } from './constants';
 
 /**
@@ -14,7 +14,7 @@ import { TIMEOUT } from './constants';
  *
  * Like any X-Pack related API, X-Pack must installed for this to work.
  */
-export function getXPackUsage(callCluster: CallCluster) {
+export function getXPackUsage(callCluster: LegacyAPICaller) {
   return callCluster('transport.request', {
     method: 'GET',
     path: '/_xpack/usage',
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/step_define_summary.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/step_define_summary.tsx
index fa4f8a7e09690..c4adb9f1f49de 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/step_define_summary.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/step_define_summary.tsx
@@ -8,7 +8,7 @@ import React, { Fragment, FC } from 'react';
 
 import { i18n } from '@kbn/i18n';
 
-import { EuiCodeBlock, EuiForm, EuiFormRow, EuiSpacer, EuiText } from '@elastic/eui';
+import { EuiCodeBlock, EuiForm, EuiFormRow, EuiSpacer } from '@elastic/eui';
 
 import { dictionaryToArray } from '../../../../../../common/types/common';
 
@@ -132,23 +132,21 @@ export const StepDefineSummary: FC<Props> = ({
         </EuiFormRow>
 
         <EuiSpacer size="m" />
-        <EuiText>
-          <DataGrid
-            {...pivotPreviewProps}
-            copyToClipboard={getPivotPreviewDevConsoleStatement(previewRequest)}
-            copyToClipboardDescription={i18n.translate(
-              'xpack.transform.pivotPreview.copyClipboardTooltip',
-              {
-                defaultMessage: 'Copy Dev Console statement of the pivot preview to the clipboard.',
-              }
-            )}
-            dataTestSubj="transformPivotPreview"
-            title={i18n.translate('xpack.transform.pivotPreview.PivotPreviewTitle', {
-              defaultMessage: 'Transform pivot preview',
-            })}
-            toastNotifications={toastNotifications}
-          />
-        </EuiText>
+        <DataGrid
+          {...pivotPreviewProps}
+          copyToClipboard={getPivotPreviewDevConsoleStatement(previewRequest)}
+          copyToClipboardDescription={i18n.translate(
+            'xpack.transform.pivotPreview.copyClipboardTooltip',
+            {
+              defaultMessage: 'Copy Dev Console statement of the pivot preview to the clipboard.',
+            }
+          )}
+          dataTestSubj="transformPivotPreview"
+          title={i18n.translate('xpack.transform.pivotPreview.PivotPreviewTitle', {
+            defaultMessage: 'Transform pivot preview',
+          })}
+          toastNotifications={toastNotifications}
+        />
       </EuiForm>
     </div>
   );
diff --git a/x-pack/plugins/transform/server/routes/api/transforms.ts b/x-pack/plugins/transform/server/routes/api/transforms.ts
index c02bc06ad6060..3d2018eb5801f 100644
--- a/x-pack/plugins/transform/server/routes/api/transforms.ts
+++ b/x-pack/plugins/transform/server/routes/api/transforms.ts
@@ -10,8 +10,8 @@ import {
   RequestHandler,
   RequestHandlerContext,
   SavedObjectsClientContract,
+  LegacyAPICaller,
 } from 'kibana/server';
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
 import { wrapEsError } from '../../../../../legacy/server/lib/create_router/error_wrappers';
 
 import { TRANSFORM_STATE } from '../../../common/constants';
@@ -394,7 +394,7 @@ export function registerTransformsRoutes(routeDependencies: RouteDependencies) {
 
 const getTransforms = async (
   options: { transformId?: string },
-  callAsCurrentUser: CallCluster
+  callAsCurrentUser: LegacyAPICaller
 ): Promise<GetTransformsResponseSchema> => {
   return await callAsCurrentUser('transform.getTransforms', options);
 };
@@ -570,7 +570,7 @@ const startTransformsHandler: RequestHandler<
 
 async function startTransforms(
   transformsInfo: StartTransformsRequestSchema,
-  callAsCurrentUser: CallCluster
+  callAsCurrentUser: LegacyAPICaller
 ) {
   const results: StartTransformsResponseSchema = {};
 
@@ -612,7 +612,7 @@ const stopTransformsHandler: RequestHandler<
 
 async function stopTransforms(
   transformsInfo: StopTransformsRequestSchema,
-  callAsCurrentUser: CallCluster
+  callAsCurrentUser: LegacyAPICaller
 ) {
   const results: StopTransformsResponseSchema = {};
 
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index e54d6739c0600..76a3b58a8f3e3 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -1430,10 +1430,7 @@
     "discover.localMenu.saveTitle": "保存",
     "discover.localMenu.shareSearchDescription": "検索を共有します",
     "discover.localMenu.shareTitle": "共有",
-    "discover.noResults.addressShardFailuresTitle": "シャードエラーの解決",
     "discover.noResults.expandYourTimeRangeTitle": "時間範囲を拡大",
-    "discover.noResults.indexFailureIndexText": "インデックス {failureIndex}",
-    "discover.noResults.indexFailureShardText": "{index}、シャード {failureShard}",
     "discover.noResults.queryMayNotMatchTitle": "1つ以上の表示されているインデックスに日付フィールドが含まれています。クエリが現在の時間範囲のデータと一致しないか、現在選択された時間範囲にデータが全く存在しない可能性があります。データが存在する時間範囲に変えることができます。",
     "discover.noResults.searchExamples.400to499StatusCodeExampleTitle": "400-499のすべてのステータスコードを検索",
     "discover.noResults.searchExamples.400to499StatusCodeWithPhpExtensionExampleTitle": "400-499のphp拡張子のステータスコードを検索",
@@ -1444,7 +1441,6 @@
     "discover.noResults.searchExamples.queryStringSyntaxLinkText": "クエリ文字列の構文",
     "discover.noResults.searchExamples.refineYourQueryTitle": "クエリの調整",
     "discover.noResults.searchExamples.statusField200StatusCodeExampleTitle": "ステータスフィールドの200を検索",
-    "discover.noResults.shardFailuresDescription": "次のシャードエラーが発生しました。",
     "discover.notifications.invalidTimeRangeText": "指定された時間範囲が無効です。（開始：'{from}'、終了：'{to}'）",
     "discover.notifications.invalidTimeRangeTitle": "無効な時間範囲",
     "discover.notifications.notSavedSearchTitle": "検索「{savedSearchTitle}」は保存されませんでした。",
@@ -2929,12 +2925,10 @@
     "savedObjectsManagement.view.savedSearchDoesNotExistErrorMessage": "このオブジェクトに関連付けられた保存された検索は現在存在しません。",
     "savedObjectsManagement.view.viewItemButtonLabel": "{title}を表示",
     "savedObjectsManagement.view.viewItemTitle": "{title}を表示",
-    "server.stats.notReadyMessage": "まだ統計が準備できていません。後程再試行してください",
-    "server.status.disabledTitle": "無効",
-    "server.status.greenTitle": "緑",
-    "server.status.redTitle": "赤",
-    "server.status.uninitializedTitle": "アンインストールしました",
-    "server.status.yellowTitle": "黄色",
+    "usageCollection.stats.notReadyMessage": "まだ統計が準備できていません。後程再試行してください",
+    "core.status.greenTitle": "緑",
+    "core.status.redTitle": "赤",
+    "core.status.yellowTitle": "黄色",
     "share.advancedSettings.csv.quoteValuesText": "csvエクスポートに値を引用するかどうかです",
     "share.advancedSettings.csv.quoteValuesTitle": "CSVの値を引用",
     "share.advancedSettings.csv.separatorText": "エクスポートされた値をこの文字列で区切ります",
@@ -4622,7 +4616,6 @@
     "xpack.apm.agentMetrics.java.threadCount": "平均カウント",
     "xpack.apm.agentMetrics.java.threadCountChartTitle": "スレッド数",
     "xpack.apm.agentMetrics.java.threadCountMax": "最高カウント",
-    "xpack.apm.alertTypes.errorRate": "エラー率",
     "xpack.apm.alertTypes.transactionDuration": "トランザクション期間",
     "xpack.apm.anomaly_detection.error.invalid_license": "異常検知を使用するには、Elastic Platinumライセンスのサブスクリプションが必要です。このライセンスがあれば、機械学習を活用して、サービスを監視できます。",
     "xpack.apm.anomaly_detection.error.missing_read_privileges": "異常検知ジョブを表示するには、機械学習およびAPMの「読み取り」権限が必要です",
@@ -4681,11 +4674,6 @@
     "xpack.apm.errorGroupDetails.relatedTransactionSample": "関連トランザクションサンプル",
     "xpack.apm.errorGroupDetails.unhandledLabel": "未対応",
     "xpack.apm.errorGroupDetails.viewOccurrencesInDiscoverButtonLabel": "ディスカバリで {occurrencesCount} 件の{occurrencesCount, plural, one {ドキュメント} other {ドキュメント}}を表示。",
-    "xpack.apm.errorRateAlert.name": "エラー率",
-    "xpack.apm.errorRateAlert.thresholdMet": "しきい値一致",
-    "xpack.apm.errorRateAlertTrigger.environment": "環境",
-    "xpack.apm.errorRateAlertTrigger.errors": "エラー",
-    "xpack.apm.errorRateAlertTrigger.isAbove": "の下限は",
     "xpack.apm.errorRateChart.avgLabel": "平均",
     "xpack.apm.errorRateChart.rateLabel": "レート",
     "xpack.apm.errorRateChart.title": "トランザクションエラー率",
@@ -4787,9 +4775,6 @@
     "xpack.apm.propertiesTable.tabs.logStacktraceLabel": "スタックトレース",
     "xpack.apm.propertiesTable.tabs.metadataLabel": "メタデータ",
     "xpack.apm.propertiesTable.tabs.timelineLabel": "タイムライン",
-    "xpack.apm.registerErrorRateAlertType.variables.serviceName": "サービス名",
-    "xpack.apm.registerTransactionDurationAlertType.variables.serviceName": "サービス名",
-    "xpack.apm.registerTransactionDurationAlertType.variables.transactionType": "トランザクションタイプ",
     "xpack.apm.rum.dashboard.backend": "バックエンド",
     "xpack.apm.rum.dashboard.frontend": "フロントエンド",
     "xpack.apm.rum.dashboard.overall.label": "全体",
@@ -4807,7 +4792,6 @@
     "xpack.apm.selectPlaceholder": "オプションを選択:",
     "xpack.apm.serviceDetails.alertsMenu.alerts": "アラート",
     "xpack.apm.serviceDetails.alertsMenu.createThresholdAlert": "しきい値アラートを作成",
-    "xpack.apm.serviceDetails.alertsMenu.errorRate": "エラー率",
     "xpack.apm.serviceDetails.alertsMenu.transactionDuration": "トランザクション期間",
     "xpack.apm.serviceDetails.alertsMenu.viewActiveAlerts": "アクティブアラートを表示",
     "xpack.apm.serviceDetails.errorsTabLabel": "エラー",
@@ -5037,11 +5021,7 @@
     "xpack.apm.transactionDurationAlert.aggregationType.99th": "99 パーセンタイル",
     "xpack.apm.transactionDurationAlert.aggregationType.avg": "平均",
     "xpack.apm.transactionDurationAlert.name": "トランザクション期間",
-    "xpack.apm.transactionDurationAlert.thresholdMet": "しきい値一致",
-    "xpack.apm.transactionDurationAlertTrigger.environment": "環境",
-    "xpack.apm.transactionDurationAlertTrigger.isAbove": "の下限は",
     "xpack.apm.transactionDurationAlertTrigger.ms": "ms",
-    "xpack.apm.transactionDurationAlertTrigger.type": "タイプ",
     "xpack.apm.transactionDurationAlertTrigger.when": "タイミング",
     "xpack.apm.transactionDurationLabel": "期間",
     "xpack.apm.transactions.chart.95thPercentileLabel": "95 パーセンタイル",
@@ -7998,7 +7978,6 @@
     "xpack.indexLifecycleMgmt.appTitle": "インデックスライフサイクルポリシー",
     "xpack.indexLifecycleMgmt.coldPhase.freezeIndexLabel": "インデックスを凍結",
     "xpack.indexLifecycleMgmt.coldPhase.numberOfReplicasLabel": "複製の数",
-    "xpack.indexLifecycleMgmt.coldPhase.replicaCountHelpText": "デフォルトで、複製の数は同じままになります。",
     "xpack.indexLifecycleMgmt.confirmDelete.cancelButton": "キャンセル",
     "xpack.indexLifecycleMgmt.confirmDelete.deleteButton": "削除",
     "xpack.indexLifecycleMgmt.confirmDelete.errorMessage": "ポリシー {policyName} の削除中にエラーが発生しました",
@@ -8006,7 +7985,6 @@
     "xpack.indexLifecycleMgmt.confirmDelete.title": "ポリシー「{name}」が削除されました",
     "xpack.indexLifecycleMgmt.confirmDelete.undoneWarning": "削除されたポリシーは復元できません。",
     "xpack.indexLifecycleMgmt.editPolicy.cancelButton": "キャンセル",
-    "xpack.indexLifecycleMgmt.editPolicy.coldPhase.activateWarmPhaseSwitchLabel": "コールドフェーズを有効にする",
     "xpack.indexLifecycleMgmt.editPolicy.coldPhase.coldPhaseDescriptionText": "インデックスへのクエリの頻度を減らすことで、大幅に性能が低いハードウェアにシャードを割り当てることができます。クエリが遅いため、複製の数を減らすことができます。",
     "xpack.indexLifecycleMgmt.editPolicy.coldPhase.coldPhaseLabel": "コールドフェーズ",
     "xpack.indexLifecycleMgmt.editPolicy.coldPhase.freezeIndexExplanationText": "凍結されたインデックスはクラスターにほとんどオーバーヘッドがなく、書き込みオペレーションがブロックされます。凍結されたインデックスは検索できますが、クエリが遅くなります。",
@@ -8052,7 +8030,6 @@
     "xpack.indexLifecycleMgmt.editPolicy.maximumIndexSizeMissingError": "最大インデックスサイズが必要です。",
     "xpack.indexLifecycleMgmt.editPolicy.nameLabel": "名前",
     "xpack.indexLifecycleMgmt.editPolicy.nodeAllocationLabel": "シャードの割当をコントロールするノード属性を選択",
-    "xpack.indexLifecycleMgmt.editPolicy.nodeAttributesMissingDescription": "ノード属性なしではシャードの割り当てをコントロールできません。",
     "xpack.indexLifecycleMgmt.editPolicy.nodeAttributesMissingLabel": "elasticsearch.yml でノード属性が構成されていません",
     "xpack.indexLifecycleMgmt.editPolicy.numberRequiredError": "数字が必要です。",
     "xpack.indexLifecycleMgmt.editPolicy.phaseCold.minimumAgeLabel": "コールドフェーズのタイミング",
@@ -8208,7 +8185,6 @@
     "xpack.indexLifecycleMgmt.warmPhase.numberOfPrimaryShardsLabel": "プライマリシャードの数",
     "xpack.indexLifecycleMgmt.warmPhase.numberOfReplicasLabel": "レプリカの数",
     "xpack.indexLifecycleMgmt.warmPhase.numberOfSegmentsLabel": "セグメントの数",
-    "xpack.indexLifecycleMgmt.warmPhase.replicaCountHelpText": "デフォルトで、レプリカの数は同じままになります。",
     "xpack.indexLifecycleMgmt.warmPhase.shrinkIndexLabel": "インデックスを縮小",
     "xpack.infra.alerting.alertFlyout.groupBy.placeholder": "なし（グループなし）",
     "xpack.infra.alerting.alertFlyout.groupByLabel": "グループ分けの条件",
@@ -15927,7 +15903,6 @@
     "xpack.securitySolution.endpoint.resolver.panel.processEventCounts.events": "イベント",
     "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.eventDescriptiveName": "{descriptor} {subject}",
     "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.events": "イベント",
-    "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.wait": "イベントを待機しています...",
     "xpack.securitySolution.endpoint.resolver.panel.relatedCounts.numberOfEventsInCrumb": "{totalCount}件のイベント",
     "xpack.securitySolution.endpoint.resolver.panel.relatedDetail.missing": "関連イベントが見つかりません。",
     "xpack.securitySolution.endpoint.resolver.panel.relatedDetail.wait": "イベントを待機しています...",
@@ -16120,7 +16095,6 @@
     "xpack.securitySolution.footer.live": "ライブ",
     "xpack.securitySolution.footer.loadingLabel": "読み込み中",
     "xpack.securitySolution.footer.loadingTimelineData": "タイムラインデータを読み込み中",
-    "xpack.securitySolution.footer.loadMoreLabel": "さらに読み込む",
     "xpack.securitySolution.footer.of": "/",
     "xpack.securitySolution.footer.rows": "行",
     "xpack.securitySolution.footer.totalCountOfEvents": "イベントが検索条件に一致します",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 4c8ccd56c1c01..89c7a03e099d3 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -1431,10 +1431,7 @@
     "discover.localMenu.saveTitle": "保存",
     "discover.localMenu.shareSearchDescription": "共享搜索",
     "discover.localMenu.shareTitle": "共享",
-    "discover.noResults.addressShardFailuresTitle": "解决分片错误",
     "discover.noResults.expandYourTimeRangeTitle": "展开时间范围",
-    "discover.noResults.indexFailureIndexText": "索引 {failureIndex}",
-    "discover.noResults.indexFailureShardText": "{index}，分片 {failureShard}",
     "discover.noResults.queryMayNotMatchTitle": "您正在查看的一个或多个索引包含日期字段。您的查询在当前时间范围内可能不匹配任何数据，也可能在当前选定的时间范围内没有任何数据。您可以尝试将时间范围更改为包含数据的时间范围。",
     "discover.noResults.searchExamples.400to499StatusCodeExampleTitle": "查找所有介于 400-499 之间的状态代码",
     "discover.noResults.searchExamples.400to499StatusCodeWithPhpExtensionExampleTitle": "查找状态代码 400-499 以及扩展名 php",
@@ -1445,7 +1442,6 @@
     "discover.noResults.searchExamples.queryStringSyntaxLinkText": "查询字符串语法",
     "discover.noResults.searchExamples.refineYourQueryTitle": "优化您的查询",
     "discover.noResults.searchExamples.statusField200StatusCodeExampleTitle": "在状态字段中查找 200",
-    "discover.noResults.shardFailuresDescription": "发生了以下分片错误：",
     "discover.notifications.invalidTimeRangeText": "提供的时间范围无效。（起始：“{from}”，结束：“{to}”）",
     "discover.notifications.invalidTimeRangeTitle": "时间范围无效",
     "discover.notifications.notSavedSearchTitle": "搜索“{savedSearchTitle}”未保存。",
@@ -2930,12 +2926,10 @@
     "savedObjectsManagement.view.savedSearchDoesNotExistErrorMessage": "与此对象关联的已保存搜索已不存在。",
     "savedObjectsManagement.view.viewItemButtonLabel": "查看“{title}”",
     "savedObjectsManagement.view.viewItemTitle": "查看“{title}”",
-    "server.stats.notReadyMessage": "统计尚未就绪。请稍后重试",
-    "server.status.disabledTitle": "已禁用",
-    "server.status.greenTitle": "绿",
-    "server.status.redTitle": "红",
-    "server.status.uninitializedTitle": "未初始化",
-    "server.status.yellowTitle": "黄",
+    "usageCollection.stats.notReadyMessage": "统计尚未就绪。请稍后重试",
+    "core.status.greenTitle": "绿",
+    "core.status.redTitle": "红",
+    "core.status.yellowTitle": "黄",
     "share.advancedSettings.csv.quoteValuesText": "在 CSV 导出中是否应使用引号引起值？",
     "share.advancedSettings.csv.quoteValuesTitle": "使用引号引起 CSV 值",
     "share.advancedSettings.csv.separatorText": "使用此字符串分隔导出的值",
@@ -4623,7 +4617,6 @@
     "xpack.apm.agentMetrics.java.threadCount": "平均计数",
     "xpack.apm.agentMetrics.java.threadCountChartTitle": "线程计数",
     "xpack.apm.agentMetrics.java.threadCountMax": "最大计数",
-    "xpack.apm.alertTypes.errorRate": "错误率",
     "xpack.apm.alertTypes.transactionDuration": "事务持续时间",
     "xpack.apm.anomaly_detection.error.invalid_license": "要使用异常检测，必须订阅 Elastic 白金级许可证。有了该许可证，您便可借助 Machine Learning 监测服务。",
     "xpack.apm.anomaly_detection.error.missing_read_privileges": "必须对 Machine Learning 和 APM 具有“读”权限，才能查看“异常检测”作业",
@@ -4682,11 +4675,6 @@
     "xpack.apm.errorGroupDetails.relatedTransactionSample": "相关的事务样本",
     "xpack.apm.errorGroupDetails.unhandledLabel": "未处理",
     "xpack.apm.errorGroupDetails.viewOccurrencesInDiscoverButtonLabel": "在 Discover 查看 {occurrencesCount} 个 {occurrencesCount, plural, one {匹配项} other {匹配项}}。",
-    "xpack.apm.errorRateAlert.name": "错误率",
-    "xpack.apm.errorRateAlert.thresholdMet": "阈值已达到",
-    "xpack.apm.errorRateAlertTrigger.environment": "环境",
-    "xpack.apm.errorRateAlertTrigger.errors": "错误",
-    "xpack.apm.errorRateAlertTrigger.isAbove": "高于",
     "xpack.apm.errorRateChart.avgLabel": "平均",
     "xpack.apm.errorRateChart.rateLabel": "比率",
     "xpack.apm.errorRateChart.title": "事务错误率",
@@ -4790,9 +4778,6 @@
     "xpack.apm.propertiesTable.tabs.logStacktraceLabel": "日志堆栈跟踪",
     "xpack.apm.propertiesTable.tabs.metadataLabel": "元数据",
     "xpack.apm.propertiesTable.tabs.timelineLabel": "时间线",
-    "xpack.apm.registerErrorRateAlertType.variables.serviceName": "服务名称",
-    "xpack.apm.registerTransactionDurationAlertType.variables.serviceName": "服务名称",
-    "xpack.apm.registerTransactionDurationAlertType.variables.transactionType": "事务类型",
     "xpack.apm.rum.dashboard.backend": "后端",
     "xpack.apm.rum.dashboard.frontend": "前端",
     "xpack.apm.rum.dashboard.overall.label": "总体",
@@ -4810,7 +4795,6 @@
     "xpack.apm.selectPlaceholder": "选择选项：",
     "xpack.apm.serviceDetails.alertsMenu.alerts": "告警",
     "xpack.apm.serviceDetails.alertsMenu.createThresholdAlert": "创建阈值告警",
-    "xpack.apm.serviceDetails.alertsMenu.errorRate": "错误率",
     "xpack.apm.serviceDetails.alertsMenu.transactionDuration": "事务持续时间",
     "xpack.apm.serviceDetails.alertsMenu.viewActiveAlerts": "查看活动的告警",
     "xpack.apm.serviceDetails.errorsTabLabel": "错误",
@@ -5040,11 +5024,7 @@
     "xpack.apm.transactionDurationAlert.aggregationType.99th": "第 99 个百分位",
     "xpack.apm.transactionDurationAlert.aggregationType.avg": "平均值",
     "xpack.apm.transactionDurationAlert.name": "事务持续时间",
-    "xpack.apm.transactionDurationAlert.thresholdMet": "阈值已达到",
-    "xpack.apm.transactionDurationAlertTrigger.environment": "环境",
-    "xpack.apm.transactionDurationAlertTrigger.isAbove": "高于",
     "xpack.apm.transactionDurationAlertTrigger.ms": "ms",
-    "xpack.apm.transactionDurationAlertTrigger.type": "类型",
     "xpack.apm.transactionDurationAlertTrigger.when": "当",
     "xpack.apm.transactionDurationLabel": "持续时间",
     "xpack.apm.transactions.chart.95thPercentileLabel": "第 95 个百分位",
@@ -8002,7 +7982,6 @@
     "xpack.indexLifecycleMgmt.appTitle": "索引生命周期策略",
     "xpack.indexLifecycleMgmt.coldPhase.freezeIndexLabel": "冻结索引",
     "xpack.indexLifecycleMgmt.coldPhase.numberOfReplicasLabel": "副本分片数目",
-    "xpack.indexLifecycleMgmt.coldPhase.replicaCountHelpText": "默认情况下，副本分片数目仍一样。",
     "xpack.indexLifecycleMgmt.confirmDelete.cancelButton": "取消",
     "xpack.indexLifecycleMgmt.confirmDelete.deleteButton": "删除",
     "xpack.indexLifecycleMgmt.confirmDelete.errorMessage": "删除策略 {policyName} 时出错",
@@ -8010,7 +7989,6 @@
     "xpack.indexLifecycleMgmt.confirmDelete.title": "删除策略“{name}”",
     "xpack.indexLifecycleMgmt.confirmDelete.undoneWarning": "无法恢复删除的策略。",
     "xpack.indexLifecycleMgmt.editPolicy.cancelButton": "取消",
-    "xpack.indexLifecycleMgmt.editPolicy.coldPhase.activateWarmPhaseSwitchLabel": "激活冷阶段",
     "xpack.indexLifecycleMgmt.editPolicy.coldPhase.coldPhaseDescriptionText": "您查询自己索引的频率较低，因此您可以在效率较低的硬件上分配分片。因为您的查询较为缓慢，所以您可以减少副本分片数目。",
     "xpack.indexLifecycleMgmt.editPolicy.coldPhase.coldPhaseLabel": "冷阶段",
     "xpack.indexLifecycleMgmt.editPolicy.coldPhase.freezeIndexExplanationText": "冻结的索引在集群上有很少的开销，已被阻止进行写操作。您可以搜索冻结的索引，但查询应会较慢。",
@@ -8056,7 +8034,6 @@
     "xpack.indexLifecycleMgmt.editPolicy.maximumIndexSizeMissingError": "最大索引大小必填。",
     "xpack.indexLifecycleMgmt.editPolicy.nameLabel": "名称",
     "xpack.indexLifecycleMgmt.editPolicy.nodeAllocationLabel": "选择节点属性来控制分片分配",
-    "xpack.indexLifecycleMgmt.editPolicy.nodeAttributesMissingDescription": "没有节点属性，将无法控制分片分配。",
     "xpack.indexLifecycleMgmt.editPolicy.nodeAttributesMissingLabel": "elasticsearch.yml 中未配置任何节点属性",
     "xpack.indexLifecycleMgmt.editPolicy.numberRequiredError": "数字必填。",
     "xpack.indexLifecycleMgmt.editPolicy.phaseCold.minimumAgeLabel": "冷阶段计时",
@@ -8212,7 +8189,6 @@
     "xpack.indexLifecycleMgmt.warmPhase.numberOfPrimaryShardsLabel": "主分片数目",
     "xpack.indexLifecycleMgmt.warmPhase.numberOfReplicasLabel": "副本分片数目",
     "xpack.indexLifecycleMgmt.warmPhase.numberOfSegmentsLabel": "段数目",
-    "xpack.indexLifecycleMgmt.warmPhase.replicaCountHelpText": "默认情况下，副本分片数目仍一样。",
     "xpack.indexLifecycleMgmt.warmPhase.shrinkIndexLabel": "缩小索引",
     "xpack.infra.alerting.alertFlyout.groupBy.placeholder": "无内容（未分组）",
     "xpack.infra.alerting.alertFlyout.groupByLabel": "分组依据",
@@ -15937,7 +15913,6 @@
     "xpack.securitySolution.endpoint.resolver.panel.processEventCounts.events": "事件",
     "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.eventDescriptiveName": "{descriptor} {subject}",
     "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.events": "事件",
-    "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.wait": "等候事件......",
     "xpack.securitySolution.endpoint.resolver.panel.relatedCounts.numberOfEventsInCrumb": "{totalCount} 个事件",
     "xpack.securitySolution.endpoint.resolver.panel.relatedDetail.missing": "找不到相关事件。",
     "xpack.securitySolution.endpoint.resolver.panel.relatedDetail.wait": "等候事件......",
@@ -16130,7 +16105,6 @@
     "xpack.securitySolution.footer.live": "实时",
     "xpack.securitySolution.footer.loadingLabel": "正在加载",
     "xpack.securitySolution.footer.loadingTimelineData": "正在加载时间线数据",
-    "xpack.securitySolution.footer.loadMoreLabel": "加载更多",
     "xpack.securitySolution.footer.of": "/",
     "xpack.securitySolution.footer.rows": "行",
     "xpack.securitySolution.footer.totalCountOfEvents": "个事件匹配搜索条件",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx
index c0674e6c4a5f7..6177262557e07 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx
@@ -244,7 +244,7 @@ export const AlertForm = ({
         ) : null}
       </EuiFlexGroup>
       {AlertParamsExpressionComponent ? (
-        <Suspense fallback={CenterJustifiedSpinner}>
+        <Suspense fallback={<CenterJustifiedSpinner />}>
           <AlertParamsExpressionComponent
             alertParams={alert.params}
             alertInterval={`${alertInterval ?? 1}${alertIntervalUnit}`}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx
index 9cc64defc1795..fcea8caf9090e 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx
@@ -82,3 +82,18 @@ test('If not enough license, button is disabled', () => {
 
   expect(screen.getByText(/Go to URL/i)).toBeDisabled();
 });
+
+test('if action is beta, beta badge is shown', () => {
+  const betaUrl = new ActionFactory(
+    {
+      ...urlDrilldownActionFactory,
+      isBeta: true,
+    },
+    {
+      getLicense: () => licensingMock.createLicense(),
+      getFeatureUsageStart: () => licensingMock.createStart().featureUsage,
+    }
+  );
+  const screen = render(<Demo actionFactories={[dashboardFactory, betaUrl]} />);
+  expect(screen.getByText(/Beta/i)).toBeVisible();
+});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
index 16d0250c5721e..a3f6cac3ba1b4 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
@@ -19,9 +19,12 @@ import {
   EuiTextColor,
   EuiTitle,
   EuiLink,
+  EuiBetaBadge,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import {
+  txtBetaActionFactoryLabel,
+  txtBetaActionFactoryTooltip,
   txtChangeButton,
   txtTriggerPickerHelpText,
   txtTriggerPickerLabel,
@@ -255,7 +258,15 @@ const SelectedActionFactory: React.FC<SelectedActionFactoryProps> = ({
           )}
           <EuiFlexItem grow={true}>
             <EuiText>
-              <h4>{actionFactory.getDisplayName(context)}</h4>
+              <h4>
+                {actionFactory.getDisplayName(context)}{' '}
+                {actionFactory.isBeta && (
+                  <EuiBetaBadge
+                    label={txtBetaActionFactoryLabel}
+                    tooltipContent={txtBetaActionFactoryTooltip}
+                  />
+                )}
+              </h4>
             </EuiText>
           </EuiFlexItem>
           {showDeselect && (
@@ -350,6 +361,10 @@ const ActionFactorySelector: React.FC<ActionFactorySelectorProps> = ({
               data-test-subj={`${TEST_SUBJ_ACTION_FACTORY_ITEM}-${actionFactory.id}`}
               onClick={() => onActionFactorySelected(actionFactory)}
               disabled={!actionFactory.isCompatibleLicense()}
+              betaBadgeLabel={actionFactory.isBeta ? txtBetaActionFactoryLabel : undefined}
+              betaBadgeTooltipContent={
+                actionFactory.isBeta ? txtBetaActionFactoryTooltip : undefined
+              }
             >
               {actionFactory.getIconType(context) && (
                 <EuiIcon type={actionFactory.getIconType(context)!} size="m" />
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/i18n.ts
index f494ecfb51f32..43a3bd01daf37 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/i18n.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/i18n.ts
@@ -33,3 +33,17 @@ export const txtTriggerPickerHelpTooltip = i18n.translate(
     defaultMessage: 'Determines when the drilldown appears in context menu',
   }
 );
+
+export const txtBetaActionFactoryLabel = i18n.translate(
+  'xpack.uiActionsEnhanced.components.actionWizard.betaActionLabel',
+  {
+    defaultMessage: `Beta`,
+  }
+);
+
+export const txtBetaActionFactoryTooltip = i18n.translate(
+  'xpack.uiActionsEnhanced.components.actionWizard.betaActionTooltip',
+  {
+    defaultMessage: `This action is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Please help us by reporting any bugs or providing other feedback.`,
+  }
+);
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts
index 8faccc088a327..f5e565d4090ff 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts
@@ -36,6 +36,12 @@ export interface DrilldownDefinition<
    */
   id: string;
 
+  /**
+   * Is this action factory not GA?
+   * Adds a beta badge on a list item representing this ActionFactory
+   */
+  readonly isBeta?: boolean;
+
   /**
    * Minimal license level
    * Empty means no restrictions
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/i18n.ts
index 78f7218dce22e..500ef21b61dc4 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/i18n.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/i18n.ts
@@ -19,7 +19,8 @@ export const txtUrlTemplatePlaceholder = i18n.translate(
 export const txtUrlPreviewHelpText = i18n.translate(
   'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.urlPreviewHelpText',
   {
-    defaultMessage: 'Please note that \\{\\{event.*\\}\\} variables replaced by dummy values.',
+    defaultMessage:
+      'Please note that in preview \\{\\{event.*\\}\\} variables are substituted with dummy values.',
   }
 );
 
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts
index 032a4a63fe2e9..66a876bdbab85 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts
@@ -114,3 +114,15 @@ describe('License & ActionFactory', () => {
     });
   });
 });
+
+describe('isBeta', () => {
+  test('false by default', async () => {
+    const factory = createActionFactory();
+    expect(factory.isBeta).toBe(false);
+  });
+
+  test('true', async () => {
+    const factory = createActionFactory({ isBeta: true });
+    expect(factory.isBeta).toBe(true);
+  });
+});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
index 35a82adf9896d..3ad6d4ee39749 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
@@ -46,6 +46,7 @@ export class ActionFactory<
   }
 
   public readonly id = this.def.id;
+  public readonly isBeta = this.def.isBeta ?? false;
   public readonly minimalLicense = this.def.minimalLicense;
   public readonly licenseFeatureName = this.def.licenseFeatureName;
   public readonly order = this.def.order || 0;
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts
index 91b8c8ec1e5ef..7ec6b21485747 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts
@@ -46,6 +46,12 @@ export interface ActionFactoryDefinition<
    */
   licenseFeatureName?: string;
 
+  /**
+   * Is this action factory not GA?
+   * Adds a beta badge on a list item representing this ActionFactory
+   */
+  readonly isBeta?: boolean;
+
   /**
    * This method should return a definition of a new action, normally used to
    * register it in `ui_actions` registry.
diff --git a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
index b8086c16f5e71..ab0aa1200f5a7 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
@@ -89,6 +89,7 @@ export class UiActionsServiceEnhancements {
     ExecutionContext extends TriggerContextMapping[SupportedTriggers] = TriggerContextMapping[SupportedTriggers]
   >({
     id: factoryId,
+    isBeta,
     order,
     CollectConfig,
     createConfig,
@@ -109,6 +110,7 @@ export class UiActionsServiceEnhancements {
       ExecutionContext
     > = {
       id: factoryId,
+      isBeta,
       minimalLicense,
       licenseFeatureName,
       order,
diff --git a/x-pack/plugins/upgrade_assistant/common/types.ts b/x-pack/plugins/upgrade_assistant/common/types.ts
index a29c37c9a988c..2a94b39ca6c66 100644
--- a/x-pack/plugins/upgrade_assistant/common/types.ts
+++ b/x-pack/plugins/upgrade_assistant/common/types.ts
@@ -4,8 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { DeprecationInfo } from 'src/legacy/core_plugins/elasticsearch';
 import { SavedObject, SavedObjectAttributes } from 'src/core/public';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationInfo } from '../../../../src/core/server/elasticsearch/legacy/api_types';
 
 export enum ReindexStep {
   // Enum values are spaced out by 10 to give us room to insert steps in between.
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/constants.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/constants.tsx
index b7eafb7bf5c88..66c802097055b 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/constants.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/constants.tsx
@@ -6,8 +6,8 @@
 
 import { IconColor } from '@elastic/eui';
 import { invert } from 'lodash';
-
-import { DeprecationInfo } from 'src/legacy/core_plugins/elasticsearch';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationInfo } from '../../../../../../../../src/core/server/elasticsearch/legacy/api_types';
 
 export const LEVEL_MAP: { [level: string]: number } = {
   warning: 0,
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/controls.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/controls.tsx
index 60db71c76357a..d75a25a95d67f 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/controls.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/controls.tsx
@@ -8,8 +8,8 @@ import React, { FunctionComponent, useState } from 'react';
 import { i18n } from '@kbn/i18n';
 import { EuiButton, EuiFieldSearch, EuiFlexGroup, EuiFlexItem, EuiCallOut } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-
-import { DeprecationInfo } from 'src/legacy/core_plugins/elasticsearch';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationInfo } from '../../../../../../../../src/core/server/elasticsearch/legacy/api_types';
 import { GroupByOption, LevelFilterOption, LoadingState } from '../../types';
 import { FilterBar } from './filter_bar';
 import { GroupByBar } from './group_by_bar';
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/grouped.test.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/grouped.test.tsx
index f2469fe1225e3..affeeb84f35d7 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/grouped.test.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/grouped.test.tsx
@@ -7,10 +7,10 @@
 import { range } from 'lodash';
 import React from 'react';
 import { mountWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
-
 import { EuiBadge, EuiPagination } from '@elastic/eui';
 
-import { DeprecationInfo } from 'src/legacy/core_plugins/elasticsearch';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationInfo } from '../../../../../../../../../src/core/server/elasticsearch/legacy/api_types';
 import { EnrichedDeprecationInfo } from '../../../../../../common/types';
 import { GroupByOption, LevelFilterOption } from '../../../types';
 import { DeprecationAccordion, filterDeps, GroupedDeprecations } from './grouped';
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/grouped.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/grouped.tsx
index bdc7fa5e58e8a..de1a5a996d75f 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/grouped.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/grouped.tsx
@@ -18,7 +18,8 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 
-import { DeprecationInfo } from 'src/legacy/core_plugins/elasticsearch';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationInfo } from '../../../../../../../../../src/core/server/elasticsearch/legacy/api_types';
 import { EnrichedDeprecationInfo } from '../../../../../../common/types';
 import { GroupByOption, LevelFilterOption } from '../../../types';
 
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/health.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/health.tsx
index 72a36d72bab6e..3ce40d0c4fdf0 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/health.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/health.tsx
@@ -10,7 +10,8 @@ import React, { FunctionComponent } from 'react';
 import { EuiBadge, EuiToolTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
-import { DeprecationInfo } from 'src/legacy/core_plugins/elasticsearch';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationInfo } from '../../../../../../../../../src/core/server/elasticsearch/legacy/api_types';
 import { COLOR_MAP, LEVEL_MAP, REVERSE_LEVEL_MAP } from '../constants';
 
 const LocalizedLevels: { [level: string]: string } = {
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/list.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/list.tsx
index 5e11e4d0a5283..038f05aace4c3 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/list.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/list.tsx
@@ -6,7 +6,8 @@
 
 import React, { FunctionComponent } from 'react';
 
-import { DeprecationInfo } from 'src/legacy/core_plugins/elasticsearch';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationInfo } from '../../../../../../../../../src/core/server/elasticsearch/legacy/api_types';
 import { EnrichedDeprecationInfo } from '../../../../../../common/types';
 import { GroupByOption } from '../../../types';
 
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/filter_bar.test.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/filter_bar.test.tsx
index 9d0c9ea9ddb56..053ef21d6b309 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/filter_bar.test.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/filter_bar.test.tsx
@@ -7,7 +7,8 @@
 import { mount, shallow } from 'enzyme';
 import React from 'react';
 
-import { DeprecationInfo } from 'src/legacy/core_plugins/elasticsearch';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationInfo } from '../../../../../../../../src/core/server/elasticsearch/legacy/api_types';
 import { LevelFilterOption } from '../../types';
 import { FilterBar } from './filter_bar';
 
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/filter_bar.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/filter_bar.tsx
index 0dafe2105cdb7..6939c547fee57 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/filter_bar.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/filter_bar.tsx
@@ -10,7 +10,8 @@ import React from 'react';
 import { EuiFilterButton, EuiFilterGroup, EuiFlexItem } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
-import { DeprecationInfo } from 'src/legacy/core_plugins/elasticsearch';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationInfo } from '../../../../../../../../src/core/server/elasticsearch/legacy/api_types';
 import { LevelFilterOption } from '../../types';
 
 const LocalizedOptions: { [option: string]: string } = {
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/es_migration_apis.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/es_migration_apis.test.ts
index 6e524a98afdc6..f97a056d5cd36 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/es_migration_apis.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/es_migration_apis.test.ts
@@ -6,7 +6,8 @@
 
 import _ from 'lodash';
 import { elasticsearchServiceMock } from 'src/core/server/mocks';
-import { DeprecationAPIResponse } from 'src/legacy/core_plugins/elasticsearch';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationAPIResponse } from '../../../../../src/core/server/elasticsearch/legacy/api_types';
 
 import { getUpgradeAssistantStatus } from './es_migration_apis';
 import fakeDeprecations from './__fixtures__/fake_deprecations.json';
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/es_migration_apis.ts b/x-pack/plugins/upgrade_assistant/server/lib/es_migration_apis.ts
index abbeb8a89e12a..9f55b9d049735 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/es_migration_apis.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/es_migration_apis.ts
@@ -5,7 +5,8 @@
  */
 
 import { ILegacyScopedClusterClient } from 'src/core/server';
-import { DeprecationAPIResponse } from 'src/legacy/core_plugins/elasticsearch';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import type { DeprecationAPIResponse } from '../../../../../src/core/server/elasticsearch/legacy/api_types';
 import { EnrichedDeprecationInfo, UpgradeAssistantStatus } from '../../common/types';
 
 import { esIndicesStateCheck } from './es_indices_state_check';
diff --git a/x-pack/plugins/uptime/public/components/certificates/__tests__/__snapshots__/cert_search.test.tsx.snap b/x-pack/plugins/uptime/public/components/certificates/__tests__/__snapshots__/cert_search.test.tsx.snap
index 97f476a56135a..f16ef6b5548b8 100644
--- a/x-pack/plugins/uptime/public/components/certificates/__tests__/__snapshots__/cert_search.test.tsx.snap
+++ b/x-pack/plugins/uptime/public/components/certificates/__tests__/__snapshots__/cert_search.test.tsx.snap
@@ -16,7 +16,7 @@ exports[`CertificatesSearch renders expected elements for valid props 1`] = `
     >
       <input
         aria-label="Search certificates"
-        class="euiFieldSearch euiFieldSearch--fullWidth"
+        class="euiFieldSearch euiFieldSearch--fullWidth euiFieldSearch-isClearable"
         data-test-subj="uptimeCertSearch"
         placeholder="Search certificates"
         type="search"
diff --git a/x-pack/plugins/xpack_legacy/README.md b/x-pack/plugins/xpack_legacy/README.md
new file mode 100644
index 0000000000000..be43825347959
--- /dev/null
+++ b/x-pack/plugins/xpack_legacy/README.md
@@ -0,0 +1,3 @@
+# Xpack Leagcy
+
+Contains HTTP endpoints and UiSettings that are slated for removal.
diff --git a/x-pack/plugins/xpack_legacy/kibana.json b/x-pack/plugins/xpack_legacy/kibana.json
new file mode 100644
index 0000000000000..fc45b612d72cf
--- /dev/null
+++ b/x-pack/plugins/xpack_legacy/kibana.json
@@ -0,0 +1,10 @@
+{
+  "id": "xpackLegacy",
+  "version": "8.0.0",
+  "kibanaVersion": "kibana",
+  "server": true,
+  "ui": false,
+  "requiredPlugins": [
+    "usageCollection"
+  ]
+}
diff --git a/x-pack/plugins/xpack_legacy/server/index.ts b/x-pack/plugins/xpack_legacy/server/index.ts
new file mode 100644
index 0000000000000..ecdee0692fc9d
--- /dev/null
+++ b/x-pack/plugins/xpack_legacy/server/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { PluginInitializerContext } from '../../../../src/core/server';
+import { XpackLegacyPlugin } from './plugin';
+
+export const plugin = (initializerContext: PluginInitializerContext) =>
+  new XpackLegacyPlugin(initializerContext);
diff --git a/x-pack/plugins/xpack_legacy/server/plugin.ts b/x-pack/plugins/xpack_legacy/server/plugin.ts
new file mode 100644
index 0000000000000..2905f8e4bf3d4
--- /dev/null
+++ b/x-pack/plugins/xpack_legacy/server/plugin.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { first } from 'rxjs/operators';
+
+import {
+  CoreStart,
+  CoreSetup,
+  Plugin,
+  PluginInitializerContext,
+} from '../../../../src/core/server';
+import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/server';
+import { registerSettingsRoute } from './routes/settings';
+
+interface SetupPluginDeps {
+  usageCollection: UsageCollectionSetup;
+}
+
+export class XpackLegacyPlugin implements Plugin {
+  constructor(private readonly initContext: PluginInitializerContext) {}
+
+  public async setup(core: CoreSetup, { usageCollection }: SetupPluginDeps) {
+    const router = core.http.createRouter();
+    const globalConfig = await this.initContext.config.legacy.globalConfig$
+      .pipe(first())
+      .toPromise();
+    const serverInfo = core.http.getServerInfo();
+
+    registerSettingsRoute({
+      router,
+      usageCollection,
+      overallStatus$: core.status.overall$,
+      config: {
+        kibanaIndex: globalConfig.kibana.index,
+        kibanaVersion: this.initContext.env.packageInfo.version,
+        uuid: this.initContext.env.instanceUuid,
+        server: serverInfo,
+      },
+    });
+  }
+
+  public start(core: CoreStart) {}
+
+  public stop() {}
+}
diff --git a/x-pack/plugins/xpack_legacy/server/routes/settings.test.ts b/x-pack/plugins/xpack_legacy/server/routes/settings.test.ts
new file mode 100644
index 0000000000000..02fa669cb05e0
--- /dev/null
+++ b/x-pack/plugins/xpack_legacy/server/routes/settings.test.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { BehaviorSubject } from 'rxjs';
+import { UnwrapPromise } from '@kbn/utility-types';
+import supertest from 'supertest';
+
+import {
+  LegacyAPICaller,
+  ServiceStatus,
+  ServiceStatusLevels,
+} from '../../../../../src/core/server';
+import { contextServiceMock } from '../../../../../src/core/server/mocks';
+import { createHttpServer } from '../../../../../src/core/server/test_utils';
+import { registerSettingsRoute } from './settings';
+
+type HttpService = ReturnType<typeof createHttpServer>;
+type HttpSetup = UnwrapPromise<ReturnType<HttpService['setup']>>;
+
+describe('/api/stats', () => {
+  let server: HttpService;
+  let httpSetup: HttpSetup;
+  let overallStatus$: BehaviorSubject<ServiceStatus>;
+  let mockApiCaller: jest.Mocked<LegacyAPICaller>;
+
+  beforeEach(async () => {
+    mockApiCaller = jest.fn().mockResolvedValue({ cluster_uuid: 'yyy-yyyyy' });
+    server = createHttpServer();
+    httpSetup = await server.setup({
+      context: contextServiceMock.createSetupContract({
+        core: {
+          elasticsearch: {
+            legacy: {
+              client: {
+                callAsCurrentUser: mockApiCaller,
+              },
+            },
+          },
+        },
+      }),
+    });
+
+    overallStatus$ = new BehaviorSubject<ServiceStatus>({
+      level: ServiceStatusLevels.available,
+      summary: 'everything is working',
+    });
+
+    const usageCollection = {
+      getCollectorByType: jest.fn().mockReturnValue({
+        fetch: jest
+          .fn()
+          .mockReturnValue({ xpack: { default_admin_email: 'kibana-machine@elastic.co' } }),
+      }),
+    } as any;
+
+    const router = httpSetup.createRouter('');
+    registerSettingsRoute({
+      router,
+      overallStatus$,
+      usageCollection,
+      config: {
+        kibanaIndex: '.kibana-test',
+        kibanaVersion: '8.8.8-SNAPSHOT',
+        server: {
+          name: 'mykibana',
+          hostname: 'mykibana.com',
+          port: 1234,
+        },
+        uuid: 'xxx-xxxxx',
+      },
+    });
+
+    await server.start();
+  });
+
+  afterEach(async () => {
+    await server.stop();
+  });
+
+  it('successfully returns data', async () => {
+    const response = await supertest(httpSetup.server.listener).get('/api/settings').expect(200);
+    expect(response.body).toMatchObject({
+      cluster_uuid: 'yyy-yyyyy',
+      settings: {
+        xpack: {
+          default_admin_email: 'kibana-machine@elastic.co',
+        },
+        kibana: {
+          uuid: 'xxx-xxxxx',
+          name: 'mykibana',
+          index: '.kibana-test',
+          host: 'mykibana.com',
+          locale: 'en',
+          transport_address: `mykibana.com:1234`,
+          version: '8.8.8',
+          snapshot: true,
+          status: 'green',
+        },
+      },
+    });
+  });
+});
diff --git a/x-pack/plugins/xpack_legacy/server/routes/settings.ts b/x-pack/plugins/xpack_legacy/server/routes/settings.ts
new file mode 100644
index 0000000000000..2a0eb3d11584e
--- /dev/null
+++ b/x-pack/plugins/xpack_legacy/server/routes/settings.ts
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { Observable } from 'rxjs';
+import { first } from 'rxjs/operators';
+
+import { IRouter, ServiceStatus, ServiceStatusLevels } from '../../../../../src/core/server';
+import { UsageCollectionSetup } from '../../../../../src/plugins/usage_collection/server';
+import { KIBANA_SETTINGS_TYPE } from '../../../monitoring/common/constants';
+import { KibanaSettingsCollector } from '../../../monitoring/server';
+
+const SNAPSHOT_REGEX = /-snapshot/i;
+
+export function registerSettingsRoute({
+  router,
+  usageCollection,
+  overallStatus$,
+  config,
+}: {
+  router: IRouter;
+  usageCollection: UsageCollectionSetup;
+  overallStatus$: Observable<ServiceStatus>;
+  config: {
+    kibanaIndex: string;
+    kibanaVersion: string;
+    uuid: string;
+    server: {
+      name: string;
+      hostname: string;
+      port: number;
+    };
+  };
+}) {
+  router.get(
+    {
+      path: '/api/settings',
+      validate: false,
+    },
+    async (context, req, res) => {
+      const { callAsCurrentUser } = context.core.elasticsearch.legacy.client;
+
+      const settingsCollector = usageCollection.getCollectorByType(KIBANA_SETTINGS_TYPE) as
+        | KibanaSettingsCollector
+        | undefined;
+      if (!settingsCollector) {
+        return res.internalError();
+      }
+
+      const settings =
+        (await settingsCollector.fetch(callAsCurrentUser)) ??
+        settingsCollector.getEmailValueStructure(null);
+      const { cluster_uuid: uuid } = await callAsCurrentUser('info', {
+        filterPath: 'cluster_uuid',
+      });
+
+      const overallStatus = await overallStatus$.pipe(first()).toPromise();
+
+      const kibana = {
+        uuid: config.uuid,
+        name: config.server.name,
+        index: config.kibanaIndex,
+        host: config.server.hostname,
+        port: config.server.port,
+        locale: i18n.getLocale(),
+        transport_address: `${config.server.hostname}:${config.server.port}`,
+        version: config.kibanaVersion.replace(SNAPSHOT_REGEX, ''),
+        snapshot: SNAPSHOT_REGEX.test(config.kibanaVersion),
+        status: ServiceStatusToLegacyState[overallStatus.level.toString()],
+      };
+
+      return res.ok({
+        body: {
+          cluster_uuid: uuid,
+          settings: {
+            ...settings,
+            kibana,
+          },
+        },
+      });
+    }
+  );
+}
+
+const ServiceStatusToLegacyState: Record<string, string> = {
+  [ServiceStatusLevels.critical.toString()]: 'red',
+  [ServiceStatusLevels.unavailable.toString()]: 'red',
+  [ServiceStatusLevels.degraded.toString()]: 'yellow',
+  [ServiceStatusLevels.available.toString()]: 'green',
+};
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/routes.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/routes.ts
index 02d39bba42659..79fc8470a8ec2 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/routes.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/routes.ts
@@ -50,6 +50,8 @@ export function defineRoutes(
         includedHiddenTypes: ['alert'],
       });
       const savedObjectsWithAlerts = await savedObjects.getScopedClient(req, {
+        // Exclude the security and spaces wrappers to get around the safeguards those have in place to prevent
+        // us from doing what we want to do - brute force replace the ApiKey
         excludedWrappers: ['security', 'spaces'],
         includedHiddenTypes: ['alert'],
       });
@@ -138,7 +140,13 @@ export function defineRoutes(
       const savedObjectsWithAlerts = await savedObjects.getScopedClient(req, {
         includedHiddenTypes: ['alert'],
       });
-      const result = await savedObjectsWithAlerts.update(type, id, attributes, options);
+      const savedAlert = await savedObjectsWithAlerts.get<RawAlert>(type, id);
+      const result = await savedObjectsWithAlerts.update(
+        type,
+        id,
+        { ...savedAlert.attributes, ...attributes },
+        options
+      );
       return res.ok({ body: result });
     }
   );
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
index d82d116396cd6..ef14dd9ec2eff 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
@@ -141,6 +141,77 @@ export default function webhookTest({ getService }: FtrProviderContext) {
       });
     });
 
+    it('should remove headers when a webhook is updated', async () => {
+      const { body: createdAction } = await supertest
+        .post('/api/actions/action')
+        .set('kbn-xsrf', 'test')
+        .send({
+          name: 'A generic Webhook action',
+          actionTypeId: '.webhook',
+          secrets: {
+            user: 'username',
+            password: 'mypassphrase',
+          },
+          config: {
+            url: webhookSimulatorURL,
+            headers: {
+              someHeader: '123',
+            },
+          },
+        })
+        .expect(200);
+
+      expect(createdAction).to.eql({
+        id: createdAction.id,
+        isPreconfigured: false,
+        name: 'A generic Webhook action',
+        actionTypeId: '.webhook',
+        config: {
+          ...defaultValues,
+          url: webhookSimulatorURL,
+          headers: {
+            someHeader: '123',
+          },
+        },
+      });
+
+      await supertest
+        .put(`/api/actions/action/${createdAction.id}`)
+        .set('kbn-xsrf', 'foo')
+        .send({
+          name: 'A generic Webhook action',
+          secrets: {
+            user: 'username',
+            password: 'mypassphrase',
+          },
+          config: {
+            url: webhookSimulatorURL,
+            headers: {
+              someOtherHeader: '456',
+            },
+          },
+        })
+        .expect(200);
+
+      const { body: fetchedAction } = await supertest
+        .get(`/api/actions/action/${createdAction.id}`)
+        .expect(200);
+
+      expect(fetchedAction).to.eql({
+        id: fetchedAction.id,
+        isPreconfigured: false,
+        name: 'A generic Webhook action',
+        actionTypeId: '.webhook',
+        config: {
+          ...defaultValues,
+          url: webhookSimulatorURL,
+          headers: {
+            someOtherHeader: '456',
+          },
+        },
+      });
+    });
+
     it('should send authentication to the webhook target', async () => {
       const webhookActionId = await createWebhookAction(webhookSimulatorURL, {}, kibanaURL);
       const { body: result } = await supertest
diff --git a/x-pack/test/api_integration/apis/index.js b/x-pack/test/api_integration/apis/index.js
index 23532d1311754..a1bcaa13cc52b 100644
--- a/x-pack/test/api_integration/apis/index.js
+++ b/x-pack/test/api_integration/apis/index.js
@@ -12,7 +12,7 @@ export default function ({ loadTestFile }) {
     loadTestFile(require.resolve('./security'));
     loadTestFile(require.resolve('./spaces'));
     loadTestFile(require.resolve('./monitoring'));
-    loadTestFile(require.resolve('./xpack_main'));
+    loadTestFile(require.resolve('./xpack_legacy'));
     loadTestFile(require.resolve('./features'));
     loadTestFile(require.resolve('./telemetry'));
     loadTestFile(require.resolve('./logstash'));
diff --git a/x-pack/test/api_integration/apis/management/index_lifecycle_management/nodes.js b/x-pack/test/api_integration/apis/management/index_lifecycle_management/nodes.js
index bc8b2af401423..bb35f6fd96429 100644
--- a/x-pack/test/api_integration/apis/management/index_lifecycle_management/nodes.js
+++ b/x-pack/test/api_integration/apis/management/index_lifecycle_management/nodes.js
@@ -29,7 +29,7 @@ export default function ({ getService }) {
         const nodesIds = Object.keys(nodeStats.nodes);
 
         const { body } = await loadNodes().expect(200);
-        expect(body[NODE_CUSTOM_ATTRIBUTE]).to.eql(nodesIds);
+        expect(body.nodesByAttributes[NODE_CUSTOM_ATTRIBUTE]).to.eql(nodesIds);
       });
     });
 
diff --git a/x-pack/test/api_integration/apis/ml/modules/get_module.ts b/x-pack/test/api_integration/apis/ml/modules/get_module.ts
index a3d060bb1faca..6c7cb8bf4dce0 100644
--- a/x-pack/test/api_integration/apis/ml/modules/get_module.ts
+++ b/x-pack/test/api_integration/apis/ml/modules/get_module.ts
@@ -20,6 +20,8 @@ const moduleIds = [
   'logs_ui_analysis',
   'logs_ui_categories',
   'metricbeat_system_ecs',
+  'metrics_ui_hosts',
+  'metrics_ui_k8s',
   'nginx_ecs',
   'sample_data_ecommerce',
   'sample_data_weblogs',
diff --git a/x-pack/test/api_integration/apis/xpack_main/index.js b/x-pack/test/api_integration/apis/xpack_legacy/index.js
similarity index 90%
rename from x-pack/test/api_integration/apis/xpack_main/index.js
rename to x-pack/test/api_integration/apis/xpack_legacy/index.js
index c011ef870df4a..b712d565311bc 100644
--- a/x-pack/test/api_integration/apis/xpack_main/index.js
+++ b/x-pack/test/api_integration/apis/xpack_legacy/index.js
@@ -5,7 +5,7 @@
  */
 
 export default function ({ loadTestFile }) {
-  describe('xpack_main', () => {
+  describe('xpack_legacy', () => {
     loadTestFile(require.resolve('./settings'));
   });
 }
diff --git a/x-pack/test/api_integration/apis/xpack_main/settings/index.js b/x-pack/test/api_integration/apis/xpack_legacy/settings/index.js
similarity index 100%
rename from x-pack/test/api_integration/apis/xpack_main/settings/index.js
rename to x-pack/test/api_integration/apis/xpack_legacy/settings/index.js
diff --git a/x-pack/test/api_integration/apis/xpack_main/settings/settings.js b/x-pack/test/api_integration/apis/xpack_legacy/settings/settings.js
similarity index 100%
rename from x-pack/test/api_integration/apis/xpack_main/settings/settings.js
rename to x-pack/test/api_integration/apis/xpack_legacy/settings/settings.js
diff --git a/x-pack/test/api_integration/config_security_basic.ts b/x-pack/test/api_integration/config_security_basic.ts
index 8489940505686..237d162e80328 100644
--- a/x-pack/test/api_integration/config_security_basic.ts
+++ b/x-pack/test/api_integration/config_security_basic.ts
@@ -19,6 +19,7 @@ export default async function (context: FtrConfigProviderContext) {
       'xpack.security.authc.api_key.enabled=true',
     ];
     config.testFiles = [require.resolve('./apis/security/security_basic')];
+    config.junit.reportName = 'X-Pack API Integration Tests (Security Basic)';
     return config;
   });
 }
diff --git a/x-pack/test/api_integration/config_security_trial.ts b/x-pack/test/api_integration/config_security_trial.ts
index 4c1e2913b987c..839165d8618cf 100644
--- a/x-pack/test/api_integration/config_security_trial.ts
+++ b/x-pack/test/api_integration/config_security_trial.ts
@@ -12,6 +12,7 @@ import { default as createTestConfig } from './config';
 export default async function (context: FtrConfigProviderContext) {
   return createTestConfig(context).then((config) => {
     config.testFiles = [require.resolve('./apis/security/security_trial')];
+    config.junit.reportName = 'X-Pack API Integration Tests (Security Trial)';
     return config;
   });
 }
diff --git a/x-pack/test/apm_api_integration/basic/tests/feature_controls.ts b/x-pack/test/apm_api_integration/basic/tests/feature_controls.ts
index 400d0d294bf02..e0e13b7b7fb98 100644
--- a/x-pack/test/apm_api_integration/basic/tests/feature_controls.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/feature_controls.ts
@@ -149,13 +149,6 @@ export default function featureControlsTests({ getService }: FtrProviderContext)
         log.error(JSON.stringify(res, null, 2));
       },
     },
-    {
-      req: {
-        url: `/api/apm/settings/custom_links`,
-      },
-      expectForbidden: expect404,
-      expectResponse: expect200,
-    },
     {
       req: {
         url: `/api/apm/settings/custom_links/transaction`,
diff --git a/x-pack/test/apm_api_integration/basic/tests/index.ts b/x-pack/test/apm_api_integration/basic/tests/index.ts
index bae94d89e7457..8aa509b0899ce 100644
--- a/x-pack/test/apm_api_integration/basic/tests/index.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/index.ts
@@ -52,5 +52,9 @@ export default function apmApiIntegrationTests({ loadTestFile }: FtrProviderCont
       loadTestFile(require.resolve('./observability_overview/has_data'));
       loadTestFile(require.resolve('./observability_overview/observability_overview'));
     });
+
+    describe('Metrics', function () {
+      loadTestFile(require.resolve('./metrics_charts/metrics_charts'));
+    });
   });
 }
diff --git a/x-pack/test/apm_api_integration/basic/tests/metrics_charts/metrics_charts.ts b/x-pack/test/apm_api_integration/basic/tests/metrics_charts/metrics_charts.ts
new file mode 100644
index 0000000000000..f82e16e090eae
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/tests/metrics_charts/metrics_charts.ts
@@ -0,0 +1,440 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect';
+import { first } from 'lodash';
+import { MetricsChartsByAgentAPIResponse } from '../../../../../plugins/apm/server/lib/metrics/get_metrics_chart_data_by_agent';
+import { GenericMetricsChart } from '../../../../../plugins/apm/server/lib/metrics/transform_metrics_chart';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import { expectSnapshot } from '../../../common/match_snapshot';
+
+interface ChartResponse {
+  body: MetricsChartsByAgentAPIResponse;
+  status: number;
+}
+
+export default function ApiTest({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+
+  describe('when data is loaded', () => {
+    before(() => esArchiver.load('metrics_8.0.0'));
+    after(() => esArchiver.unload('metrics_8.0.0'));
+
+    describe('for opbeans-node', () => {
+      const start = encodeURIComponent('2020-09-08T14:50:00.000Z');
+      const end = encodeURIComponent('2020-09-08T14:55:00.000Z');
+      const uiFilters = encodeURIComponent(JSON.stringify({}));
+      const agentName = 'nodejs';
+
+      describe('returns metrics data', () => {
+        let chartsResponse: ChartResponse;
+        before(async () => {
+          chartsResponse = await supertest.get(
+            `/api/apm/services/opbeans-node/metrics/charts?start=${start}&end=${end}&uiFilters=${uiFilters}&agentName=${agentName}`
+          );
+        });
+        it('contains CPU usage and System memory usage chart data', async () => {
+          expect(chartsResponse.status).to.be(200);
+          expectSnapshot(chartsResponse.body.charts.map((chart) => chart.title)).toMatchInline(`
+            Array [
+              "CPU usage",
+              "System memory usage",
+            ]
+          `);
+        });
+
+        describe('CPU usage', () => {
+          let cpuUsageChart: GenericMetricsChart | undefined;
+          before(() => {
+            cpuUsageChart = chartsResponse.body.charts.find(({ key }) => key === 'cpu_usage_chart');
+          });
+
+          it('has correct series', () => {
+            expect(cpuUsageChart).to.not.empty();
+            expectSnapshot(cpuUsageChart?.series.map(({ title }) => title)).toMatchInline(`
+              Array [
+                "System max",
+                "System average",
+                "Process max",
+                "Process average",
+              ]
+            `);
+          });
+
+          it('has correct series overall values', () => {
+            expectSnapshot(cpuUsageChart?.series.map(({ overallValue }) => overallValue))
+              .toMatchInline(`
+              Array [
+                0.714,
+                0.38770000000000004,
+                0.75,
+                0.2543,
+              ]
+            `);
+          });
+        });
+
+        describe("System memory usage (using 'system.memory' fields to calculate the memory usage)", () => {
+          let systemMemoryUsageChart: GenericMetricsChart | undefined;
+          before(() => {
+            systemMemoryUsageChart = chartsResponse.body.charts.find(
+              ({ key }) => key === 'memory_usage_chart'
+            );
+          });
+
+          it('has correct series', () => {
+            expect(systemMemoryUsageChart).to.not.empty();
+            expectSnapshot(systemMemoryUsageChart?.series.map(({ title }) => title)).toMatchInline(`
+              Array [
+                "Max",
+                "Average",
+              ]
+            `);
+          });
+
+          it('has correct series overall values', () => {
+            expectSnapshot(systemMemoryUsageChart?.series.map(({ overallValue }) => overallValue))
+              .toMatchInline(`
+              Array [
+                0.7220939209255549,
+                0.7181735467963479,
+              ]
+            `);
+          });
+        });
+      });
+    });
+
+    describe('for opbeans-java', () => {
+      const uiFilters = encodeURIComponent(JSON.stringify({}));
+      const agentName = 'java';
+
+      describe('returns metrics data', () => {
+        const start = encodeURIComponent('2020-09-08T14:55:30.000Z');
+        const end = encodeURIComponent('2020-09-08T15:00:00.000Z');
+
+        let chartsResponse: ChartResponse;
+        before(async () => {
+          chartsResponse = await supertest.get(
+            `/api/apm/services/opbeans-java/metrics/charts?start=${start}&end=${end}&uiFilters=${uiFilters}&agentName=${agentName}`
+          );
+        });
+
+        it('has correct chart data', async () => {
+          expect(chartsResponse.status).to.be(200);
+          expectSnapshot(chartsResponse.body.charts.map((chart) => chart.title)).toMatchInline(`
+            Array [
+              "CPU usage",
+              "System memory usage",
+              "Heap Memory",
+              "Non-Heap Memory",
+              "Thread Count",
+              "Garbage collection per minute",
+              "Garbage collection time spent per minute",
+            ]
+          `);
+        });
+
+        describe('CPU usage', () => {
+          let cpuUsageChart: GenericMetricsChart | undefined;
+          before(() => {
+            cpuUsageChart = chartsResponse.body.charts.find(({ key }) => key === 'cpu_usage_chart');
+          });
+
+          it('has correct series', () => {
+            expect(cpuUsageChart).to.not.empty();
+            expectSnapshot(cpuUsageChart?.series.map(({ title }) => title)).toMatchInline(`
+              Array [
+                "System max",
+                "System average",
+                "Process max",
+                "Process average",
+              ]
+            `);
+          });
+
+          it('has correct series overall values', () => {
+            expectSnapshot(cpuUsageChart?.series.map(({ overallValue }) => overallValue))
+              .toMatchInline(`
+              Array [
+                0.203,
+                0.17877777777777779,
+                0.01,
+                0.009000000000000001,
+              ]
+            `);
+          });
+
+          it('has the correct rate', async () => {
+            const yValues = cpuUsageChart?.series.map((serie) => first(serie.data)?.y);
+            expectSnapshot(yValues).toMatchInline(`
+              Array [
+                0.193,
+                0.193,
+                0.009000000000000001,
+                0.009000000000000001,
+              ]
+            `);
+          });
+        });
+
+        describe("System memory usage (using 'system.process.cgroup' fields to calculate the memory usage)", () => {
+          let systemMemoryUsageChart: GenericMetricsChart | undefined;
+          before(() => {
+            systemMemoryUsageChart = chartsResponse.body.charts.find(
+              ({ key }) => key === 'memory_usage_chart'
+            );
+          });
+
+          it('has correct series', () => {
+            expect(systemMemoryUsageChart).to.not.empty();
+            expectSnapshot(systemMemoryUsageChart?.series.map(({ title }) => title)).toMatchInline(`
+              Array [
+                "Max",
+                "Average",
+              ]
+            `);
+          });
+
+          it('has correct series overall values', () => {
+            expectSnapshot(systemMemoryUsageChart?.series.map(({ overallValue }) => overallValue))
+              .toMatchInline(`
+              Array [
+                0.7079247035578369,
+                0.7053959808411816,
+              ]
+            `);
+          });
+
+          it('has the correct rate', async () => {
+            const yValues = systemMemoryUsageChart?.series.map((serie) => first(serie.data)?.y);
+            expectSnapshot(yValues).toMatchInline(`
+              Array [
+                0.7079247035578369,
+                0.7079247035578369,
+              ]
+            `);
+          });
+        });
+
+        describe('Heap Memory', () => {
+          let cpuUsageChart: GenericMetricsChart | undefined;
+          before(() => {
+            cpuUsageChart = chartsResponse.body.charts.find(
+              ({ key }) => key === 'heap_memory_area_chart'
+            );
+          });
+
+          it('has correct series', () => {
+            expect(cpuUsageChart).to.not.empty();
+            expectSnapshot(cpuUsageChart?.series.map(({ title }) => title)).toMatchInline(`
+              Array [
+                "Avg. used",
+                "Avg. committed",
+                "Avg. limit",
+              ]
+            `);
+          });
+
+          it('has correct series overall values', () => {
+            expectSnapshot(cpuUsageChart?.series.map(({ overallValue }) => overallValue))
+              .toMatchInline(`
+              Array [
+                222501617.7777778,
+                374341632,
+                1560281088,
+              ]
+            `);
+          });
+
+          it('has the correct rate', async () => {
+            const yValues = cpuUsageChart?.series.map((serie) => first(serie.data)?.y);
+            expectSnapshot(yValues).toMatchInline(`
+              Array [
+                211472896,
+                374341632,
+                1560281088,
+              ]
+            `);
+          });
+        });
+
+        describe('Non-Heap Memory', () => {
+          let cpuUsageChart: GenericMetricsChart | undefined;
+          before(() => {
+            cpuUsageChart = chartsResponse.body.charts.find(
+              ({ key }) => key === 'non_heap_memory_area_chart'
+            );
+          });
+
+          it('has correct series', () => {
+            expect(cpuUsageChart).to.not.empty();
+            expectSnapshot(cpuUsageChart?.series.map(({ title }) => title)).toMatchInline(`
+              Array [
+                "Avg. used",
+                "Avg. committed",
+              ]
+            `);
+          });
+
+          it('has correct series overall values', () => {
+            expectSnapshot(cpuUsageChart?.series.map(({ overallValue }) => overallValue))
+              .toMatchInline(`
+              Array [
+                138573397.33333334,
+                147677639.1111111,
+              ]
+            `);
+          });
+
+          it('has the correct rate', async () => {
+            const yValues = cpuUsageChart?.series.map((serie) => first(serie.data)?.y);
+            expectSnapshot(yValues).toMatchInline(`
+              Array [
+                138162752,
+                147386368,
+              ]
+            `);
+          });
+        });
+
+        describe('Thread Count', () => {
+          let cpuUsageChart: GenericMetricsChart | undefined;
+          before(() => {
+            cpuUsageChart = chartsResponse.body.charts.find(
+              ({ key }) => key === 'thread_count_line_chart'
+            );
+          });
+
+          it('has correct series', () => {
+            expect(cpuUsageChart).to.not.empty();
+            expectSnapshot(cpuUsageChart?.series.map(({ title }) => title)).toMatchInline(`
+              Array [
+                "Avg. count",
+                "Max count",
+              ]
+            `);
+          });
+
+          it('has correct series overall values', () => {
+            expectSnapshot(cpuUsageChart?.series.map(({ overallValue }) => overallValue))
+              .toMatchInline(`
+              Array [
+                44.44444444444444,
+                45,
+              ]
+            `);
+          });
+
+          it('has the correct rate', async () => {
+            const yValues = cpuUsageChart?.series.map((serie) => first(serie.data)?.y);
+            expectSnapshot(yValues).toMatchInline(`
+              Array [
+                44,
+                44,
+              ]
+            `);
+          });
+        });
+
+        describe('Garbage collection per minute', () => {
+          let cpuUsageChart: GenericMetricsChart | undefined;
+          before(() => {
+            cpuUsageChart = chartsResponse.body.charts.find(
+              ({ key }) => key === 'gc_rate_line_chart'
+            );
+          });
+
+          it('has correct series', () => {
+            expect(cpuUsageChart).to.not.empty();
+            expectSnapshot(cpuUsageChart?.series.map(({ title }) => title)).toMatchInline(`
+              Array [
+                "G1 Old Generation",
+                "G1 Young Generation",
+              ]
+            `);
+          });
+
+          it('has correct series overall values', () => {
+            expectSnapshot(cpuUsageChart?.series.map(({ overallValue }) => overallValue))
+              .toMatchInline(`
+              Array [
+                0,
+                15,
+              ]
+            `);
+          });
+        });
+
+        describe('Garbage collection time spent per minute', () => {
+          let cpuUsageChart: GenericMetricsChart | undefined;
+          before(() => {
+            cpuUsageChart = chartsResponse.body.charts.find(
+              ({ key }) => key === 'gc_time_line_chart'
+            );
+          });
+
+          it('has correct series', () => {
+            expect(cpuUsageChart).to.not.empty();
+            expectSnapshot(cpuUsageChart?.series.map(({ title }) => title)).toMatchInline(`
+              Array [
+                "G1 Old Generation",
+                "G1 Young Generation",
+              ]
+            `);
+          });
+
+          it('has correct series overall values', () => {
+            expectSnapshot(cpuUsageChart?.series.map(({ overallValue }) => overallValue))
+              .toMatchInline(`
+              Array [
+                0,
+                187.5,
+              ]
+            `);
+          });
+        });
+      });
+
+      // 9223372036854771712 = memory limit for a c-group when no memory limit is specified
+      it('calculates system memory usage using system total field when cgroup limit is equal to 9223372036854771712', async () => {
+        const start = encodeURIComponent('2020-09-08T15:00:30.000Z');
+        const end = encodeURIComponent('2020-09-08T15:05:00.000Z');
+
+        const chartsResponse: ChartResponse = await supertest.get(
+          `/api/apm/services/opbeans-java/metrics/charts?start=${start}&end=${end}&uiFilters=${uiFilters}&agentName=${agentName}`
+        );
+
+        const systemMemoryUsageChart = chartsResponse.body.charts.find(
+          ({ key }) => key === 'memory_usage_chart'
+        );
+
+        expect(systemMemoryUsageChart).to.not.empty();
+        expectSnapshot(systemMemoryUsageChart?.series.map(({ title }) => title)).toMatchInline(`
+          Array [
+            "Max",
+            "Average",
+          ]
+        `);
+        expectSnapshot(systemMemoryUsageChart?.series.map(({ overallValue }) => overallValue))
+          .toMatchInline(`
+          Array [
+            0.11452389642649889,
+            0.11400237609041514,
+          ]
+        `);
+
+        const yValues = systemMemoryUsageChart?.series.map((serie) => first(serie.data)?.y);
+        expectSnapshot(yValues).toMatchInline(`
+          Array [
+            0.11383724014063981,
+            0.11383724014063981,
+          ]
+        `);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/apm_api_integration/basic/tests/settings/custom_link.ts b/x-pack/test/apm_api_integration/basic/tests/settings/custom_link.ts
index a1c647a854bf6..60b4020e73dce 100644
--- a/x-pack/test/apm_api_integration/basic/tests/settings/custom_link.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/settings/custom_link.ts
@@ -3,75 +3,16 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import URL from 'url';
 import expect from '@kbn/expect';
+import { expectSnapshot } from '../../../common/match_snapshot';
 import { CustomLink } from '../../../../../plugins/apm/common/custom_link/custom_link_types';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 export default function customLinksTests({ getService }: FtrProviderContext) {
-  const supertestRead = getService('supertestAsApmReadUser');
   const supertestWrite = getService('supertestAsApmWriteUser');
-  const log = getService('log');
-  const esArchiver = getService('esArchiver');
-
-  const archiveName = 'apm_8.0.0';
-
-  function searchCustomLinks(filters?: any) {
-    const path = URL.format({
-      pathname: `/api/apm/settings/custom_links`,
-      query: filters,
-    });
-    return supertestRead.get(path).set('kbn-xsrf', 'foo');
-  }
-
-  async function createCustomLink(customLink: CustomLink) {
-    log.debug('creating configuration', customLink);
-    const res = await supertestWrite
-      .post(`/api/apm/settings/custom_links`)
-      .send(customLink)
-      .set('kbn-xsrf', 'foo');
-
-    throwOnError(res);
-
-    return res;
-  }
-
-  async function updateCustomLink(id: string, customLink: CustomLink) {
-    log.debug('updating configuration', id, customLink);
-    const res = await supertestWrite
-      .put(`/api/apm/settings/custom_links/${id}`)
-      .send(customLink)
-      .set('kbn-xsrf', 'foo');
-
-    throwOnError(res);
-
-    return res;
-  }
-
-  async function deleteCustomLink(id: string) {
-    log.debug('deleting configuration', id);
-    const res = await supertestWrite
-      .delete(`/api/apm/settings/custom_links/${id}`)
-      .set('kbn-xsrf', 'foo');
-
-    throwOnError(res);
-
-    return res;
-  }
-
-  function throwOnError(res: any) {
-    const { statusCode, req, body } = res;
-    if (statusCode !== 200) {
-      throw new Error(`
-      Endpoint: ${req.method} ${req.path}
-      Service: ${JSON.stringify(res.request._data.service)}
-      Status code: ${statusCode}
-      Response: ${body.message}`);
-    }
-  }
 
   describe('custom links', () => {
-    before(async () => {
+    it('is only be available to users with Gold license (or higher)', async () => {
       const customLink = {
         url: 'https://elastic.co',
         label: 'with filters',
@@ -80,80 +21,16 @@ export default function customLinksTests({ getService }: FtrProviderContext) {
           { key: 'transaction.type', value: 'qux' },
         ],
       } as CustomLink;
-      await createCustomLink(customLink);
-    });
-    it('fetches a custom link', async () => {
-      const { status, body } = await searchCustomLinks({
-        'service.name': 'baz',
-        'transaction.type': 'qux',
-      });
-      const { label, url, filters } = body[0];
-
-      expect(status).to.equal(200);
-      expect({ label, url, filters }).to.eql({
-        label: 'with filters',
-        url: 'https://elastic.co',
-        filters: [
-          { key: 'service.name', value: 'baz' },
-          { key: 'transaction.type', value: 'qux' },
-        ],
-      });
-    });
-    it('updates a custom link', async () => {
-      let { status, body } = await searchCustomLinks({
-        'service.name': 'baz',
-        'transaction.type': 'qux',
-      });
-      expect(status).to.equal(200);
-      await updateCustomLink(body[0].id, {
-        label: 'foo',
-        url: 'https://elastic.co?service.name={{service.name}}',
-        filters: [
-          { key: 'service.name', value: 'quz' },
-          { key: 'transaction.name', value: 'bar' },
-        ],
-      });
-      ({ status, body } = await searchCustomLinks({
-        'service.name': 'quz',
-        'transaction.name': 'bar',
-      }));
-      const { label, url, filters } = body[0];
-      expect(status).to.equal(200);
-      expect({ label, url, filters }).to.eql({
-        label: 'foo',
-        url: 'https://elastic.co?service.name={{service.name}}',
-        filters: [
-          { key: 'service.name', value: 'quz' },
-          { key: 'transaction.name', value: 'bar' },
-        ],
-      });
-    });
-    it('deletes a custom link', async () => {
-      let { status, body } = await searchCustomLinks({
-        'service.name': 'quz',
-        'transaction.name': 'bar',
-      });
-      expect(status).to.equal(200);
-      await deleteCustomLink(body[0].id);
-      ({ status, body } = await searchCustomLinks({
-        'service.name': 'quz',
-        'transaction.name': 'bar',
-      }));
-      expect(status).to.equal(200);
-      expect(body).to.eql([]);
-    });
+      const response = await supertestWrite
+        .post(`/api/apm/settings/custom_links`)
+        .send(customLink)
+        .set('kbn-xsrf', 'foo');
 
-    describe('transaction', () => {
-      before(() => esArchiver.load(archiveName));
-      after(() => esArchiver.unload(archiveName));
+      expect(response.status).to.be(403);
 
-      it('fetches a transaction sample', async () => {
-        const response = await supertestRead.get(
-          '/api/apm/settings/custom_links/transaction?service.name=opbeans-java'
-        );
-        expect(response.status).to.be(200);
-        expect(response.body.service.name).to.eql('opbeans-java');
-      });
+      expectSnapshot(response.body.message).toMatchInline(
+        `"To create custom links, you must be subscribed to an Elastic Gold license or above. With it, you'll have the ability to create custom links to improve your workflow when analyzing your services."`
+      );
     });
   });
 }
diff --git a/x-pack/test/apm_api_integration/basic/tests/traces/__snapshots__/top_traces.snap b/x-pack/test/apm_api_integration/basic/tests/traces/__snapshots__/top_traces.snap
index c5ee0b524f0d4..cd5773d18d6b7 100644
--- a/x-pack/test/apm_api_integration/basic/tests/traces/__snapshots__/top_traces.snap
+++ b/x-pack/test/apm_api_integration/basic/tests/traces/__snapshots__/top_traces.snap
@@ -9,6 +9,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "POST /api/orders",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "POST /api/orders",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -18,6 +21,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.stats",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.stats",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -27,6 +33,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/customers/:id",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/customers/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -36,6 +45,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/products/top",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/products/top",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -45,6 +57,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::OrdersController#show",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::OrdersController#show",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -54,6 +69,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/orders/:id",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/orders/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -63,6 +81,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::ProductsController#top",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::ProductsController#top",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -72,6 +93,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/products",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/products",
+    "transactionType": "request",
     "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
@@ -81,6 +105,9 @@ Array [
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#customers",
     },
+    "serviceName": "opbeans-java",
+    "transactionName": "APIRestController#customers",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -90,6 +117,9 @@ Array [
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#product",
     },
+    "serviceName": "opbeans-java",
+    "transactionName": "APIRestController#product",
+    "transactionType": "request",
     "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
@@ -99,6 +129,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/stats",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/stats",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -108,6 +141,9 @@ Array [
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#topProducts",
     },
+    "serviceName": "opbeans-java",
+    "transactionName": "APIRestController#topProducts",
+    "transactionType": "request",
     "transactionsPerMinute": 0.1,
   },
   Object {
@@ -117,6 +153,9 @@ Array [
       "service.name": "opbeans-java",
       "transaction.name": "ResourceHttpRequestHandler",
     },
+    "serviceName": "opbeans-java",
+    "transactionName": "ResourceHttpRequestHandler",
+    "transactionType": "request",
     "transactionsPerMinute": 0.26666666666666666,
   },
   Object {
@@ -126,6 +165,9 @@ Array [
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#customerWhoBought",
     },
+    "serviceName": "opbeans-java",
+    "transactionName": "APIRestController#customerWhoBought",
+    "transactionType": "request",
     "transactionsPerMinute": 0.1,
   },
   Object {
@@ -135,6 +177,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/types",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/types",
+    "transactionType": "request",
     "transactionsPerMinute": 0.1,
   },
   Object {
@@ -144,6 +189,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/products/:id/customers",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/products/:id/customers",
+    "transactionType": "request",
     "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
@@ -153,6 +201,9 @@ Array [
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#order",
     },
+    "serviceName": "opbeans-java",
+    "transactionName": "APIRestController#order",
+    "transactionType": "request",
     "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
@@ -162,6 +213,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::TypesController#index",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::TypesController#index",
+    "transactionType": "request",
     "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
@@ -171,6 +225,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.customer",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.customer",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -180,6 +237,9 @@ Array [
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/customers/:id",
     },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/customers/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
@@ -189,6 +249,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/types/:id",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/types/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.1,
   },
   Object {
@@ -198,6 +261,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/customers",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/customers",
+    "transactionType": "request",
     "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
@@ -207,6 +273,9 @@ Array [
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#customer",
     },
+    "serviceName": "opbeans-java",
+    "transactionName": "APIRestController#customer",
+    "transactionType": "request",
     "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
@@ -216,6 +285,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.customers",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.customers",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -225,6 +297,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.products",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.products",
+    "transactionType": "request",
     "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
@@ -234,6 +309,9 @@ Array [
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/types/:id",
     },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/types/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.43333333333333335,
   },
   Object {
@@ -243,6 +321,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::StatsController#index",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::StatsController#index",
+    "transactionType": "request",
     "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
@@ -252,6 +333,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::ProductsController#show",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::ProductsController#show",
+    "transactionType": "request",
     "transactionsPerMinute": 0.1,
   },
   Object {
@@ -261,6 +345,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::TypesController#show",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::TypesController#show",
+    "transactionType": "request",
     "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
@@ -270,6 +357,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.orders",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.orders",
+    "transactionType": "request",
     "transactionsPerMinute": 0.1,
   },
   Object {
@@ -279,6 +369,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.product_type",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.product_type",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -288,6 +381,9 @@ Array [
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/orders/:id",
     },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/orders/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.23333333333333334,
   },
   Object {
@@ -297,6 +393,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::OrdersController#index",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::OrdersController#index",
+    "transactionType": "request",
     "transactionsPerMinute": 0.1,
   },
   Object {
@@ -306,6 +405,9 @@ Array [
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/customers",
     },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/customers",
+    "transactionType": "request",
     "transactionsPerMinute": 0.23333333333333334,
   },
   Object {
@@ -315,6 +417,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.product",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.product",
+    "transactionType": "request",
     "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
@@ -324,6 +429,9 @@ Array [
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/types",
     },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/types",
+    "transactionType": "request",
     "transactionsPerMinute": 0.3,
   },
   Object {
@@ -333,6 +441,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.top_products",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.top_products",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -342,6 +453,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::CustomersController#index",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::CustomersController#index",
+    "transactionType": "request",
     "transactionsPerMinute": 0.26666666666666666,
   },
   Object {
@@ -351,6 +465,9 @@ Array [
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/products",
     },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/products",
+    "transactionType": "request",
     "transactionsPerMinute": 0.2,
   },
   Object {
@@ -360,6 +477,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::ProductsController#index",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::ProductsController#index",
+    "transactionType": "request",
     "transactionsPerMinute": 0.26666666666666666,
   },
   Object {
@@ -369,6 +489,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::CustomersController#show",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::CustomersController#show",
+    "transactionType": "request",
     "transactionsPerMinute": 0.3,
   },
   Object {
@@ -378,6 +501,9 @@ Array [
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/stats",
     },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/stats",
+    "transactionType": "request",
     "transactionsPerMinute": 0.23333333333333334,
   },
   Object {
@@ -387,6 +513,9 @@ Array [
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/products/:id/customers",
     },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/products/:id/customers",
+    "transactionType": "request",
     "transactionsPerMinute": 0.43333333333333335,
   },
   Object {
@@ -396,6 +525,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "GET /api",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api",
+    "transactionType": "request",
     "transactionsPerMinute": 0.4666666666666667,
   },
   Object {
@@ -405,6 +537,9 @@ Array [
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/products/:id",
     },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/products/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.5333333333333333,
   },
   Object {
@@ -414,6 +549,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.product_customers",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.product_customers",
+    "transactionType": "request",
     "transactionsPerMinute": 0.2,
   },
   Object {
@@ -423,6 +561,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "opbeans.tasks.sync_orders",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "opbeans.tasks.sync_orders",
+    "transactionType": "celery",
     "transactionsPerMinute": 2,
   },
   Object {
@@ -432,6 +573,9 @@ Array [
       "service.name": "opbeans-java",
       "transaction.name": "DispatcherServlet#doGet",
     },
+    "serviceName": "opbeans-java",
+    "transactionName": "DispatcherServlet#doGet",
+    "transactionType": "request",
     "transactionsPerMinute": 0.3,
   },
   Object {
@@ -441,6 +585,9 @@ Array [
       "service.name": "opbeans-rum",
       "transaction.name": "/customers",
     },
+    "serviceName": "opbeans-rum",
+    "transactionName": "/customers",
+    "transactionType": "page-load",
     "transactionsPerMinute": 0.36666666666666664,
   },
   Object {
@@ -450,6 +597,9 @@ Array [
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/orders",
     },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/orders",
+    "transactionType": "request",
     "transactionsPerMinute": 0.26666666666666666,
   },
   Object {
@@ -459,6 +609,9 @@ Array [
       "service.name": "opbeans-ruby",
       "transaction.name": "Rack",
     },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Rack",
+    "transactionType": "request",
     "transactionsPerMinute": 1.4333333333333333,
   },
   Object {
@@ -468,6 +621,9 @@ Array [
       "service.name": "opbeans-rum",
       "transaction.name": "/products",
     },
+    "serviceName": "opbeans-rum",
+    "transactionName": "/products",
+    "transactionType": "page-load",
     "transactionsPerMinute": 0.5,
   },
   Object {
@@ -477,6 +633,9 @@ Array [
       "service.name": "opbeans-rum",
       "transaction.name": "/dashboard",
     },
+    "serviceName": "opbeans-rum",
+    "transactionName": "/dashboard",
+    "transactionType": "page-load",
     "transactionsPerMinute": 0.9333333333333333,
   },
   Object {
@@ -486,6 +645,9 @@ Array [
       "service.name": "opbeans-rum",
       "transaction.name": "/orders",
     },
+    "serviceName": "opbeans-rum",
+    "transactionName": "/orders",
+    "transactionType": "page-load",
     "transactionsPerMinute": 0.4666666666666667,
   },
   Object {
@@ -495,6 +657,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "Process completed order",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "Process completed order",
+    "transactionType": "Worker",
     "transactionsPerMinute": 1.5333333333333334,
   },
   Object {
@@ -504,6 +669,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "Process payment",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "Process payment",
+    "transactionType": "Worker",
     "transactionsPerMinute": 1.4333333333333333,
   },
   Object {
@@ -513,6 +681,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "opbeans.tasks.update_stats",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "opbeans.tasks.update_stats",
+    "transactionType": "celery",
     "transactionsPerMinute": 12,
   },
   Object {
@@ -522,6 +693,9 @@ Array [
       "service.name": "opbeans-node",
       "transaction.name": "Update shipping status",
     },
+    "serviceName": "opbeans-node",
+    "transactionName": "Update shipping status",
+    "transactionType": "Worker",
     "transactionsPerMinute": 1.5,
   },
   Object {
@@ -531,6 +705,9 @@ Array [
       "service.name": "opbeans-python",
       "transaction.name": "opbeans.tasks.sync_customers",
     },
+    "serviceName": "opbeans-python",
+    "transactionName": "opbeans.tasks.sync_customers",
+    "transactionType": "celery",
     "transactionsPerMinute": 1.2,
   },
 ]
diff --git a/x-pack/test/apm_api_integration/basic/tests/traces/top_traces.ts b/x-pack/test/apm_api_integration/basic/tests/traces/top_traces.ts
index a63c007f96032..3429301e4a326 100644
--- a/x-pack/test/apm_api_integration/basic/tests/traces/top_traces.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/traces/top_traces.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import expect from '@kbn/expect';
-import { sortBy, omit } from 'lodash';
+import { sortBy } from 'lodash';
 import archives_metadata from '../../../common/archives_metadata';
 import { expectSnapshot } from '../../../common/match_snapshot';
 import { FtrProviderContext } from '../../../../common/ftr_provider_context';
@@ -53,17 +53,14 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       });
 
       it('returns the correct buckets', async () => {
-        const responseWithoutSamples = sortBy(
-          response.body.items.map((item: any) => omit(item, 'sample')),
-          'impact'
-        );
+        const sortedItems = sortBy(response.body.items, 'impact');
 
-        const firstItem = responseWithoutSamples[0];
-        const lastItem = responseWithoutSamples[responseWithoutSamples.length - 1];
+        const firstItem = sortedItems[0];
+        const lastItem = sortedItems[sortedItems.length - 1];
 
-        const groups = responseWithoutSamples.map((item) => item.key).slice(0, 5);
+        const groups = sortedItems.map((item) => item.key).slice(0, 5);
 
-        expectSnapshot(responseWithoutSamples).toMatch();
+        expectSnapshot(sortedItems).toMatch();
 
         expectSnapshot(firstItem).toMatchInline(`
           Object {
@@ -73,6 +70,9 @@ export default function ApiTest({ getService }: FtrProviderContext) {
               "service.name": "opbeans-node",
               "transaction.name": "POST /api/orders",
             },
+            "serviceName": "opbeans-node",
+            "transactionName": "POST /api/orders",
+            "transactionType": "request",
             "transactionsPerMinute": 0.03333333333333333,
           }
         `);
@@ -85,6 +85,9 @@ export default function ApiTest({ getService }: FtrProviderContext) {
               "service.name": "opbeans-python",
               "transaction.name": "opbeans.tasks.sync_customers",
             },
+            "serviceName": "opbeans-python",
+            "transactionName": "opbeans.tasks.sync_customers",
+            "transactionType": "celery",
             "transactionsPerMinute": 1.2,
           }
         `);
@@ -114,16 +117,6 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           ]
         `);
       });
-
-      it('returns a sample', async () => {
-        // sample should provide enough information to deeplink to a transaction detail page
-        response.body.items.forEach((item: any) => {
-          expect(item.sample.trace.id).to.be.an('string');
-          expect(item.sample.transaction.id).to.be.an('string');
-          expect(item.sample.service.name).to.be(item.key['service.name']);
-          expect(item.sample.transaction.name).to.be(item.key['transaction.name']);
-        });
-      });
     });
   });
 }
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/top_transaction_groups.snap b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/top_transaction_groups.snap
index a80f392a32aa3..e37b2283f009a 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/top_transaction_groups.snap
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/top_transaction_groups.snap
@@ -7,6 +7,9 @@ Array [
     "impact": 0,
     "key": "POST /api/orders",
     "p95": 1136,
+    "serviceName": "opbeans-node",
+    "transactionName": "POST /api/orders",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -14,6 +17,9 @@ Array [
     "impact": 0.1825278966745733,
     "key": "GET /api/customers/:id",
     "p95": 4448,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/customers/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
@@ -21,6 +27,9 @@ Array [
     "impact": 0.23878275411766442,
     "key": "GET /*",
     "p95": 2832,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /*",
+    "transactionType": "request",
     "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
@@ -28,6 +37,9 @@ Array [
     "impact": 1.122093248707094,
     "key": "GET /api/orders/:id",
     "p95": 13376,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/orders/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
@@ -35,6 +47,9 @@ Array [
     "impact": 1.6667276549425354,
     "key": "GET /api/products/top",
     "p95": 19552,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/products/top",
+    "transactionType": "request",
     "transactionsPerMinute": 0.1,
   },
   Object {
@@ -42,6 +57,9 @@ Array [
     "impact": 1.6843141249393074,
     "key": "GET /api/products/:id",
     "p95": 16000,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/products/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
@@ -49,6 +67,9 @@ Array [
     "impact": 2.013104650965918,
     "key": "GET /api/types",
     "p95": 14944,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/types",
+    "transactionType": "request",
     "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
@@ -56,6 +77,9 @@ Array [
     "impact": 2.6092969071297842,
     "key": "GET /api/products/:id/customers",
     "p95": 17760,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/products/:id/customers",
+    "transactionType": "request",
     "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
@@ -63,6 +87,9 @@ Array [
     "impact": 3.633626859892089,
     "key": "GET /api/customers",
     "p95": 25984,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/customers",
+    "transactionType": "request",
     "transactionsPerMinute": 0.1,
   },
   Object {
@@ -70,6 +97,9 @@ Array [
     "impact": 3.7207945807456553,
     "key": "GET /api/types/:id",
     "p95": 21984,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/types/:id",
+    "transactionType": "request",
     "transactionsPerMinute": 0.16666666666666666,
   },
   Object {
@@ -77,6 +107,9 @@ Array [
     "impact": 3.9451586141206243,
     "key": "GET /api/orders",
     "p95": 16736,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/orders",
+    "transactionType": "request",
     "transactionsPerMinute": 0.2,
   },
   Object {
@@ -84,6 +117,9 @@ Array [
     "impact": 4.71355627370009,
     "key": "GET /api/products",
     "p95": 30448,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/products",
+    "transactionType": "request",
     "transactionsPerMinute": 0.23333333333333334,
   },
   Object {
@@ -91,6 +127,9 @@ Array [
     "impact": 11.579379700079686,
     "key": "GET /api/stats",
     "p95": 36288,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/stats",
+    "transactionType": "request",
     "transactionsPerMinute": 0.3,
   },
   Object {
@@ -98,6 +137,9 @@ Array [
     "impact": 100,
     "key": "GET /api",
     "p95": 131008,
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api",
+    "transactionType": "request",
     "transactionsPerMinute": 1.4333333333333333,
   },
 ]
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/top_transaction_groups.ts b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/top_transaction_groups.ts
index 3154cea2626c0..c3ac1ed518652 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/top_transaction_groups.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/top_transaction_groups.ts
@@ -13,10 +13,6 @@ function sortTransactionGroups(items: any[]) {
   return sortBy(items, 'impact');
 }
 
-function omitSampleFromTransactionGroups(items: any[]) {
-  return sortTransactionGroups(items).map(({ sample, ...item }) => ({ ...item }));
-}
-
 export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
@@ -64,18 +60,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         expectSnapshot(response.body.items.length).toMatchInline(`14`);
       });
 
-      it('returns the correct buckets (when ignoring samples)', () => {
-        expectSnapshot(omitSampleFromTransactionGroups(response.body.items)).toMatch();
-      });
-
-      it('returns the correct buckets and samples', () => {
-        // sample should provide enough information to deeplink to a transaction detail page
-        response.body.items.forEach((item: any) => {
-          expect(item.sample.trace.id).to.be.an('string');
-          expect(item.sample.transaction.id).to.be.an('string');
-          expect(item.sample.service.name).to.be('opbeans-node');
-          expect(item.sample.transaction.name).to.be(item.key);
-        });
+      it('returns the correct buckets (when ignoring samples)', async () => {
+        expectSnapshot(sortTransactionGroups(response.body.items)).toMatch();
       });
     });
   });
diff --git a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/metrics_8.0.0/data.json.gz b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/metrics_8.0.0/data.json.gz
new file mode 100644
index 0000000000000..7b38da28496a5
Binary files /dev/null and b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/metrics_8.0.0/data.json.gz differ
diff --git a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/metrics_8.0.0/mappings.json b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/metrics_8.0.0/mappings.json
new file mode 100644
index 0000000000000..b3b3281be3cdb
--- /dev/null
+++ b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/metrics_8.0.0/mappings.json
@@ -0,0 +1,4092 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-metric": {
+        "is_write_index": true
+      }
+    },
+    "index": "apm-8.0.0-metric-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "golang": {
+          "properties": {
+            "goroutines": {
+              "type": "long"
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "active": {
+                      "type": "float"
+                    },
+                    "allocated": {
+                      "type": "float"
+                    },
+                    "frees": {
+                      "type": "long"
+                    },
+                    "idle": {
+                      "type": "float"
+                    },
+                    "mallocs": {
+                      "type": "long"
+                    },
+                    "objects": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "gc": {
+                  "properties": {
+                    "cpu_fraction": {
+                      "type": "float"
+                    },
+                    "next_gc_limit": {
+                      "type": "float"
+                    },
+                    "total_count": {
+                      "type": "long"
+                    },
+                    "total_pause": {
+                      "properties": {
+                        "ns": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                },
+                "system": {
+                  "properties": {
+                    "obtained": {
+                      "type": "float"
+                    },
+                    "released": {
+                      "type": "float"
+                    },
+                    "stack": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jvm": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "alloc": {
+                  "type": "float"
+                },
+                "count": {
+                  "type": "long"
+                },
+                "time": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "float"
+                    },
+                    "pool": {
+                      "properties": {
+                        "committed": {
+                          "type": "float"
+                        },
+                        "max": {
+                          "type": "long"
+                        },
+                        "used": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "non_heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "env": {
+              "type": "keyword"
+            },
+            "hostname": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "nodejs": {
+          "properties": {
+            "eventloop": {
+              "properties": {
+                "delay": {
+                  "properties": {
+                    "avg": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "ns": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "handles": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "arrayBuffers": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "external": {
+                  "properties": {
+                    "bytes": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "heap": {
+                  "properties": {
+                    "allocated": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "requests": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cgroup": {
+                  "properties": {
+                    "memory": {
+                      "properties": {
+                        "mem": {
+                          "properties": {
+                            "limit": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "long"
+                                }
+                              }
+                            },
+                            "usage": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "long"
+                                }
+                              }
+                            }
+                          }
+                        },
+                        "stats": {
+                          "properties": {
+                            "inactive_file": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "long"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "cpu": {
+                  "properties": {
+                    "system": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "user": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "experience": {
+              "properties": {
+                "cls": {
+                  "scaling_factor": 1000000,
+                  "type": "scaled_float"
+                },
+                "fid": {
+                  "scaling_factor": 1000000,
+                  "type": "scaled_float"
+                },
+                "tbt": {
+                  "scaling_factor": 1000000,
+                  "type": "scaled_float"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-metric"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "max_docvalue_fields_search": "200",
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "1ms"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/data.json.gz b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/data.json.gz
new file mode 100644
index 0000000000000..d23b9e51d734d
Binary files /dev/null and b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/data.json.gz differ
diff --git a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/mappings.json b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/mappings.json
new file mode 100644
index 0000000000000..5a5d48464b8b1
--- /dev/null
+++ b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/mappings.json
@@ -0,0 +1,63452 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".ml-annotations-read": {
+        "is_hidden": true
+      },
+      ".ml-annotations-write": {
+        "is_hidden": true
+      }
+    },
+    "index": ".ml-annotations-6",
+    "mappings": {
+      "_meta": {
+        "version": "8.0.0"
+      },
+      "properties": {
+        "annotation": {
+          "type": "text"
+        },
+        "by_field_name": {
+          "type": "keyword"
+        },
+        "by_field_value": {
+          "type": "keyword"
+        },
+        "create_time": {
+          "type": "date"
+        },
+        "create_username": {
+          "type": "keyword"
+        },
+        "detector_index": {
+          "type": "integer"
+        },
+        "end_timestamp": {
+          "type": "date"
+        },
+        "event": {
+          "type": "keyword"
+        },
+        "job_id": {
+          "type": "keyword"
+        },
+        "modified_time": {
+          "type": "date"
+        },
+        "modified_username": {
+          "type": "keyword"
+        },
+        "over_field_name": {
+          "type": "keyword"
+        },
+        "over_field_value": {
+          "type": "keyword"
+        },
+        "partition_field_name": {
+          "type": "keyword"
+        },
+        "partition_field_value": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "hidden": "true",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".ml-anomalies-.write-android_homepage_high_latency_by_geo": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-apm-environment_not_defined-7ed6-high_mean_transaction_duration": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-apm-production-229a-high_mean_transaction_duration": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-apm-testing-d457-high_mean_transaction_duration": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-auto_http_0x73c4bc9426fb6908_high_latency_by_geo": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-kibana-logs-ui-default-default-log-entry-categories-count": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-kibana-logs-ui-default-default-log-entry-rate": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-android_homepage_high_latency_by_geo": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "android_homepage_high_latency_by_geo"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-apm-environment_not_defined-7ed6-high_mean_transaction_duration": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "apm-environment_not_defined-7ed6-high_mean_transaction_duration"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-apm-production-229a-high_mean_transaction_duration": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "apm-production-229a-high_mean_transaction_duration"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-apm-testing-d457-high_mean_transaction_duration": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "apm-testing-d457-high_mean_transaction_duration"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-auto_http_0x73c4bc9426fb6908_high_latency_by_geo": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "auto_http_0x73c4bc9426fb6908_high_latency_by_geo"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-kibana-logs-ui-default-default-log-entry-categories-count": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "kibana-logs-ui-default-default-log-entry-categories-count"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-kibana-logs-ui-default-default-log-entry-rate": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "kibana-logs-ui-default-default-log-entry-rate"
+            }
+          }
+        },
+        "is_hidden": true
+      }
+    },
+    "index": ".ml-anomalies-shared",
+    "mappings": {
+      "_meta": {
+        "version": "8.0.0"
+      },
+      "dynamic_templates": [
+        {
+          "strings_as_keywords": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match": "*"
+          }
+        }
+      ],
+      "properties": {
+        "actual": {
+          "type": "double"
+        },
+        "all_field_values": {
+          "analyzer": "whitespace",
+          "type": "text"
+        },
+        "anomaly_score": {
+          "type": "double"
+        },
+        "average_bucket_processing_time_ms": {
+          "type": "double"
+        },
+        "bucket_allocation_failures_count": {
+          "type": "long"
+        },
+        "bucket_count": {
+          "type": "long"
+        },
+        "bucket_influencers": {
+          "properties": {
+            "anomaly_score": {
+              "type": "double"
+            },
+            "bucket_span": {
+              "type": "long"
+            },
+            "influencer_field_name": {
+              "type": "keyword"
+            },
+            "initial_anomaly_score": {
+              "type": "double"
+            },
+            "is_interim": {
+              "type": "boolean"
+            },
+            "job_id": {
+              "type": "keyword"
+            },
+            "probability": {
+              "type": "double"
+            },
+            "raw_anomaly_score": {
+              "type": "double"
+            },
+            "result_type": {
+              "type": "keyword"
+            },
+            "timestamp": {
+              "type": "date"
+            }
+          },
+          "type": "nested"
+        },
+        "bucket_span": {
+          "type": "long"
+        },
+        "by_field_name": {
+          "type": "keyword"
+        },
+        "by_field_value": {
+          "copy_to": [
+            "all_field_values"
+          ],
+          "type": "keyword"
+        },
+        "categorization_status": {
+          "type": "keyword"
+        },
+        "categorized_doc_count": {
+          "type": "keyword"
+        },
+        "category_id": {
+          "type": "long"
+        },
+        "causes": {
+          "properties": {
+            "actual": {
+              "type": "double"
+            },
+            "by_field_name": {
+              "type": "keyword"
+            },
+            "by_field_value": {
+              "copy_to": [
+                "all_field_values"
+              ],
+              "type": "keyword"
+            },
+            "correlated_by_field_value": {
+              "copy_to": [
+                "all_field_values"
+              ],
+              "type": "keyword"
+            },
+            "field_name": {
+              "type": "keyword"
+            },
+            "function": {
+              "type": "keyword"
+            },
+            "function_description": {
+              "type": "keyword"
+            },
+            "geo_results": {
+              "properties": {
+                "actual_point": {
+                  "type": "geo_point"
+                },
+                "typical_point": {
+                  "type": "geo_point"
+                }
+              }
+            },
+            "over_field_name": {
+              "type": "keyword"
+            },
+            "over_field_value": {
+              "copy_to": [
+                "all_field_values"
+              ],
+              "type": "keyword"
+            },
+            "partition_field_name": {
+              "type": "keyword"
+            },
+            "partition_field_value": {
+              "copy_to": [
+                "all_field_values"
+              ],
+              "type": "keyword"
+            },
+            "probability": {
+              "type": "double"
+            },
+            "typical": {
+              "type": "double"
+            }
+          },
+          "type": "nested"
+        },
+        "dead_category_count": {
+          "type": "keyword"
+        },
+        "description": {
+          "type": "text"
+        },
+        "detector_index": {
+          "type": "integer"
+        },
+        "earliest_record_timestamp": {
+          "type": "date"
+        },
+        "empty_bucket_count": {
+          "type": "long"
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "keyword"
+            }
+          }
+        },
+        "event_count": {
+          "type": "long"
+        },
+        "examples": {
+          "type": "text"
+        },
+        "exponential_average_bucket_processing_time_ms": {
+          "type": "double"
+        },
+        "exponential_average_calculation_context": {
+          "properties": {
+            "incremental_metric_value_ms": {
+              "type": "double"
+            },
+            "latest_timestamp": {
+              "type": "date"
+            },
+            "previous_exponential_average_ms": {
+              "type": "double"
+            }
+          }
+        },
+        "failed_category_count": {
+          "type": "keyword"
+        },
+        "field_name": {
+          "type": "keyword"
+        },
+        "forecast_create_timestamp": {
+          "type": "date"
+        },
+        "forecast_end_timestamp": {
+          "type": "date"
+        },
+        "forecast_expiry_timestamp": {
+          "type": "date"
+        },
+        "forecast_id": {
+          "type": "keyword"
+        },
+        "forecast_lower": {
+          "type": "double"
+        },
+        "forecast_memory_bytes": {
+          "type": "long"
+        },
+        "forecast_messages": {
+          "type": "keyword"
+        },
+        "forecast_prediction": {
+          "type": "double"
+        },
+        "forecast_progress": {
+          "type": "double"
+        },
+        "forecast_start_timestamp": {
+          "type": "date"
+        },
+        "forecast_status": {
+          "type": "keyword"
+        },
+        "forecast_upper": {
+          "type": "double"
+        },
+        "frequent_category_count": {
+          "type": "keyword"
+        },
+        "function": {
+          "type": "keyword"
+        },
+        "function_description": {
+          "type": "keyword"
+        },
+        "geo_results": {
+          "properties": {
+            "actual_point": {
+              "type": "geo_point"
+            },
+            "typical_point": {
+              "type": "geo_point"
+            }
+          }
+        },
+        "influencer_field_name": {
+          "type": "keyword"
+        },
+        "influencer_field_value": {
+          "copy_to": [
+            "all_field_values"
+          ],
+          "type": "keyword"
+        },
+        "influencer_score": {
+          "type": "double"
+        },
+        "influencers": {
+          "properties": {
+            "influencer_field_name": {
+              "type": "keyword"
+            },
+            "influencer_field_values": {
+              "copy_to": [
+                "all_field_values"
+              ],
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "initial_anomaly_score": {
+          "type": "double"
+        },
+        "initial_influencer_score": {
+          "type": "double"
+        },
+        "initial_record_score": {
+          "type": "double"
+        },
+        "input_bytes": {
+          "type": "long"
+        },
+        "input_field_count": {
+          "type": "long"
+        },
+        "input_record_count": {
+          "type": "long"
+        },
+        "invalid_date_count": {
+          "type": "long"
+        },
+        "is_interim": {
+          "type": "boolean"
+        },
+        "job_id": {
+          "copy_to": [
+            "all_field_values"
+          ],
+          "type": "keyword"
+        },
+        "last_data_time": {
+          "type": "date"
+        },
+        "latest_empty_bucket_timestamp": {
+          "type": "date"
+        },
+        "latest_record_time_stamp": {
+          "type": "date"
+        },
+        "latest_record_timestamp": {
+          "type": "date"
+        },
+        "latest_result_time_stamp": {
+          "type": "date"
+        },
+        "latest_sparse_bucket_timestamp": {
+          "type": "date"
+        },
+        "log_time": {
+          "type": "date"
+        },
+        "max_matching_length": {
+          "type": "long"
+        },
+        "maximum_bucket_processing_time_ms": {
+          "type": "double"
+        },
+        "memory_status": {
+          "type": "keyword"
+        },
+        "min_version": {
+          "type": "keyword"
+        },
+        "minimum_bucket_processing_time_ms": {
+          "type": "double"
+        },
+        "missing_field_count": {
+          "type": "long"
+        },
+        "mlcategory": {
+          "type": "keyword"
+        },
+        "model_bytes": {
+          "type": "long"
+        },
+        "model_bytes_exceeded": {
+          "type": "keyword"
+        },
+        "model_bytes_memory_limit": {
+          "type": "keyword"
+        },
+        "model_feature": {
+          "type": "keyword"
+        },
+        "model_lower": {
+          "type": "double"
+        },
+        "model_median": {
+          "type": "double"
+        },
+        "model_size_stats": {
+          "properties": {
+            "bucket_allocation_failures_count": {
+              "type": "long"
+            },
+            "categorization_status": {
+              "type": "keyword"
+            },
+            "categorized_doc_count": {
+              "type": "keyword"
+            },
+            "dead_category_count": {
+              "type": "keyword"
+            },
+            "failed_category_count": {
+              "type": "keyword"
+            },
+            "frequent_category_count": {
+              "type": "keyword"
+            },
+            "job_id": {
+              "type": "keyword"
+            },
+            "log_time": {
+              "type": "date"
+            },
+            "memory_status": {
+              "type": "keyword"
+            },
+            "model_bytes": {
+              "type": "long"
+            },
+            "model_bytes_exceeded": {
+              "type": "keyword"
+            },
+            "model_bytes_memory_limit": {
+              "type": "keyword"
+            },
+            "peak_model_bytes": {
+              "type": "long"
+            },
+            "rare_category_count": {
+              "type": "keyword"
+            },
+            "result_type": {
+              "type": "keyword"
+            },
+            "timestamp": {
+              "type": "date"
+            },
+            "total_by_field_count": {
+              "type": "long"
+            },
+            "total_category_count": {
+              "type": "keyword"
+            },
+            "total_over_field_count": {
+              "type": "long"
+            },
+            "total_partition_field_count": {
+              "type": "long"
+            }
+          }
+        },
+        "model_upper": {
+          "type": "double"
+        },
+        "monitor": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "multi_bucket_impact": {
+          "type": "double"
+        },
+        "num_matches": {
+          "type": "long"
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "name": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "out_of_order_timestamp_count": {
+          "type": "long"
+        },
+        "over_field_name": {
+          "type": "keyword"
+        },
+        "over_field_value": {
+          "copy_to": [
+            "all_field_values"
+          ],
+          "type": "keyword"
+        },
+        "partition_field_name": {
+          "type": "keyword"
+        },
+        "partition_field_value": {
+          "copy_to": [
+            "all_field_values"
+          ],
+          "type": "keyword"
+        },
+        "peak_model_bytes": {
+          "type": "keyword"
+        },
+        "preferred_to_categories": {
+          "type": "long"
+        },
+        "probability": {
+          "type": "double"
+        },
+        "processed_field_count": {
+          "type": "long"
+        },
+        "processed_record_count": {
+          "type": "long"
+        },
+        "processing_time_ms": {
+          "type": "long"
+        },
+        "quantiles": {
+          "enabled": false,
+          "type": "object"
+        },
+        "rare_category_count": {
+          "type": "keyword"
+        },
+        "raw_anomaly_score": {
+          "type": "double"
+        },
+        "record_score": {
+          "type": "double"
+        },
+        "regex": {
+          "type": "keyword"
+        },
+        "result_type": {
+          "type": "keyword"
+        },
+        "retain": {
+          "type": "boolean"
+        },
+        "scheduled_events": {
+          "type": "keyword"
+        },
+        "search_count": {
+          "type": "long"
+        },
+        "service": {
+          "properties": {
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "snapshot_doc_count": {
+          "type": "integer"
+        },
+        "snapshot_id": {
+          "type": "keyword"
+        },
+        "sparse_bucket_count": {
+          "type": "long"
+        },
+        "terms": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "total_by_field_count": {
+          "type": "long"
+        },
+        "total_category_count": {
+          "type": "keyword"
+        },
+        "total_over_field_count": {
+          "type": "long"
+        },
+        "total_partition_field_count": {
+          "type": "long"
+        },
+        "total_search_time_ms": {
+          "type": "double"
+        },
+        "transaction": {
+          "properties": {
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "typical": {
+          "type": "double"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "hidden": "true",
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "translog": {
+          "durability": "async"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": ".ml-config",
+    "mappings": {
+      "_meta": {
+        "version": "8.0.0"
+      },
+      "dynamic_templates": [
+        {
+          "strings_as_keywords": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match": "*"
+          }
+        }
+      ],
+      "properties": {
+        "aggregations": {
+          "enabled": false,
+          "type": "object"
+        },
+        "allow_lazy_open": {
+          "type": "keyword"
+        },
+        "analysis": {
+          "properties": {
+            "classification": {
+              "properties": {
+                "class_assignment_objective": {
+                  "type": "keyword"
+                },
+                "dependent_variable": {
+                  "type": "keyword"
+                },
+                "eta": {
+                  "type": "double"
+                },
+                "feature_bag_fraction": {
+                  "type": "double"
+                },
+                "gamma": {
+                  "type": "double"
+                },
+                "lambda": {
+                  "type": "double"
+                },
+                "max_trees": {
+                  "type": "integer"
+                },
+                "num_top_classes": {
+                  "type": "integer"
+                },
+                "num_top_feature_importance_values": {
+                  "type": "integer"
+                },
+                "prediction_field_name": {
+                  "type": "keyword"
+                },
+                "training_percent": {
+                  "type": "double"
+                }
+              }
+            },
+            "outlier_detection": {
+              "properties": {
+                "feature_influence_threshold": {
+                  "type": "double"
+                },
+                "method": {
+                  "type": "keyword"
+                },
+                "n_neighbors": {
+                  "type": "integer"
+                }
+              }
+            },
+            "regression": {
+              "properties": {
+                "dependent_variable": {
+                  "type": "keyword"
+                },
+                "eta": {
+                  "type": "double"
+                },
+                "feature_bag_fraction": {
+                  "type": "double"
+                },
+                "gamma": {
+                  "type": "double"
+                },
+                "lambda": {
+                  "type": "double"
+                },
+                "loss_function": {
+                  "type": "keyword"
+                },
+                "loss_function_parameter": {
+                  "type": "double"
+                },
+                "max_trees": {
+                  "type": "integer"
+                },
+                "num_top_feature_importance_values": {
+                  "type": "integer"
+                },
+                "prediction_field_name": {
+                  "type": "keyword"
+                },
+                "training_percent": {
+                  "type": "double"
+                }
+              }
+            }
+          }
+        },
+        "analysis_config": {
+          "properties": {
+            "bucket_span": {
+              "type": "keyword"
+            },
+            "categorization_analyzer": {
+              "enabled": false,
+              "type": "object"
+            },
+            "categorization_field_name": {
+              "type": "keyword"
+            },
+            "categorization_filters": {
+              "type": "keyword"
+            },
+            "detectors": {
+              "properties": {
+                "by_field_name": {
+                  "type": "keyword"
+                },
+                "custom_rules": {
+                  "properties": {
+                    "actions": {
+                      "type": "keyword"
+                    },
+                    "conditions": {
+                      "properties": {
+                        "applies_to": {
+                          "type": "keyword"
+                        },
+                        "operator": {
+                          "type": "keyword"
+                        },
+                        "value": {
+                          "type": "double"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "scope": {
+                      "enabled": false,
+                      "type": "object"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "detector_description": {
+                  "type": "text"
+                },
+                "detector_index": {
+                  "type": "integer"
+                },
+                "exclude_frequent": {
+                  "type": "keyword"
+                },
+                "field_name": {
+                  "type": "keyword"
+                },
+                "function": {
+                  "type": "keyword"
+                },
+                "over_field_name": {
+                  "type": "keyword"
+                },
+                "partition_field_name": {
+                  "type": "keyword"
+                },
+                "use_null": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "influencers": {
+              "type": "keyword"
+            },
+            "latency": {
+              "type": "keyword"
+            },
+            "multivariate_by_fields": {
+              "type": "boolean"
+            },
+            "per_partition_categorization": {
+              "properties": {
+                "enabled": {
+                  "type": "boolean"
+                },
+                "stop_on_warn": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "summary_count_field_name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "analysis_limits": {
+          "properties": {
+            "categorization_examples_limit": {
+              "type": "long"
+            },
+            "model_memory_limit": {
+              "type": "keyword"
+            }
+          }
+        },
+        "analyzed_fields": {
+          "enabled": false,
+          "type": "object"
+        },
+        "background_persist_interval": {
+          "type": "keyword"
+        },
+        "chunking_config": {
+          "properties": {
+            "mode": {
+              "type": "keyword"
+            },
+            "time_span": {
+              "type": "keyword"
+            }
+          }
+        },
+        "config_type": {
+          "type": "keyword"
+        },
+        "create_time": {
+          "type": "date"
+        },
+        "custom_settings": {
+          "enabled": false,
+          "type": "object"
+        },
+        "daily_model_snapshot_retention_after_days": {
+          "type": "long"
+        },
+        "data_description": {
+          "properties": {
+            "field_delimiter": {
+              "type": "keyword"
+            },
+            "format": {
+              "type": "keyword"
+            },
+            "quote_character": {
+              "type": "keyword"
+            },
+            "time_field": {
+              "type": "keyword"
+            },
+            "time_format": {
+              "type": "keyword"
+            }
+          }
+        },
+        "datafeed_id": {
+          "type": "keyword"
+        },
+        "delayed_data_check_config": {
+          "properties": {
+            "check_window": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        },
+        "deleting": {
+          "type": "keyword"
+        },
+        "description": {
+          "type": "text"
+        },
+        "dest": {
+          "properties": {
+            "index": {
+              "type": "keyword"
+            },
+            "results_field": {
+              "type": "keyword"
+            }
+          }
+        },
+        "finished_time": {
+          "type": "date"
+        },
+        "frequency": {
+          "type": "keyword"
+        },
+        "groups": {
+          "type": "keyword"
+        },
+        "headers": {
+          "enabled": false,
+          "type": "object"
+        },
+        "id": {
+          "type": "keyword"
+        },
+        "indices": {
+          "type": "keyword"
+        },
+        "indices_options": {
+          "enabled": false,
+          "type": "object"
+        },
+        "job_id": {
+          "type": "keyword"
+        },
+        "job_type": {
+          "type": "keyword"
+        },
+        "job_version": {
+          "type": "keyword"
+        },
+        "max_empty_searches": {
+          "type": "keyword"
+        },
+        "max_num_threads": {
+          "type": "integer"
+        },
+        "model_plot_config": {
+          "properties": {
+            "annotations_enabled": {
+              "type": "boolean"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "terms": {
+              "type": "keyword"
+            }
+          }
+        },
+        "model_snapshot_id": {
+          "type": "keyword"
+        },
+        "model_snapshot_min_version": {
+          "type": "keyword"
+        },
+        "model_snapshot_retention_days": {
+          "type": "long"
+        },
+        "query": {
+          "enabled": false,
+          "type": "object"
+        },
+        "query_delay": {
+          "type": "keyword"
+        },
+        "renormalization_window_days": {
+          "type": "long"
+        },
+        "results_index_name": {
+          "type": "keyword"
+        },
+        "results_retention_days": {
+          "type": "long"
+        },
+        "script_fields": {
+          "enabled": false,
+          "type": "object"
+        },
+        "scroll_size": {
+          "type": "long"
+        },
+        "source": {
+          "properties": {
+            "_source": {
+              "enabled": false,
+              "type": "object"
+            },
+            "index": {
+              "type": "keyword"
+            },
+            "query": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "version": {
+          "type": "keyword"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "max_result_window": "10000",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".ml-state-write": {
+        "is_hidden": true
+      }
+    },
+    "index": ".ml-state-000001",
+    "mappings": {
+      "_meta": {
+        "version": "8000099"
+      },
+      "enabled": false
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "hidden": "true",
+        "lifecycle": {
+          "name": "ml-size-based-ilm-policy",
+          "rollover_alias": ".ml-state-write"
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-error": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-error-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-error"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-error": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-error-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-error"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-error": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-error-2020.07.31-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-error"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-error": {
+        "is_write_index": true
+      }
+    },
+    "index": "apm-8.0.0-error-2020.07.31-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-error"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-metric": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-metric-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "golang": {
+          "properties": {
+            "goroutines": {
+              "type": "long"
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "active": {
+                      "type": "float"
+                    },
+                    "allocated": {
+                      "type": "float"
+                    },
+                    "frees": {
+                      "type": "float"
+                    },
+                    "idle": {
+                      "type": "float"
+                    },
+                    "mallocs": {
+                      "type": "float"
+                    },
+                    "objects": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "gc": {
+                  "properties": {
+                    "cpu_fraction": {
+                      "type": "float"
+                    },
+                    "next_gc_limit": {
+                      "type": "float"
+                    },
+                    "total_count": {
+                      "type": "long"
+                    },
+                    "total_pause": {
+                      "properties": {
+                        "ns": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                },
+                "system": {
+                  "properties": {
+                    "obtained": {
+                      "type": "float"
+                    },
+                    "released": {
+                      "type": "float"
+                    },
+                    "stack": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jvm": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "alloc": {
+                  "type": "float"
+                },
+                "count": {
+                  "type": "long"
+                },
+                "time": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "float"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "non_heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "env": {
+              "type": "keyword"
+            },
+            "hostname": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "nodejs": {
+          "properties": {
+            "eventloop": {
+              "properties": {
+                "delay": {
+                  "properties": {
+                    "avg": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "ns": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "handles": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "allocated": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "requests": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ruby": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "slots": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    },
+                    "live": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "threads": {
+              "type": "long"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "system": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "user": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-metric"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-metric": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-metric-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "golang": {
+          "properties": {
+            "goroutines": {
+              "type": "long"
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "active": {
+                      "type": "float"
+                    },
+                    "allocated": {
+                      "type": "float"
+                    },
+                    "frees": {
+                      "type": "long"
+                    },
+                    "idle": {
+                      "type": "float"
+                    },
+                    "mallocs": {
+                      "type": "long"
+                    },
+                    "objects": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "gc": {
+                  "properties": {
+                    "cpu_fraction": {
+                      "type": "float"
+                    },
+                    "next_gc_limit": {
+                      "type": "float"
+                    },
+                    "total_count": {
+                      "type": "long"
+                    },
+                    "total_pause": {
+                      "properties": {
+                        "ns": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                },
+                "system": {
+                  "properties": {
+                    "obtained": {
+                      "type": "float"
+                    },
+                    "released": {
+                      "type": "float"
+                    },
+                    "stack": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jvm": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "alloc": {
+                  "type": "float"
+                },
+                "count": {
+                  "type": "long"
+                },
+                "time": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "float"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "non_heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "env": {
+              "type": "keyword"
+            },
+            "hostname": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "nodejs": {
+          "properties": {
+            "eventloop": {
+              "properties": {
+                "delay": {
+                  "properties": {
+                    "avg": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "ns": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "handles": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "arrayBuffers": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "external": {
+                  "properties": {
+                    "bytes": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "heap": {
+                  "properties": {
+                    "allocated": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "requests": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ruby": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "slots": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    },
+                    "live": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "threads": {
+              "type": "long"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "system": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "user": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-metric"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-metric": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-metric-2020.07.31-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "clr": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "gen0size": {
+                  "type": "float"
+                },
+                "gen1size": {
+                  "type": "float"
+                },
+                "gen2size": {
+                  "type": "float"
+                },
+                "gen3size": {
+                  "type": "float"
+                }
+              }
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "golang": {
+          "properties": {
+            "goroutines": {
+              "type": "long"
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "active": {
+                      "type": "float"
+                    },
+                    "allocated": {
+                      "type": "float"
+                    },
+                    "frees": {
+                      "type": "long"
+                    },
+                    "idle": {
+                      "type": "float"
+                    },
+                    "mallocs": {
+                      "type": "long"
+                    },
+                    "objects": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "gc": {
+                  "properties": {
+                    "cpu_fraction": {
+                      "type": "float"
+                    },
+                    "next_gc_limit": {
+                      "type": "float"
+                    },
+                    "total_count": {
+                      "type": "long"
+                    },
+                    "total_pause": {
+                      "properties": {
+                        "ns": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "system": {
+                  "properties": {
+                    "obtained": {
+                      "type": "float"
+                    },
+                    "released": {
+                      "type": "float"
+                    },
+                    "stack": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jvm": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "alloc": {
+                  "type": "float"
+                },
+                "count": {
+                  "type": "long"
+                },
+                "time": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "float"
+                    },
+                    "pool": {
+                      "properties": {
+                        "committed": {
+                          "type": "float"
+                        },
+                        "max": {
+                          "type": "float"
+                        },
+                        "used": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "non_heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "env": {
+              "type": "keyword"
+            },
+            "hostname": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "nodejs": {
+          "properties": {
+            "eventloop": {
+              "properties": {
+                "delay": {
+                  "properties": {
+                    "avg": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "ns": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "handles": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "arrayBuffers": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "external": {
+                  "properties": {
+                    "bytes": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "heap": {
+                  "properties": {
+                    "allocated": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "requests": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ruby": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "total": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "slots": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    },
+                    "live": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "threads": {
+              "type": "long"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cgroup": {
+                  "properties": {
+                    "memory": {
+                      "properties": {
+                        "mem": {
+                          "properties": {
+                            "limit": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            },
+                            "usage": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            }
+                          }
+                        },
+                        "stats": {
+                          "properties": {
+                            "inactive_file": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "cpu": {
+                  "properties": {
+                    "system": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "user": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-metric"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-metric": {
+        "is_write_index": true
+      }
+    },
+    "index": "apm-8.0.0-metric-2020.07.31-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "clr": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "gen0size": {
+                  "type": "float"
+                },
+                "gen1size": {
+                  "type": "float"
+                },
+                "gen2size": {
+                  "type": "float"
+                },
+                "gen3size": {
+                  "type": "float"
+                }
+              }
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "golang": {
+          "properties": {
+            "goroutines": {
+              "type": "long"
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "active": {
+                      "type": "float"
+                    },
+                    "allocated": {
+                      "type": "float"
+                    },
+                    "frees": {
+                      "type": "float"
+                    },
+                    "idle": {
+                      "type": "float"
+                    },
+                    "mallocs": {
+                      "type": "float"
+                    },
+                    "objects": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "gc": {
+                  "properties": {
+                    "cpu_fraction": {
+                      "type": "float"
+                    },
+                    "next_gc_limit": {
+                      "type": "float"
+                    },
+                    "total_count": {
+                      "type": "long"
+                    },
+                    "total_pause": {
+                      "properties": {
+                        "ns": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                },
+                "system": {
+                  "properties": {
+                    "obtained": {
+                      "type": "float"
+                    },
+                    "released": {
+                      "type": "float"
+                    },
+                    "stack": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jvm": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "alloc": {
+                  "type": "float"
+                },
+                "count": {
+                  "type": "long"
+                },
+                "time": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "float"
+                    },
+                    "pool": {
+                      "properties": {
+                        "committed": {
+                          "type": "float"
+                        },
+                        "max": {
+                          "type": "float"
+                        },
+                        "used": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "non_heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "env": {
+              "type": "keyword"
+            },
+            "hostname": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "nodejs": {
+          "properties": {
+            "eventloop": {
+              "properties": {
+                "delay": {
+                  "properties": {
+                    "avg": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "ns": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "handles": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "arrayBuffers": {
+                  "properties": {
+                    "bytes": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "external": {
+                  "properties": {
+                    "bytes": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "heap": {
+                  "properties": {
+                    "allocated": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "requests": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ruby": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "slots": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    },
+                    "live": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "threads": {
+              "type": "long"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cgroup": {
+                  "properties": {
+                    "memory": {
+                      "properties": {
+                        "mem": {
+                          "properties": {
+                            "limit": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            },
+                            "usage": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            }
+                          }
+                        },
+                        "stats": {
+                          "properties": {
+                            "inactive_file": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "cpu": {
+                  "properties": {
+                    "system": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "user": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-metric"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-span": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-span-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "foo": {
+              "type": "keyword"
+            },
+            "productId": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-span"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-span": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-span-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "foo": {
+              "type": "keyword"
+            },
+            "productId": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-span"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-span": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-span-2020.07.31-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "foo": {
+              "type": "keyword"
+            },
+            "productId": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-span"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-span": {
+        "is_write_index": true
+      }
+    },
+    "index": "apm-8.0.0-span-2020.07.31-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "foo": {
+              "type": "keyword"
+            },
+            "productId": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-span"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-transaction": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-transaction-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_email": {
+              "type": "keyword"
+            },
+            "customer_name": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "served_from_cache": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                },
+                "agent": {
+                  "properties": {
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "firstContentfulPaint": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "largestContentfulPaint": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "timeToFirstByte": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                },
+                "navigationTiming": {
+                  "properties": {
+                    "connectEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "connectStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domLoading": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "fetchStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "requestStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-transaction"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-transaction": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-transaction-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_email": {
+              "type": "keyword"
+            },
+            "customer_name": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            },
+            "served_from_cache": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                },
+                "agent": {
+                  "properties": {
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "firstContentfulPaint": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "largestContentfulPaint": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "timeToFirstByte": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                },
+                "navigationTiming": {
+                  "properties": {
+                    "connectEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "connectStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domLoading": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "fetchStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "requestStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-transaction"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-transaction": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-transaction-2020.07.31-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_email": {
+              "type": "keyword"
+            },
+            "customer_name": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            },
+            "served_from_cache": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                },
+                "agent": {
+                  "properties": {
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "timeToFirstByte": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                },
+                "navigationTiming": {
+                  "properties": {
+                    "connectEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "connectStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domLoading": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "fetchStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "requestStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-transaction"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-transaction": {
+        "is_write_index": true
+      }
+    },
+    "index": "apm-8.0.0-transaction-2020.07.31-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_email": {
+              "type": "keyword"
+            },
+            "customer_name": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            },
+            "served_from_cache": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                },
+                "agent": {
+                  "properties": {
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "timeToFirstByte": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                },
+                "navigationTiming": {
+                  "properties": {
+                    "connectEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "connectStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domLoading": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "fetchStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "requestStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-transaction"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/apm_api_integration/trial/tests/csm/web_core_vitals.ts b/x-pack/test/apm_api_integration/trial/tests/csm/web_core_vitals.ts
index 654386cb9987b..18beb76e5a3a0 100644
--- a/x-pack/test/apm_api_integration/trial/tests/csm/web_core_vitals.ts
+++ b/x-pack/test/apm_api_integration/trial/tests/csm/web_core_vitals.ts
@@ -52,7 +52,7 @@ export default function rumServicesApiTests({ getService }: FtrProviderContext)
 
         expectSnapshot(response.body).toMatchInline(`
           Object {
-            "cls": "0",
+            "cls": "0.00",
             "clsRanks": Array [
               100,
               0,
diff --git a/x-pack/test/apm_api_integration/trial/tests/index.ts b/x-pack/test/apm_api_integration/trial/tests/index.ts
index bf32c4661afd5..ae62253c62d81 100644
--- a/x-pack/test/apm_api_integration/trial/tests/index.ts
+++ b/x-pack/test/apm_api_integration/trial/tests/index.ts
@@ -19,6 +19,7 @@ export default function observabilityApiIntegrationTests({ loadTestFile }: FtrPr
     });
 
     describe('Settings', function () {
+      loadTestFile(require.resolve('./settings/custom_link.ts'));
       describe('Anomaly detection', function () {
         loadTestFile(require.resolve('./settings/anomaly_detection/no_access_user'));
         loadTestFile(require.resolve('./settings/anomaly_detection/read_user'));
diff --git a/x-pack/test/apm_api_integration/trial/tests/settings/custom_link.ts b/x-pack/test/apm_api_integration/trial/tests/settings/custom_link.ts
new file mode 100644
index 0000000000000..bcfe8fce4b948
--- /dev/null
+++ b/x-pack/test/apm_api_integration/trial/tests/settings/custom_link.ts
@@ -0,0 +1,159 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import URL from 'url';
+import expect from '@kbn/expect';
+import { CustomLink } from '../../../../../plugins/apm/common/custom_link/custom_link_types';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+
+export default function customLinksTests({ getService }: FtrProviderContext) {
+  const supertestRead = getService('supertest');
+  const supertestWrite = getService('supertestAsApmWriteUser');
+  const log = getService('log');
+  const esArchiver = getService('esArchiver');
+
+  const archiveName = 'apm_8.0.0';
+
+  function searchCustomLinks(filters?: any) {
+    const path = URL.format({
+      pathname: `/api/apm/settings/custom_links`,
+      query: filters,
+    });
+    return supertestRead.get(path).set('kbn-xsrf', 'foo');
+  }
+
+  async function createCustomLink(customLink: CustomLink) {
+    log.debug('creating configuration', customLink);
+    const res = await supertestWrite
+      .post(`/api/apm/settings/custom_links`)
+      .send(customLink)
+      .set('kbn-xsrf', 'foo');
+
+    throwOnError(res);
+
+    return res;
+  }
+
+  async function updateCustomLink(id: string, customLink: CustomLink) {
+    log.debug('updating configuration', id, customLink);
+    const res = await supertestWrite
+      .put(`/api/apm/settings/custom_links/${id}`)
+      .send(customLink)
+      .set('kbn-xsrf', 'foo');
+
+    throwOnError(res);
+
+    return res;
+  }
+
+  async function deleteCustomLink(id: string) {
+    log.debug('deleting configuration', id);
+    const res = await supertestWrite
+      .delete(`/api/apm/settings/custom_links/${id}`)
+      .set('kbn-xsrf', 'foo');
+
+    throwOnError(res);
+
+    return res;
+  }
+
+  function throwOnError(res: any) {
+    const { statusCode, req, body } = res;
+    if (statusCode !== 200) {
+      throw new Error(`
+      Endpoint: ${req.method} ${req.path}
+      Service: ${JSON.stringify(res.request._data.service)}
+      Status code: ${statusCode}
+      Response: ${body.message}`);
+    }
+  }
+
+  describe('custom links', () => {
+    before(async () => {
+      const customLink = {
+        url: 'https://elastic.co',
+        label: 'with filters',
+        filters: [
+          { key: 'service.name', value: 'baz' },
+          { key: 'transaction.type', value: 'qux' },
+        ],
+      } as CustomLink;
+      await createCustomLink(customLink);
+    });
+    it('fetches a custom link', async () => {
+      const { status, body } = await searchCustomLinks({
+        'service.name': 'baz',
+        'transaction.type': 'qux',
+      });
+      const { label, url, filters } = body[0];
+
+      expect(status).to.equal(200);
+      expect({ label, url, filters }).to.eql({
+        label: 'with filters',
+        url: 'https://elastic.co',
+        filters: [
+          { key: 'service.name', value: 'baz' },
+          { key: 'transaction.type', value: 'qux' },
+        ],
+      });
+    });
+    it('updates a custom link', async () => {
+      let { status, body } = await searchCustomLinks({
+        'service.name': 'baz',
+        'transaction.type': 'qux',
+      });
+      expect(status).to.equal(200);
+      await updateCustomLink(body[0].id, {
+        label: 'foo',
+        url: 'https://elastic.co?service.name={{service.name}}',
+        filters: [
+          { key: 'service.name', value: 'quz' },
+          { key: 'transaction.name', value: 'bar' },
+        ],
+      });
+      ({ status, body } = await searchCustomLinks({
+        'service.name': 'quz',
+        'transaction.name': 'bar',
+      }));
+      const { label, url, filters } = body[0];
+      expect(status).to.equal(200);
+      expect({ label, url, filters }).to.eql({
+        label: 'foo',
+        url: 'https://elastic.co?service.name={{service.name}}',
+        filters: [
+          { key: 'service.name', value: 'quz' },
+          { key: 'transaction.name', value: 'bar' },
+        ],
+      });
+    });
+    it('deletes a custom link', async () => {
+      let { status, body } = await searchCustomLinks({
+        'service.name': 'quz',
+        'transaction.name': 'bar',
+      });
+      expect(status).to.equal(200);
+      await deleteCustomLink(body[0].id);
+      ({ status, body } = await searchCustomLinks({
+        'service.name': 'quz',
+        'transaction.name': 'bar',
+      }));
+      expect(status).to.equal(200);
+      expect(body).to.eql([]);
+    });
+
+    describe('transaction', () => {
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
+
+      it('fetches a transaction sample', async () => {
+        const response = await supertestRead.get(
+          '/api/apm/settings/custom_links/transaction?service.name=opbeans-java'
+        );
+        expect(response.status).to.be(200);
+        expect(response.body.service.name).to.eql('opbeans-java');
+      });
+    });
+  });
+}
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
index 108ca365bc14f..c6294cfe6ec28 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
@@ -129,7 +129,7 @@ export default ({ getService }: FtrProviderContext): void => {
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .set('kbn-xsrf', 'true')
-          .attach('file', getSimpleRuleAsNdjson(['rule-1']), 'rules.ndjson')
+          .attach('file', getSimpleRuleAsNdjson(['rule-1'], true), 'rules.ndjson')
           .expect(200);
 
         const { body } = await supertest
@@ -192,6 +192,56 @@ export default ({ getService }: FtrProviderContext): void => {
         });
       });
 
+      // import is very slow in 7.10+ due to the alerts client find api
+      // when importing 100 rules it takes about 30 seconds for this
+      // test to complete so at 10 rules completing in about 10 seconds
+      // I figured this is enough to make sure the import route is doing its job.
+      it('should be able to import 10 rules', async () => {
+        const ruleIds = new Array(10).fill(undefined).map((_, index) => `rule-${index}`);
+        const { body } = await supertest
+          .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
+          .set('kbn-xsrf', 'true')
+          .attach('file', getSimpleRuleAsNdjson(ruleIds, false), 'rules.ndjson')
+          .expect(200);
+
+        expect(body).to.eql({
+          errors: [],
+          success: true,
+          success_count: 10,
+        });
+      });
+
+      // uncomment the below test once we speed up the alerts client find api
+      // in another PR.
+      // it('should be able to import 10000 rules', async () => {
+      //   const ruleIds = new Array(10000).fill(undefined).map((_, index) => `rule-${index}`);
+      //   const { body } = await supertest
+      //     .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
+      //     .set('kbn-xsrf', 'true')
+      //     .attach('file', getSimpleRuleAsNdjson(ruleIds, false), 'rules.ndjson')
+      //     .expect(200);
+
+      //   expect(body).to.eql({
+      //     errors: [],
+      //     success: true,
+      //     success_count: 10000,
+      //   });
+      // });
+
+      it('should NOT be able to import more than 10,000 rules', async () => {
+        const ruleIds = new Array(10001).fill(undefined).map((_, index) => `rule-${index}`);
+        const { body } = await supertest
+          .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
+          .set('kbn-xsrf', 'true')
+          .attach('file', getSimpleRuleAsNdjson(ruleIds, false), 'rules.ndjson')
+          .expect(500);
+
+        expect(body).to.eql({
+          status_code: 500,
+          message: "Can't import more than 10000 rules",
+        });
+      });
+
       it('should report a conflict if there is an attempt to import two rules with the same rule_id', async () => {
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
@@ -280,7 +330,7 @@ export default ({ getService }: FtrProviderContext): void => {
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .set('kbn-xsrf', 'true')
-          .attach('file', getSimpleRuleAsNdjson(['rule-1']), 'rules.ndjson')
+          .attach('file', getSimpleRuleAsNdjson(['rule-1'], true), 'rules.ndjson')
           .expect(200);
 
         const simpleRule = getSimpleRule('rule-1');
@@ -372,13 +422,17 @@ export default ({ getService }: FtrProviderContext): void => {
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .set('kbn-xsrf', 'true')
-          .attach('file', getSimpleRuleAsNdjson(['rule-1', 'rule-2']), 'rules.ndjson')
+          .attach('file', getSimpleRuleAsNdjson(['rule-1', 'rule-2'], true), 'rules.ndjson')
           .expect(200);
 
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .set('kbn-xsrf', 'true')
-          .attach('file', getSimpleRuleAsNdjson(['rule-1', 'rule-2', 'rule-3']), 'rules.ndjson')
+          .attach(
+            'file',
+            getSimpleRuleAsNdjson(['rule-1', 'rule-2', 'rule-3'], true),
+            'rules.ndjson'
+          )
           .expect(200);
 
         const { body: bodyOfRule1 } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts
index e0b60ae1fbeeb..664077d5a4fab 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts
@@ -129,7 +129,7 @@ export default ({ getService }: FtrProviderContext): void => {
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .set('kbn-xsrf', 'true')
-          .attach('file', getSimpleRuleAsNdjson(['rule-1']), 'rules.ndjson')
+          .attach('file', getSimpleRuleAsNdjson(['rule-1'], true), 'rules.ndjson')
           .expect(200);
 
         const { body } = await supertest
@@ -243,7 +243,7 @@ export default ({ getService }: FtrProviderContext): void => {
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .set('kbn-xsrf', 'true')
-          .attach('file', getSimpleRuleAsNdjson(['rule-1']), 'rules.ndjson')
+          .attach('file', getSimpleRuleAsNdjson(['rule-1'], true), 'rules.ndjson')
           .expect(200);
 
         const simpleRule = getSimpleRule('rule-1');
@@ -335,13 +335,17 @@ export default ({ getService }: FtrProviderContext): void => {
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .set('kbn-xsrf', 'true')
-          .attach('file', getSimpleRuleAsNdjson(['rule-1', 'rule-2']), 'rules.ndjson')
+          .attach('file', getSimpleRuleAsNdjson(['rule-1', 'rule-2'], true), 'rules.ndjson')
           .expect(200);
 
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .set('kbn-xsrf', 'true')
-          .attach('file', getSimpleRuleAsNdjson(['rule-1', 'rule-2', 'rule-3']), 'rules.ndjson')
+          .attach(
+            'file',
+            getSimpleRuleAsNdjson(['rule-1', 'rule-2', 'rule-3'], true),
+            'rules.ndjson'
+          )
           .expect(200);
 
         const { body: bodyOfRule1 } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/utils.ts b/x-pack/test/detection_engine_api_integration/utils.ts
index 4cbbc142edd40..1dba1a154373b 100644
--- a/x-pack/test/detection_engine_api_integration/utils.ts
+++ b/x-pack/test/detection_engine_api_integration/utils.ts
@@ -56,10 +56,12 @@ export const removeServerGeneratedPropertiesIncludingRuleId = (
 /**
  * This is a typical simple rule for testing that is easy for most basic testing
  * @param ruleId
+ * @param enabled Enables the rule on creation or not. Defaulted to false to enable it on import
  */
-export const getSimpleRule = (ruleId = 'rule-1'): CreateRulesSchema => ({
+export const getSimpleRule = (ruleId = 'rule-1', enabled = true): CreateRulesSchema => ({
   name: 'Simple Rule Query',
   description: 'Simple Rule Query',
+  enabled,
   risk_score: 1,
   rule_id: ruleId,
   severity: 'high',
@@ -360,9 +362,9 @@ export const deleteSignalsIndex = async (
  * for testing uploads.
  * @param ruleIds Array of strings of rule_ids
  */
-export const getSimpleRuleAsNdjson = (ruleIds: string[]): Buffer => {
+export const getSimpleRuleAsNdjson = (ruleIds: string[], enabled = false): Buffer => {
   const stringOfRules = ruleIds.map((ruleId) => {
-    const simpleRule = getSimpleRule(ruleId);
+    const simpleRule = getSimpleRule(ruleId, enabled);
     return JSON.stringify(simpleRule);
   });
   return Buffer.from(stringOfRules.join('\n'));
diff --git a/x-pack/test/functional/apps/dashboard/reporting/screenshots.ts b/x-pack/test/functional/apps/dashboard/reporting/screenshots.ts
index 912bce22b1b21..5c9934d6e6dc8 100644
--- a/x-pack/test/functional/apps/dashboard/reporting/screenshots.ts
+++ b/x-pack/test/functional/apps/dashboard/reporting/screenshots.ts
@@ -72,8 +72,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         const url = await PageObjects.reporting.getReportURL(60000);
         const res = await PageObjects.reporting.getResponse(url);
 
-        expect(res.statusCode).to.equal(200);
-        expect(res.headers['content-type']).to.equal('application/pdf');
+        expect(res.status).to.equal(200);
+        expect(res.get('content-type')).to.equal('application/pdf');
       });
     });
 
diff --git a/x-pack/test/functional/apps/lens/dashboard.ts b/x-pack/test/functional/apps/lens/dashboard.ts
index ccf2f88a9d0ed..4a68c9a8ff3f2 100644
--- a/x-pack/test/functional/apps/lens/dashboard.ts
+++ b/x-pack/test/functional/apps/lens/dashboard.ts
@@ -17,6 +17,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const retry = getService('retry');
   const testSubjects = getService('testSubjects');
   const filterBar = getService('filterBar');
+  const security = getService('security');
 
   async function clickInChart(x: number, y: number) {
     const el = await elasticChart.getCanvas();
@@ -24,8 +25,15 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   }
 
   describe('lens dashboard tests', () => {
-    it('metric should be embeddable', async () => {
+    before(async () => {
       await PageObjects.common.navigateToApp('dashboard');
+      await security.testUser.setRoles(['global_dashboard_all', 'test_logstash_reader'], false);
+    });
+    after(async () => {
+      await security.testUser.restoreDefaults();
+    });
+
+    it('metric should be embeddable', async () => {
       await PageObjects.dashboard.clickNewDashboard();
       await dashboardAddPanel.clickOpenAddPanel();
       await dashboardAddPanel.filterEmbeddableNames('Artistpreviouslyknownaslens');
diff --git a/x-pack/test/functional/apps/lens/persistent_context.ts b/x-pack/test/functional/apps/lens/persistent_context.ts
index b57a9884dd11f..15515df92a89f 100644
--- a/x-pack/test/functional/apps/lens/persistent_context.ts
+++ b/x-pack/test/functional/apps/lens/persistent_context.ts
@@ -12,8 +12,20 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const browser = getService('browser');
   const filterBar = getService('filterBar');
   const appsMenu = getService('appsMenu');
+  const security = getService('security');
 
   describe('lens query context', () => {
+    before(async () => {
+      await security.testUser.setRoles(
+        ['global_discover_read', 'global_visualize_read', 'test_logstash_reader'],
+        false
+      );
+    });
+
+    after(async () => {
+      await security.testUser.restoreDefaults();
+    });
+
     it('should carry over time range and pinned filters to discover', async () => {
       await PageObjects.visualize.navigateToNewVisualization();
       await PageObjects.visualize.clickVisType('lens');
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
index 2524d0486171b..d3de41689244b 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
@@ -108,7 +108,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.testExecution.logTestStep('job creation displays the time range step');
       await ml.jobWizardCommon.assertTimeRangeSectionExists();
 
-      await ml.testExecution.logTestStep('job creation sets the timerange');
+      await ml.testExecution.logTestStep('job creation sets the time range');
       await ml.jobWizardCommon.clickUseFullDataButton(
         'Apr 5, 2019 @ 11:25:35.770',
         'Nov 21, 2019 @ 06:01:13.914'
@@ -230,7 +230,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.testExecution.logTestStep('job cloning displays the time range step');
       await ml.jobWizardCommon.assertTimeRangeSectionExists();
 
-      await ml.testExecution.logTestStep('job cloning sets the timerange');
+      await ml.testExecution.logTestStep('job cloning sets the time range');
       await ml.jobWizardCommon.clickUseFullDataButton(
         'Apr 5, 2019 @ 11:25:35.770',
         'Nov 21, 2019 @ 06:01:13.914'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/index.ts b/x-pack/test/functional/apps/ml/anomaly_detection/index.ts
index 0983ebd79dd90..07ffef62ce3c0 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/index.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/index.ts
@@ -10,6 +10,7 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     this.tags(['skipFirefox']);
 
     loadTestFile(require.resolve('./single_metric_job'));
+    loadTestFile(require.resolve('./single_metric_job_without_datafeed_start'));
     loadTestFile(require.resolve('./multi_metric_job'));
     loadTestFile(require.resolve('./population_job'));
     loadTestFile(require.resolve('./saved_search_job'));
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/multi_metric_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/multi_metric_job.ts
index 5324890b269bc..0964be83f628b 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/multi_metric_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/multi_metric_job.ts
@@ -104,7 +104,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.testExecution.logTestStep('job creation displays the time range step');
       await ml.jobWizardCommon.assertTimeRangeSectionExists();
 
-      await ml.testExecution.logTestStep('job creation sets the timerange');
+      await ml.testExecution.logTestStep('job creation sets the time range');
       await ml.jobWizardCommon.clickUseFullDataButton(
         'Feb 7, 2016 @ 00:00:00.000',
         'Feb 11, 2016 @ 23:59:54.000'
@@ -235,7 +235,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.testExecution.logTestStep('job cloning displays the time range step');
       await ml.jobWizardCommon.assertTimeRangeSectionExists();
 
-      await ml.testExecution.logTestStep('job cloning sets the timerange');
+      await ml.testExecution.logTestStep('job cloning sets the time range');
       await ml.jobWizardCommon.clickUseFullDataButton(
         'Feb 7, 2016 @ 00:00:00.000',
         'Feb 11, 2016 @ 23:59:54.000'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/population_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/population_job.ts
index 4797334ee57af..6b914f0c2ba07 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/population_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/population_job.ts
@@ -118,7 +118,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.testExecution.logTestStep('job creation displays the time range step');
       await ml.jobWizardCommon.assertTimeRangeSectionExists();
 
-      await ml.testExecution.logTestStep('job creation sets the timerange');
+      await ml.testExecution.logTestStep('job creation sets the time range');
       await ml.jobWizardCommon.clickUseFullDataButton(
         'Jun 12, 2019 @ 00:04:19.000',
         'Jul 12, 2019 @ 23:45:36.000'
@@ -261,7 +261,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.testExecution.logTestStep('job cloning displays the time range step');
       await ml.jobWizardCommon.assertTimeRangeSectionExists();
 
-      await ml.testExecution.logTestStep('job cloning sets the timerange');
+      await ml.testExecution.logTestStep('job cloning sets the time range');
       await ml.jobWizardCommon.clickUseFullDataButton(
         'Jun 12, 2019 @ 00:04:19.000',
         'Jul 12, 2019 @ 23:45:36.000'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
index ea3a42e2f27c8..f5f416411f175 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
@@ -306,7 +306,7 @@ export default function ({ getService }: FtrProviderContext) {
           await ml.testExecution.logTestStep('job creation displays the time range step');
           await ml.jobWizardCommon.assertTimeRangeSectionExists();
 
-          await ml.testExecution.logTestStep('job creation sets the timerange');
+          await ml.testExecution.logTestStep('job creation sets the time range');
           await ml.jobWizardCommon.clickUseFullDataButton(
             'Feb 7, 2016 @ 00:00:00.000',
             'Feb 11, 2016 @ 23:59:54.000'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job.ts
index 89612e51eee13..dd6310b67d844 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job.ts
@@ -103,7 +103,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.testExecution.logTestStep('job creation displays the time range step');
       await ml.jobWizardCommon.assertTimeRangeSectionExists();
 
-      await ml.testExecution.logTestStep('job creation sets the timerange');
+      await ml.testExecution.logTestStep('job creation sets the time range');
       await ml.jobWizardCommon.clickUseFullDataButton(
         'Feb 7, 2016 @ 00:00:00.000',
         'Feb 11, 2016 @ 23:59:54.000'
@@ -212,7 +212,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.testExecution.logTestStep('job cloning displays the time range step');
       await ml.jobWizardCommon.assertTimeRangeSectionExists();
 
-      await ml.testExecution.logTestStep('job cloning sets the timerange');
+      await ml.testExecution.logTestStep('job cloning sets the time range');
       await ml.jobWizardCommon.clickUseFullDataButton(
         'Feb 7, 2016 @ 00:00:00.000',
         'Feb 11, 2016 @ 23:59:54.000'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job_without_datafeed_start.ts b/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job_without_datafeed_start.ts
new file mode 100644
index 0000000000000..73a11294b97b1
--- /dev/null
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job_without_datafeed_start.ts
@@ -0,0 +1,151 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const ml = getService('ml');
+
+  const jobId = `fq_single_1_${Date.now()}`;
+  const aggAndFieldIdentifier = 'Mean(responsetime)';
+  const bucketSpan = '30m';
+
+  function getExpectedRow(expectedJobId: string) {
+    return {
+      id: expectedJobId,
+      description: '',
+      jobGroups: [],
+      recordCount: '0',
+      memoryStatus: 'ok',
+      jobState: 'closed',
+      datafeedState: 'stopped',
+      latestTimestamp: '',
+    };
+  }
+
+  function getExpectedCounts(expectedJobId: string) {
+    return {
+      job_id: expectedJobId,
+      processed_record_count: '0',
+      processed_field_count: '0',
+      input_bytes: '0.0 B',
+      input_field_count: '0',
+      invalid_date_count: '0',
+      missing_field_count: '0',
+      out_of_order_timestamp_count: '0',
+      empty_bucket_count: '0',
+      sparse_bucket_count: '0',
+      bucket_count: '0',
+    };
+  }
+
+  function getExpectedModelSizeStats(expectedJobId: string) {
+    return {
+      job_id: expectedJobId,
+      result_type: 'model_size_stats',
+      total_by_field_count: '0',
+      total_over_field_count: '0',
+      total_partition_field_count: '0',
+      bucket_allocation_failures_count: '0',
+      memory_status: 'ok',
+    };
+  }
+
+  describe('single metric without datafeed start', function () {
+    this.tags(['mlqa']);
+    before(async () => {
+      await esArchiver.loadIfNeeded('ml/farequote');
+      await ml.testResources.createIndexPatternIfNeeded('ft_farequote', '@timestamp');
+      await ml.testResources.setKibanaTimeZoneToUTC();
+
+      await ml.securityUI.loginAsMlPowerUser();
+    });
+
+    after(async () => {
+      await ml.api.cleanMlIndices();
+    });
+
+    it('job creation loads the single metric wizard for the source data', async () => {
+      await ml.testExecution.logTestStep('job creation loads the job management page');
+      await ml.navigation.navigateToMl();
+      await ml.navigation.navigateToJobManagement();
+
+      await ml.testExecution.logTestStep('job creation loads the new job source selection page');
+      await ml.jobManagement.navigateToNewJobSourceSelection();
+
+      await ml.testExecution.logTestStep('job creation loads the job type selection page');
+      await ml.jobSourceSelection.selectSourceForAnomalyDetectionJob('ft_farequote');
+
+      await ml.testExecution.logTestStep('job creation loads the single metric job wizard page');
+      await ml.jobTypeSelection.selectSingleMetricJob();
+    });
+
+    it('job creation navigates through the single metric wizard and sets all needed fields', async () => {
+      await ml.testExecution.logTestStep('job creation displays the time range step');
+      await ml.jobWizardCommon.assertTimeRangeSectionExists();
+
+      await ml.testExecution.logTestStep('job creation sets the time range');
+      await ml.jobWizardCommon.clickUseFullDataButton(
+        'Feb 7, 2016 @ 00:00:00.000',
+        'Feb 11, 2016 @ 23:59:54.000'
+      );
+
+      await ml.testExecution.logTestStep('job creation displays the event rate chart');
+      await ml.jobWizardCommon.assertEventRateChartExists();
+      await ml.jobWizardCommon.assertEventRateChartHasData();
+
+      await ml.testExecution.logTestStep('job creation displays the pick fields step');
+      await ml.jobWizardCommon.advanceToPickFieldsSection();
+
+      await ml.testExecution.logTestStep('job creation selects field and aggregation');
+      await ml.jobWizardCommon.assertAggAndFieldInputExists();
+      await ml.jobWizardCommon.selectAggAndField(aggAndFieldIdentifier, true);
+      await ml.jobWizardCommon.assertAnomalyChartExists('LINE');
+
+      await ml.testExecution.logTestStep('job creation inputs the bucket span');
+      await ml.jobWizardCommon.assertBucketSpanInputExists();
+      await ml.jobWizardCommon.setBucketSpan(bucketSpan);
+
+      await ml.testExecution.logTestStep('job creation displays the job details step');
+      await ml.jobWizardCommon.advanceToJobDetailsSection();
+
+      await ml.testExecution.logTestStep('job creation inputs the job id');
+      await ml.jobWizardCommon.assertJobIdInputExists();
+      await ml.jobWizardCommon.setJobId(jobId);
+
+      await ml.testExecution.logTestStep('job creation displays the validation step');
+      await ml.jobWizardCommon.advanceToValidationSection();
+
+      await ml.testExecution.logTestStep('job creation displays the summary step');
+      await ml.jobWizardCommon.advanceToSummarySection();
+    });
+
+    it('job creation runs the job and displays it correctly in the job list', async () => {
+      await ml.testExecution.logTestStep('job creation creates the job and finishes processing');
+
+      await ml.jobWizardCommon.assertStartDatafeedSwitchExists();
+      await ml.jobWizardCommon.toggleStartDatafeedSwitch(false);
+
+      await ml.jobWizardCommon.assertCreateJobButtonExists();
+      await ml.jobWizardCommon.createJobWithoutDatafeedStart();
+
+      await ml.jobTable.waitForJobsToLoad();
+      await ml.jobTable.filterWithSearchString(jobId, 1);
+
+      await ml.testExecution.logTestStep(
+        'job creation displays details for the created job in the job list'
+      );
+      await ml.jobTable.assertJobRowFields(jobId, getExpectedRow(jobId));
+
+      await ml.jobTable.assertJobRowDetailsCounts(
+        jobId,
+        getExpectedCounts(jobId),
+        getExpectedModelSizeStats(jobId)
+      );
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/visualize/reporting.ts b/x-pack/test/functional/apps/visualize/reporting.ts
index d1cea5a4481b1..0752971ba832b 100644
--- a/x-pack/test/functional/apps/visualize/reporting.ts
+++ b/x-pack/test/functional/apps/visualize/reporting.ts
@@ -68,8 +68,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         const url = await PageObjects.reporting.getReportURL(60000);
         const res = await PageObjects.reporting.getResponse(url);
 
-        expect(res.statusCode).to.equal(200);
-        expect(res.headers['content-type']).to.equal('application/pdf');
+        expect(res.status).to.equal(200);
+        expect(res.get('content-type')).to.equal('application/pdf');
       });
     });
   });
diff --git a/x-pack/test/functional/config.js b/x-pack/test/functional/config.js
index 4d85ac4f286e3..2072f4aa1c571 100644
--- a/x-pack/test/functional/config.js
+++ b/x-pack/test/functional/config.js
@@ -236,6 +236,28 @@ export default async function ({ readConfigFile }) {
           ],
         },
 
+        global_discover_all: {
+          kibana: [
+            {
+              feature: {
+                discover: ['all'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        },
+
+        global_dashboard_read: {
+          kibana: [
+            {
+              feature: {
+                dashboard: ['read'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        },
+
         global_discover_read: {
           kibana: [
             {
diff --git a/x-pack/test/functional/config_security_basic.ts b/x-pack/test/functional/config_security_basic.ts
index 48c397d9c37de..968281b75b7ac 100644
--- a/x-pack/test/functional/config_security_basic.ts
+++ b/x-pack/test/functional/config_security_basic.ts
@@ -70,7 +70,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     },
 
     junit: {
-      reportName: 'Chrome X-Pack UI Functional Tests',
+      reportName: 'Chrome X-Pack UI Functional Tests (Security Basic)',
     },
   };
 }
diff --git a/x-pack/test/functional/es_archives/endpoint/resolver_tree/data.json.gz b/x-pack/test/functional/es_archives/endpoint/resolver_tree/data.json.gz
new file mode 100644
index 0000000000000..0c3e40ce6eb54
Binary files /dev/null and b/x-pack/test/functional/es_archives/endpoint/resolver_tree/data.json.gz differ
diff --git a/x-pack/test/functional/page_objects/reporting_page.ts b/x-pack/test/functional/page_objects/reporting_page.ts
index 5828871d7c685..c6662c9639f21 100644
--- a/x-pack/test/functional/page_objects/reporting_page.ts
+++ b/x-pack/test/functional/page_objects/reporting_page.ts
@@ -4,14 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import http, { IncomingMessage } from 'http';
-import { parse } from 'url';
+import expect from '@kbn/expect';
+import { format as formatUrl } from 'url';
+import supertestAsPromised from 'supertest-as-promised';
+
 import { FtrProviderContext } from '../ftr_provider_context';
 
 export function ReportingPageProvider({ getService, getPageObjects }: FtrProviderContext) {
   const browser = getService('browser');
+  const config = getService('config');
   const log = getService('log');
   const retry = getService('retry');
+  const security = getService('security');
   const testSubjects = getService('testSubjects');
   const PageObjects = getPageObjects(['security', 'share', 'timePicker']);
 
@@ -42,45 +46,23 @@ export function ReportingPageProvider({ getService, getPageObjects }: FtrProvide
       `);
     }
 
-    getResponse(url: string): Promise<IncomingMessage> {
-      log.debug(`getResponse for ${url}`);
-      const auth = 'test_user:changeme'; // FIXME not sure why there is no config that can be read for this
-      const headers = {
-        Authorization: `Basic ${Buffer.from(auth).toString('base64')}`,
-      };
-      const parsedUrl = parse(url);
-      return new Promise((resolve, reject) => {
-        http
-          .get(
-            {
-              hostname: parsedUrl.hostname,
-              path: parsedUrl.path,
-              port: parsedUrl.port,
-              headers,
-            },
-            (res: IncomingMessage) => {
-              resolve(res);
-            }
-          )
-          .on('error', (e: Error) => {
-            log.error(e);
-            reject(e);
-          });
+    async getResponse(fullUrl: string): Promise<supertestAsPromised.Response> {
+      log.debug(`getResponse for ${fullUrl}`);
+      const kibanaServerConfig = config.get('servers.kibana');
+      const baseURL = formatUrl({
+        ...kibanaServerConfig,
+        auth: false,
       });
+      const urlWithoutBase = fullUrl.replace(baseURL, '');
+      const res = await security.testUserSupertest.get(urlWithoutBase);
+      return res;
     }
 
     async getRawPdfReportData(url: string): Promise<Buffer> {
-      const data: Buffer[] = []; // List of Buffer objects
       log.debug(`getRawPdfReportData for ${url}`);
-
-      return new Promise(async (resolve, reject) => {
-        const response = await this.getResponse(url).catch(reject);
-
-        if (response) {
-          response.on('data', (chunk: Buffer) => data.push(chunk));
-          response.on('end', () => resolve(Buffer.concat(data)));
-        }
-      });
+      const response = await this.getResponse(url);
+      expect(response.body).to.be.a(Buffer);
+      return response.body as Buffer;
     }
 
     async openCsvReportingPanel() {
diff --git a/x-pack/test/functional/services/ml/job_wizard_common.ts b/x-pack/test/functional/services/ml/job_wizard_common.ts
index 97253c5f45303..4ccd08c75397b 100644
--- a/x-pack/test/functional/services/ml/job_wizard_common.ts
+++ b/x-pack/test/functional/services/ml/job_wizard_common.ts
@@ -335,6 +335,37 @@ export function MachineLearningJobWizardCommonProvider(
       }
     },
 
+    async assertStartDatafeedSwitchExists() {
+      const subj = 'mlJobWizardStartDatafeedCheckbox';
+      await testSubjects.existOrFail(subj, { allowHidden: true });
+    },
+
+    async getStartDatafeedSwitchCheckedState(): Promise<boolean> {
+      const subj = 'mlJobWizardStartDatafeedCheckbox';
+      const isSelected = await testSubjects.getAttribute(subj, 'aria-checked');
+      return isSelected === 'true';
+    },
+
+    async assertStartDatafeedSwitchCheckedState(expectedValue: boolean) {
+      const actualCheckedState = await this.getStartDatafeedSwitchCheckedState();
+      expect(actualCheckedState).to.eql(
+        expectedValue,
+        `Expected start datafeed switch to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          actualCheckedState ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
+    async toggleStartDatafeedSwitch(toggle: boolean) {
+      const subj = 'mlJobWizardStartDatafeedCheckbox';
+      if ((await this.getStartDatafeedSwitchCheckedState()) !== toggle) {
+        await retry.tryForTime(5 * 1000, async () => {
+          await testSubjects.clickWhenNotDisabled(subj);
+          await this.assertStartDatafeedSwitchCheckedState(toggle);
+        });
+      }
+    },
+
     async assertModelMemoryLimitInputExists(
       sectionOptions: SectionOptions = { withAdvancedSection: true }
     ) {
@@ -510,5 +541,10 @@ export function MachineLearningJobWizardCommonProvider(
       await testSubjects.clickWhenNotDisabled('mlJobWizardButtonCreateJob');
       await testSubjects.existOrFail('mlJobWizardButtonRunInRealTime', { timeout: 2 * 60 * 1000 });
     },
+
+    async createJobWithoutDatafeedStart() {
+      await testSubjects.clickWhenNotDisabled('mlJobWizardButtonCreateJob');
+      await testSubjects.existOrFail('mlPageJobManagement');
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/settings_filter_list.ts b/x-pack/test/functional/services/ml/settings_filter_list.ts
index fb1f203b65562..0afe9f21b03a6 100644
--- a/x-pack/test/functional/services/ml/settings_filter_list.ts
+++ b/x-pack/test/functional/services/ml/settings_filter_list.ts
@@ -17,7 +17,7 @@ export function MachineLearningSettingsFilterListProvider({ getService }: FtrPro
       const $ = await table.parseDomContent();
       const rows = [];
 
-      for (const tr of $.findTestSubjects('~mlCalendarListRow').toArray()) {
+      for (const tr of $.findTestSubjects('~mlFilterListsRow').toArray()) {
         const $tr = $(tr);
 
         const inUseSubject = $tr
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
index 56952919e416a..67672cb54c21b 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
@@ -40,7 +40,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
     return createdAlert;
   }
 
-  describe('alerts', function () {
+  // FLAKY: https://github.com/elastic/kibana/issues/77401
+  describe.skip('alerts', function () {
     before(async () => {
       await pageObjects.common.navigateToApp('triggersActions');
       await testSubjects.click('alertsTab');
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/events.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/events.ts
index 93147091dc430..29680653bba5c 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/events.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/events.ts
@@ -32,5 +32,24 @@ export default function ({ getService }: FtrProviderContext) {
       expect(event).to.have.keys('type', 'subtype', 'message', 'payload');
       expect(event.payload).to.have.keys('previous_state');
     });
+
+    it('should return a 400 when given an invalid "kuery" value', async () => {
+      await supertest
+        .get(`/api/ingest_manager/fleet/agents/agent1/events?kuery=m`) // missing saved object type
+        .expect(400);
+    });
+    it('should accept a valid "kuery" value', async () => {
+      const filter = encodeURIComponent('fleet-agent-events.subtype : "STOPPED"');
+      const { body: apiResponse } = await supertest
+        .get(`/api/ingest_manager/fleet/agents/agent1/events?kuery=${filter}`)
+        .expect(200);
+
+      expect(apiResponse).to.have.keys(['list', 'total', 'page']);
+      expect(apiResponse.total).to.be(1);
+      expect(apiResponse.page).to.be(1);
+
+      const event = apiResponse.list[0];
+      expect(event.subtype).to.eql('STOPPED');
+    });
   });
 }
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/list.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/list.ts
index 1ee00ed720169..0c6c39dde0547 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/list.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/list.ts
@@ -95,5 +95,22 @@ export default function ({ getService }: FtrProviderContext) {
         .auth(users.kibana_basic_user.username, users.kibana_basic_user.password)
         .expect(404);
     });
+    it('should return a 400 when given an invalid "kuery" value', async () => {
+      await supertest
+        .get(`/api/ingest_manager/fleet/agents?kuery=m`) // missing saved object type
+        .auth(users.fleet_user.username, users.fleet_user.password)
+        .expect(400);
+    });
+    it('should accept a valid "kuery" value', async () => {
+      const filter = encodeURIComponent('fleet-agents.shared_id : "agent2_filebeat"');
+      const { body: apiResponse } = await supertest
+        .get(`/api/ingest_manager/fleet/agents?kuery=${filter}`)
+        .auth(users.fleet_user.username, users.fleet_user.password)
+        .expect(200);
+
+      expect(apiResponse.total).to.eql(1);
+      const agent = apiResponse.list[0];
+      expect(agent.shared_id).to.eql('agent2_filebeat');
+    });
   });
 }
diff --git a/x-pack/test/security_api_integration/session_idle.config.ts b/x-pack/test/security_api_integration/session_idle.config.ts
index da85c6342037e..34a23b7f5f926 100644
--- a/x-pack/test/security_api_integration/session_idle.config.ts
+++ b/x-pack/test/security_api_integration/session_idle.config.ts
@@ -36,7 +36,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     },
 
     junit: {
-      reportName: 'X-Pack Security API Integration Tests',
+      reportName: 'X-Pack Security API Integration Tests (Session Idle Timeout)',
     },
   };
 }
diff --git a/x-pack/test/security_api_integration/session_lifespan.config.ts b/x-pack/test/security_api_integration/session_lifespan.config.ts
index 17773a7739847..b5fdf6b6914b1 100644
--- a/x-pack/test/security_api_integration/session_lifespan.config.ts
+++ b/x-pack/test/security_api_integration/session_lifespan.config.ts
@@ -36,7 +36,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     },
 
     junit: {
-      reportName: 'X-Pack Security API Integration Tests',
+      reportName: 'X-Pack Security API Integration Tests (Session Lifespan)',
     },
   };
 }
diff --git a/x-pack/test/security_api_integration/tests/session_idle/cleanup.ts b/x-pack/test/security_api_integration/tests/session_idle/cleanup.ts
index c4302b7637923..01e2ad76fb3d2 100644
--- a/x-pack/test/security_api_integration/tests/session_idle/cleanup.ts
+++ b/x-pack/test/security_api_integration/tests/session_idle/cleanup.ts
@@ -36,11 +36,8 @@ export default function ({ getService }: FtrProviderContext) {
   describe('Session Idle cleanup', () => {
     beforeEach(async () => {
       await es.cluster.health({ index: '.kibana_security_session*', waitForStatus: 'green' });
-      await es.deleteByQuery({
+      await es.indices.delete({
         index: '.kibana_security_session*',
-        q: '*',
-        waitForCompletion: true,
-        refresh: true,
         ignore: [404],
       });
     });
diff --git a/x-pack/test/security_api_integration/tests/session_lifespan/cleanup.ts b/x-pack/test/security_api_integration/tests/session_lifespan/cleanup.ts
index dbdaf494fdf27..6036acf3d1cf1 100644
--- a/x-pack/test/security_api_integration/tests/session_lifespan/cleanup.ts
+++ b/x-pack/test/security_api_integration/tests/session_lifespan/cleanup.ts
@@ -30,15 +30,11 @@ export default function ({ getService }: FtrProviderContext) {
     return (await es.search({ index: '.kibana_security_session*' })).hits.total.value;
   }
 
-  // FLAKY: https://github.com/elastic/kibana/issues/76223
-  describe.skip('Session Lifespan cleanup', () => {
+  describe('Session Lifespan cleanup', () => {
     beforeEach(async () => {
       await es.cluster.health({ index: '.kibana_security_session*', waitForStatus: 'green' });
-      await es.deleteByQuery({
+      await es.indices.delete({
         index: '.kibana_security_session*',
-        q: '*',
-        waitForCompletion: true,
-        refresh: true,
         ignore: [404],
       });
     });
diff --git a/x-pack/test/security_functional/login_selector.config.ts b/x-pack/test/security_functional/login_selector.config.ts
index 48665c93c091a..bdb4778740503 100644
--- a/x-pack/test/security_functional/login_selector.config.ts
+++ b/x-pack/test/security_functional/login_selector.config.ts
@@ -76,7 +76,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     screenshots: { directory: resolve(__dirname, 'screenshots') },
 
     junit: {
-      reportName: 'Chrome X-Pack Security Functional Tests',
+      reportName: 'Chrome X-Pack Security Functional Tests (Login Selector)',
     },
   };
 }
diff --git a/x-pack/test/security_functional/oidc.config.ts b/x-pack/test/security_functional/oidc.config.ts
index 5fd59e049a0f4..1ed5d51098420 100644
--- a/x-pack/test/security_functional/oidc.config.ts
+++ b/x-pack/test/security_functional/oidc.config.ts
@@ -76,7 +76,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     screenshots: { directory: resolve(__dirname, 'screenshots') },
 
     junit: {
-      reportName: 'Chrome X-Pack Security Functional Tests',
+      reportName: 'Chrome X-Pack Security Functional Tests (OpenID Connect)',
     },
   };
 }
diff --git a/x-pack/test/security_functional/saml.config.ts b/x-pack/test/security_functional/saml.config.ts
index c47145f8bc039..9d925bee480a8 100644
--- a/x-pack/test/security_functional/saml.config.ts
+++ b/x-pack/test/security_functional/saml.config.ts
@@ -70,7 +70,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     screenshots: { directory: resolve(__dirname, 'screenshots') },
 
     junit: {
-      reportName: 'Chrome X-Pack Security Functional Tests',
+      reportName: 'Chrome X-Pack Security Functional Tests (SAML)',
     },
   };
 }
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts
index 7485e5db20478..4beb64affc46b 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts
@@ -160,13 +160,6 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
           );
           expect(endpointDetailTitleNew).to.equal(endpointDetailTitleInitial);
         });
-
-        // The integration does not work properly yet.  Skipping this test for now.
-        it.skip('navigates to ingest fleet when the Reassign Policy link is clicked', async () => {
-          await (await testSubjects.find('hostnameCellLink')).click();
-          await (await testSubjects.find('endpointDetailsLinkToIngest')).click();
-          await testSubjects.existOrFail('fleetAgentListTable');
-        });
       });
 
       // This set of tests fails the flyout does not open in the before() and will be fixed in soon
@@ -307,17 +300,5 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         expect(tableData).to.eql(expectedDataFromQuery);
       });
     });
-
-    describe.skip('when there is no data,', () => {
-      before(async () => {
-        // clear out the data and reload the page
-        await deleteMetadataStream(getService);
-        await deleteMetadataCurrentStream(getService);
-        await pageObjects.endpoint.navigateToEndpointList();
-      });
-      it('displays empty Policy Table page.', async () => {
-        await testSubjects.existOrFail('emptyPolicyTable');
-      });
-    });
   });
 };
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/index.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/index.ts
index ad1980cd7218b..c25233a0c82eb 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/index.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/index.ts
@@ -30,5 +30,6 @@ export default function (providerContext: FtrProviderContext) {
     });
     loadTestFile(require.resolve('./endpoint_list'));
     loadTestFile(require.resolve('./policy_details'));
+    loadTestFile(require.resolve('./resolver'));
   });
 }
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/resolver.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/resolver.ts
new file mode 100644
index 0000000000000..e8fa18aa01b4c
--- /dev/null
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/resolver.ts
@@ -0,0 +1,198 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ getPageObjects, getService }: FtrProviderContext) {
+  const pageObjects = getPageObjects(['common', 'timePicker', 'hosts', 'settings']);
+  const testSubjects = getService('testSubjects');
+  const esArchiver = getService('esArchiver');
+  const queryBar = getService('queryBar');
+
+  // FLAKY: https://github.com/elastic/kibana/issues/77835
+  describe.skip('Endpoint Event Resolver', function () {
+    before(async () => {
+      await esArchiver.load('endpoint/resolver_tree', { useCreate: true });
+      await pageObjects.hosts.navigateToSecurityHostsPage();
+      const fromTime = 'Jan 1, 2018 @ 00:00:00.000';
+      const toTime = 'now';
+      await pageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
+      await queryBar.setQuery('event.dataset : endpoint.events.file');
+      await queryBar.submitQuery();
+      await (await testSubjects.find('draggable-content-host.name')).click();
+      await testSubjects.existOrFail('header-page-title');
+      await (await testSubjects.find('navigation-events')).click();
+      await testSubjects.existOrFail('events-viewer-panel');
+      await testSubjects.exists('investigate-in-resolver-button', { timeout: 4000 });
+      await (await testSubjects.findAll('investigate-in-resolver-button'))[0].click();
+    });
+
+    after(async () => {
+      await pageObjects.hosts.deleteDataStreams();
+    });
+
+    it('check that Resolver and Data table is loaded', async () => {
+      await testSubjects.existOrFail('resolver:graph');
+      await testSubjects.existOrFail('tableHeaderCell_name_0');
+      await testSubjects.existOrFail('tableHeaderCell_timestamp_1');
+    });
+
+    it('compare resolver Nodes Table data and Data length', async () => {
+      const nodeData: string[] = [];
+      const TableData: string[] = [];
+
+      const Table = await testSubjects.findAll('resolver:node-list:item');
+      for (const value of Table) {
+        const text = await value._webElement.getText();
+        TableData.push(text.split('\n')[0]);
+      }
+      await (await testSubjects.find('resolver:graph-controls:zoom-out')).click();
+      const Nodes = await testSubjects.findAll('resolver:node:primary-button');
+      for (const value of Nodes) {
+        nodeData.push(await value._webElement.getText());
+      }
+      for (let i = 0; i < nodeData.length; i++) {
+        expect(TableData[i]).to.eql(nodeData[i]);
+      }
+      expect(nodeData.length).to.eql(TableData.length);
+      await (await testSubjects.find('resolver:graph-controls:zoom-in')).click();
+    });
+
+    it('resolver Nodes navigation Up', async () => {
+      const OriginalNodeDataStyle = await pageObjects.hosts.parseStyles();
+      await (await testSubjects.find('resolver:graph-controls:north-button')).click();
+
+      const NewNodeDataStyle = await pageObjects.hosts.parseStyles();
+      for (let i = 0; i < OriginalNodeDataStyle.length; i++) {
+        expect(parseFloat(OriginalNodeDataStyle[i].top)).to.lessThan(
+          parseFloat(NewNodeDataStyle[i].top)
+        );
+        expect(parseFloat(OriginalNodeDataStyle[i].left)).to.equal(
+          parseFloat(NewNodeDataStyle[i].left)
+        );
+      }
+      await (await testSubjects.find('resolver:graph-controls:center-button')).click();
+    });
+
+    it('resolver Nodes navigation Down', async () => {
+      const OriginalNodeDataStyle = await pageObjects.hosts.parseStyles();
+      await (await testSubjects.find('resolver:graph-controls:south-button')).click();
+
+      const NewNodeDataStyle = await pageObjects.hosts.parseStyles();
+      for (let i = 0; i < NewNodeDataStyle.length; i++) {
+        expect(parseFloat(NewNodeDataStyle[i].top)).to.lessThan(
+          parseFloat(OriginalNodeDataStyle[i].top)
+        );
+        expect(parseFloat(OriginalNodeDataStyle[i].left)).to.equal(
+          parseFloat(NewNodeDataStyle[i].left)
+        );
+      }
+      await (await testSubjects.find('resolver:graph-controls:center-button')).click();
+    });
+
+    it('resolver Nodes navigation Left', async () => {
+      const OriginalNodeDataStyle = await pageObjects.hosts.parseStyles();
+      await (await testSubjects.find('resolver:graph-controls:east-button')).click();
+
+      const NewNodeDataStyle = await pageObjects.hosts.parseStyles();
+      for (let i = 0; i < OriginalNodeDataStyle.length; i++) {
+        expect(parseFloat(NewNodeDataStyle[i].left)).to.lessThan(
+          parseFloat(OriginalNodeDataStyle[i].left)
+        );
+        expect(parseFloat(NewNodeDataStyle[i].top)).to.equal(
+          parseFloat(OriginalNodeDataStyle[i].top)
+        );
+      }
+      await (await testSubjects.find('resolver:graph-controls:center-button')).click();
+    });
+
+    it('resolver Nodes navigation Right', async () => {
+      const OriginalNodeDataStyle = await pageObjects.hosts.parseStyles();
+      await testSubjects.click('resolver:graph-controls:west-button');
+      const NewNodeDataStyle = await pageObjects.hosts.parseStyles();
+      for (let i = 0; i < NewNodeDataStyle.length; i++) {
+        expect(parseFloat(OriginalNodeDataStyle[i].left)).to.lessThan(
+          parseFloat(NewNodeDataStyle[i].left)
+        );
+        expect(parseFloat(NewNodeDataStyle[i].top)).to.equal(
+          parseFloat(OriginalNodeDataStyle[i].top)
+        );
+      }
+      await (await testSubjects.find('resolver:graph-controls:center-button')).click();
+    });
+
+    it('resolver Nodes navigation Center', async () => {
+      const OriginalNodeDataStyle = await pageObjects.hosts.parseStyles();
+      await (await testSubjects.find('resolver:graph-controls:east-button')).click();
+      await (await testSubjects.find('resolver:graph-controls:south-button')).click();
+
+      const NewNodeDataStyle = await pageObjects.hosts.parseStyles();
+      for (let i = 0; i < NewNodeDataStyle.length; i++) {
+        expect(parseFloat(NewNodeDataStyle[i].left)).to.lessThan(
+          parseFloat(OriginalNodeDataStyle[i].left)
+        );
+        expect(parseFloat(NewNodeDataStyle[i].top)).to.lessThan(
+          parseFloat(OriginalNodeDataStyle[i].top)
+        );
+      }
+      await (await testSubjects.find('resolver:graph-controls:center-button')).click();
+      const CenterNodeDataStyle = await pageObjects.hosts.parseStyles();
+
+      for (let i = 0; i < CenterNodeDataStyle.length; i++) {
+        expect(parseFloat(CenterNodeDataStyle[i].left)).to.equal(
+          parseFloat(OriginalNodeDataStyle[i].left)
+        );
+        expect(parseFloat(CenterNodeDataStyle[i].top)).to.equal(
+          parseFloat(OriginalNodeDataStyle[i].top)
+        );
+      }
+    });
+
+    it('resolver Nodes navigation zoom in', async () => {
+      const OriginalNodeDataStyle = await pageObjects.hosts.parseStyles();
+      await (await testSubjects.find('resolver:graph-controls:zoom-in')).click();
+
+      const NewNodeDataStyle = await pageObjects.hosts.parseStyles();
+      for (let i = 1; i < NewNodeDataStyle.length; i++) {
+        expect(parseFloat(NewNodeDataStyle[i].left)).to.lessThan(
+          parseFloat(OriginalNodeDataStyle[i].left)
+        );
+        expect(parseFloat(NewNodeDataStyle[i].top)).to.lessThan(
+          parseFloat(OriginalNodeDataStyle[i].top)
+        );
+        expect(parseFloat(OriginalNodeDataStyle[i].width)).to.lessThan(
+          parseFloat(NewNodeDataStyle[i].width)
+        );
+        expect(parseFloat(OriginalNodeDataStyle[i].height)).to.lessThan(
+          parseFloat(NewNodeDataStyle[i].height)
+        );
+        await (await testSubjects.find('resolver:graph-controls:zoom-out')).click();
+      }
+    });
+
+    it('resolver Nodes navigation zoom out', async () => {
+      const OriginalNodeDataStyle = await pageObjects.hosts.parseStyles();
+      await (await testSubjects.find('resolver:graph-controls:zoom-out')).click();
+      const NewNodeDataStyle1 = await pageObjects.hosts.parseStyles();
+      for (let i = 1; i < OriginalNodeDataStyle.length; i++) {
+        expect(parseFloat(OriginalNodeDataStyle[i].left)).to.lessThan(
+          parseFloat(NewNodeDataStyle1[i].left)
+        );
+        expect(parseFloat(OriginalNodeDataStyle[i].top)).to.lessThan(
+          parseFloat(NewNodeDataStyle1[i].top)
+        );
+        expect(parseFloat(NewNodeDataStyle1[i].width)).to.lessThan(
+          parseFloat(OriginalNodeDataStyle[i].width)
+        );
+        expect(parseFloat(NewNodeDataStyle1[i].height)).to.lessThan(
+          parseFloat(OriginalNodeDataStyle[i].height)
+        );
+      }
+      await (await testSubjects.find('resolver:graph-controls:zoom-in')).click();
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_endpoint/config.ts b/x-pack/test/security_solution_endpoint/config.ts
index 5aa5e42ffd4ee..840862ab00560 100644
--- a/x-pack/test/security_solution_endpoint/config.ts
+++ b/x-pack/test/security_solution_endpoint/config.ts
@@ -30,6 +30,10 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
       ['securitySolutionManagement']: {
         pathname: '/app/security/administration',
       },
+      ...xpackFunctionalConfig.get('apps'),
+      ['security']: {
+        pathname: '/app/security',
+      },
     },
     kbnTestServer: {
       ...xpackFunctionalConfig.get('kbnTestServer'),
diff --git a/x-pack/test/security_solution_endpoint/page_objects/hosts_page.ts b/x-pack/test/security_solution_endpoint/page_objects/hosts_page.ts
new file mode 100644
index 0000000000000..c5f7d5b5fdf31
--- /dev/null
+++ b/x-pack/test/security_solution_endpoint/page_objects/hosts_page.ts
@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrProviderContext } from '../ftr_provider_context';
+import { deleteEventsStream } from '../../security_solution_endpoint_api_int/apis/data_stream_helper';
+import { deleteAlertsStream } from '../../security_solution_endpoint_api_int/apis/data_stream_helper';
+import { deleteMetadataStream } from '../../security_solution_endpoint_api_int/apis/data_stream_helper';
+import { deletePolicyStream } from '../../security_solution_endpoint_api_int/apis/data_stream_helper';
+import { deleteTelemetryStream } from '../../security_solution_endpoint_api_int/apis/data_stream_helper';
+export interface DataStyle {
+  left: string;
+  top: string;
+  width: string;
+  height: string;
+}
+
+export function SecurityHostsPageProvider({ getService, getPageObjects }: FtrProviderContext) {
+  const pageObjects = getPageObjects(['common', 'header']);
+  const testSubjects = getService('testSubjects');
+
+  /**
+   * @function parseStyles
+   * Parses a string of inline styles into a typescript object with casing for react
+   * @param {string} styles
+   * @returns {Object}
+   */
+  const parseStyle = (
+    styles: string
+  ): {
+    left?: string;
+    top?: string;
+    width?: string;
+    height?: string;
+  } =>
+    styles
+      .split(';')
+      .filter((style: string) => style.split(':')[0] && style.split(':')[1])
+      .map((style: string) => [
+        style
+          .split(':')[0]
+          .trim()
+          .replace(/-./g, (c: string) => c.substr(1).toUpperCase()),
+        style.split(':').slice(1).join(':').trim(),
+      ])
+      .reduce(
+        (styleObj: {}, style: string[]) => ({
+          ...styleObj,
+          [style[0]]: style[1],
+        }),
+        {}
+      );
+  return {
+    /**
+     * Navigate to the Security Hosts page
+     */
+    async navigateToSecurityHostsPage() {
+      await pageObjects.common.navigateToUrlWithBrowserHistory('security', '/hosts/AllHosts');
+      await pageObjects.header.waitUntilLoadingHasFinished();
+    },
+    /**
+     * Finds a table and returns the data in a nested array with row 0 is the headers if they exist.
+     * It uses euiTableCellContent to avoid poluting the array data with the euiTableRowCell__mobileHeader data.
+     * @param dataTestSubj
+     * @param element
+     * @returns Promise<string[][]>
+     */
+    async getEndpointEventResolverNodeData(dataTestSubj: string, element: string) {
+      await testSubjects.exists(dataTestSubj);
+      const Elements = await testSubjects.findAll(dataTestSubj);
+      const $ = [];
+      for (const value of Elements) {
+        $.push(await value.getAttribute(element));
+      }
+      return $;
+    },
+
+    /**
+     * Gets a array of not parsed styles and returns the Array of parsed styles.
+     * @returns Promise<string[][]>
+     */
+    async parseStyles() {
+      const tableData = await this.getEndpointEventResolverNodeData('resolver:node', 'style');
+      const styles: DataStyle[] = [];
+      for (let i = 1; i < tableData.length; i++) {
+        const eachStyle = parseStyle(tableData[i]);
+        styles.push({
+          top: eachStyle.top ?? '',
+          height: eachStyle.height ?? '',
+          left: eachStyle.left ?? '',
+          width: eachStyle.width ?? '',
+        });
+      }
+      return styles;
+    },
+    /**
+     * Deletes DataStreams from Index Management.
+     */
+    async deleteDataStreams() {
+      await deleteEventsStream(getService);
+      await deleteAlertsStream(getService);
+      await deletePolicyStream(getService);
+      await deleteMetadataStream(getService);
+      await deleteTelemetryStream(getService);
+    },
+  };
+}
diff --git a/x-pack/test/security_solution_endpoint/page_objects/index.ts b/x-pack/test/security_solution_endpoint/page_objects/index.ts
index 39a9e7009c385..3664a2033d8b7 100644
--- a/x-pack/test/security_solution_endpoint/page_objects/index.ts
+++ b/x-pack/test/security_solution_endpoint/page_objects/index.ts
@@ -10,6 +10,7 @@ import { EndpointPolicyPageProvider } from './policy_page';
 import { TrustedAppsPageProvider } from './trusted_apps_page';
 import { EndpointPageUtils } from './page_utils';
 import { IngestManagerCreatePackagePolicy } from './ingest_manager_create_package_policy_page';
+import { SecurityHostsPageProvider } from './hosts_page';
 
 export const pageObjects = {
   ...xpackFunctionalPageObjects,
@@ -18,4 +19,5 @@ export const pageObjects = {
   trustedApps: TrustedAppsPageProvider,
   endpointPageUtils: EndpointPageUtils,
   ingestManagerCreatePackagePolicy: IngestManagerCreatePackagePolicy,
+  hosts: SecurityHostsPageProvider,
 };
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/data_stream_helper.ts b/x-pack/test/security_solution_endpoint_api_int/apis/data_stream_helper.ts
index be25f26532d9c..f1c05b2fc8f20 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/data_stream_helper.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/data_stream_helper.ts
@@ -11,6 +11,7 @@ import {
   alertsIndexPattern,
   policyIndexPattern,
   metadataCurrentIndexPattern,
+  telemetryIndexPattern,
 } from '../../../plugins/security_solution/common/endpoint/constants';
 
 export async function deleteDataStream(getService: (serviceName: 'es') => Client, index: string) {
@@ -75,3 +76,7 @@ export async function deleteAlertsStream(getService: (serviceName: 'es') => Clie
 export async function deletePolicyStream(getService: (serviceName: 'es') => Client) {
   await deleteDataStream(getService, policyIndexPattern);
 }
+
+export async function deleteTelemetryStream(getService: (serviceName: 'es') => Client) {
+  await deleteDataStream(getService, telemetryIndexPattern);
+}
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/index.ts b/x-pack/test/security_solution_endpoint_api_int/apis/index.ts
index 8b4a73b7eb848..3d344c1b3b51b 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/index.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/index.ts
@@ -28,6 +28,7 @@ export default function endpointAPIIntegrationTests(providerContext: FtrProvider
     });
     loadTestFile(require.resolve('./resolver/index'));
     loadTestFile(require.resolve('./metadata'));
+    loadTestFile(require.resolve('./metadata_v1'));
     loadTestFile(require.resolve('./policy'));
     loadTestFile(require.resolve('./artifacts'));
     loadTestFile(require.resolve('./package'));
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/metadata.ts b/x-pack/test/security_solution_endpoint_api_int/apis/metadata.ts
index 2286320ed7a88..b157c3159ccc0 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/metadata.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/metadata.ts
@@ -11,6 +11,8 @@ import {
   deleteAllDocsFromMetadataIndex,
   deleteMetadataStream,
 } from './data_stream_helper';
+import { METADATA_REQUEST_ROUTE } from '../../../plugins/security_solution/server/endpoint/routes/metadata';
+import { MetadataQueryStrategyVersions } from '../../../plugins/security_solution/common/endpoint/types';
 
 /**
  * The number of host documents in the es archive.
@@ -22,14 +24,14 @@ export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
 
   describe('test metadata api', () => {
-    describe('POST /api/endpoint/metadata when index is empty', () => {
+    describe(`POST ${METADATA_REQUEST_ROUTE} when index is empty`, () => {
       it('metadata api should return empty result when index is empty', async () => {
         await deleteMetadataStream(getService);
         await deleteAllDocsFromMetadataIndex(getService);
         await deleteMetadataCurrentStream(getService);
         await deleteAllDocsFromMetadataCurrentIndex(getService);
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send()
           .expect(200);
@@ -40,7 +42,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
     });
 
-    describe('POST /api/endpoint/metadata when index is not empty', () => {
+    describe(`POST ${METADATA_REQUEST_ROUTE} when index is not empty`, () => {
       before(async () => {
         await esArchiver.load('endpoint/metadata/api_feature', { useCreate: true });
         // wait for transform
@@ -56,7 +58,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
       it('metadata api should return one entry for each host with default paging', async () => {
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send()
           .expect(200);
@@ -68,7 +70,7 @@ export default function ({ getService }: FtrProviderContext) {
 
       it('metadata api should return page based on paging properties passed.', async () => {
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send({
             paging_properties: [
@@ -85,6 +87,7 @@ export default function ({ getService }: FtrProviderContext) {
         expect(body.hosts.length).to.eql(1);
         expect(body.request_page_size).to.eql(1);
         expect(body.request_page_index).to.eql(1);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_2);
       });
 
       /* test that when paging properties produces no result, the total should reflect the actual number of metadata
@@ -92,7 +95,7 @@ export default function ({ getService }: FtrProviderContext) {
        */
       it('metadata api should return accurate total metadata if page index produces no result', async () => {
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send({
             paging_properties: [
@@ -109,11 +112,12 @@ export default function ({ getService }: FtrProviderContext) {
         expect(body.hosts.length).to.eql(0);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(30);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_2);
       });
 
       it('metadata api should return 400 when pagingProperties is below boundaries.', async () => {
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send({
             paging_properties: [
@@ -131,7 +135,7 @@ export default function ({ getService }: FtrProviderContext) {
 
       it('metadata api should return page based on filters passed.', async () => {
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send({
             filters: {
@@ -143,12 +147,13 @@ export default function ({ getService }: FtrProviderContext) {
         expect(body.hosts.length).to.eql(2);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_2);
       });
 
       it('metadata api should return page based on filters and paging passed.', async () => {
         const notIncludedIp = '10.46.229.234';
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send({
             paging_properties: [
@@ -180,12 +185,13 @@ export default function ({ getService }: FtrProviderContext) {
         expect(body.hosts.length).to.eql(2);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_2);
       });
 
       it('metadata api should return page based on host.os.Ext.variant filter.', async () => {
         const variantValue = 'Windows Pro';
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send({
             filters: {
@@ -201,12 +207,13 @@ export default function ({ getService }: FtrProviderContext) {
         expect(body.hosts.length).to.eql(2);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_2);
       });
 
       it('metadata api should return the latest event for all the events for an endpoint', async () => {
         const targetEndpointIp = '10.46.229.234';
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send({
             filters: {
@@ -223,11 +230,12 @@ export default function ({ getService }: FtrProviderContext) {
         expect(body.hosts.length).to.eql(1);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_2);
       });
 
       it('metadata api should return the latest event for all the events where policy status is not success', async () => {
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send({
             filters: {
@@ -248,7 +256,7 @@ export default function ({ getService }: FtrProviderContext) {
         const targetEndpointId = 'fc0ff548-feba-41b6-8367-65e8790d0eaf';
         const targetElasticAgentId = '023fa40c-411d-4188-a941-4147bfadd095';
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send({
             filters: {
@@ -266,11 +274,12 @@ export default function ({ getService }: FtrProviderContext) {
         expect(body.hosts.length).to.eql(1);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_2);
       });
 
       it('metadata api should return all hosts when filter is empty string', async () => {
         const { body } = await supertest
-          .post('/api/endpoint/metadata')
+          .post(`${METADATA_REQUEST_ROUTE}`)
           .set('kbn-xsrf', 'xxx')
           .send({
             filters: {
@@ -282,6 +291,7 @@ export default function ({ getService }: FtrProviderContext) {
         expect(body.hosts.length).to.eql(numberOfHostsInFixture);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_2);
       });
     });
   });
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/metadata_v1.ts b/x-pack/test/security_solution_endpoint_api_int/apis/metadata_v1.ts
new file mode 100644
index 0000000000000..548e5f6c768da
--- /dev/null
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/metadata_v1.ts
@@ -0,0 +1,284 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect/expect.js';
+import { FtrProviderContext } from '../ftr_provider_context';
+import { deleteMetadataStream } from './data_stream_helper';
+import { METADATA_REQUEST_V1_ROUTE } from '../../../plugins/security_solution/server/endpoint/routes/metadata';
+import { MetadataQueryStrategyVersions } from '../../../plugins/security_solution/common/endpoint/types';
+
+/**
+ * The number of host documents in the es archive.
+ */
+const numberOfHostsInFixture = 3;
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const supertest = getService('supertest');
+  describe('test metadata api v1', () => {
+    describe(`POST ${METADATA_REQUEST_V1_ROUTE} when index is empty`, () => {
+      it('metadata api should return empty result when index is empty', async () => {
+        // the endpoint uses data streams and es archiver does not support deleting them at the moment so we need
+        // to do it manually
+        await deleteMetadataStream(getService);
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send()
+          .expect(200);
+        expect(body.total).to.eql(0);
+        expect(body.hosts.length).to.eql(0);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_1);
+      });
+    });
+
+    describe(`POST ${METADATA_REQUEST_V1_ROUTE} when index is not empty`, () => {
+      before(
+        async () => await esArchiver.load('endpoint/metadata/api_feature', { useCreate: true })
+      );
+      // the endpoint uses data streams and es archiver does not support deleting them at the moment so we need
+      // to do it manually
+      after(async () => await deleteMetadataStream(getService));
+      it('metadata api should return one entry for each host with default paging', async () => {
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send()
+          .expect(200);
+        expect(body.total).to.eql(numberOfHostsInFixture);
+        expect(body.hosts.length).to.eql(numberOfHostsInFixture);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_1);
+      });
+
+      it('metadata api should return page based on paging properties passed.', async () => {
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            paging_properties: [
+              {
+                page_size: 1,
+              },
+              {
+                page_index: 1,
+              },
+            ],
+          })
+          .expect(200);
+        expect(body.total).to.eql(numberOfHostsInFixture);
+        expect(body.hosts.length).to.eql(1);
+        expect(body.request_page_size).to.eql(1);
+        expect(body.request_page_index).to.eql(1);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_1);
+      });
+
+      /* test that when paging properties produces no result, the total should reflect the actual number of metadata
+      in the index.
+       */
+      it('metadata api should return accurate total metadata if page index produces no result', async () => {
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            paging_properties: [
+              {
+                page_size: 10,
+              },
+              {
+                page_index: 3,
+              },
+            ],
+          })
+          .expect(200);
+        expect(body.total).to.eql(numberOfHostsInFixture);
+        expect(body.hosts.length).to.eql(0);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(30);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_1);
+      });
+
+      it('metadata api should return 400 when pagingProperties is below boundaries.', async () => {
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            paging_properties: [
+              {
+                page_size: 0,
+              },
+              {
+                page_index: 1,
+              },
+            ],
+          })
+          .expect(400);
+        expect(body.message).to.contain('Value must be equal to or greater than [1]');
+      });
+
+      it('metadata api should return page based on filters passed.', async () => {
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            filters: {
+              kql: 'not host.ip:10.46.229.234',
+            },
+          })
+          .expect(200);
+        expect(body.total).to.eql(2);
+        expect(body.hosts.length).to.eql(2);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_1);
+      });
+
+      it('metadata api should return page based on filters and paging passed.', async () => {
+        const notIncludedIp = '10.46.229.234';
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            paging_properties: [
+              {
+                page_size: 10,
+              },
+              {
+                page_index: 0,
+              },
+            ],
+            filters: {
+              kql: `not host.ip:${notIncludedIp}`,
+            },
+          })
+          .expect(200);
+        expect(body.total).to.eql(2);
+        const resultIps: string[] = [].concat(
+          ...body.hosts.map((hostInfo: Record<string, any>) => hostInfo.metadata.host.ip)
+        );
+        expect(resultIps).to.eql([
+          '10.192.213.130',
+          '10.70.28.129',
+          '10.101.149.26',
+          '2606:a000:ffc0:39:11ef:37b9:3371:578c',
+        ]);
+        expect(resultIps).not.include.eql(notIncludedIp);
+        expect(body.hosts.length).to.eql(2);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_1);
+      });
+
+      it('metadata api should return page based on host.os.Ext.variant filter.', async () => {
+        const variantValue = 'Windows Pro';
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            filters: {
+              kql: `host.os.Ext.variant:${variantValue}`,
+            },
+          })
+          .expect(200);
+        expect(body.total).to.eql(2);
+        const resultOsVariantValue: Set<string> = new Set(
+          body.hosts.map((hostInfo: Record<string, any>) => hostInfo.metadata.host.os.Ext.variant)
+        );
+        expect(Array.from(resultOsVariantValue)).to.eql([variantValue]);
+        expect(body.hosts.length).to.eql(2);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_1);
+      });
+
+      it('metadata api should return the latest event for all the events for an endpoint', async () => {
+        const targetEndpointIp = '10.46.229.234';
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            filters: {
+              kql: `host.ip:${targetEndpointIp}`,
+            },
+          })
+          .expect(200);
+        expect(body.total).to.eql(1);
+        const resultIp: string = body.hosts[0].metadata.host.ip.filter(
+          (ip: string) => ip === targetEndpointIp
+        );
+        expect(resultIp).to.eql([targetEndpointIp]);
+        expect(body.hosts[0].metadata.event.created).to.eql(1579881969541);
+        expect(body.hosts.length).to.eql(1);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_1);
+      });
+
+      it('metadata api should return the latest event for all the events where policy status is not success', async () => {
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            filters: {
+              kql: `not Endpoint.policy.applied.status:success`,
+            },
+          })
+          .expect(200);
+        const statuses: Set<string> = new Set(
+          body.hosts.map(
+            (hostInfo: Record<string, any>) => hostInfo.metadata.Endpoint.policy.applied.status
+          )
+        );
+        expect(statuses.size).to.eql(1);
+        expect(Array.from(statuses)).to.eql(['failure']);
+      });
+
+      it('metadata api should return the endpoint based on the elastic agent id, and status should be error', async () => {
+        const targetEndpointId = 'fc0ff548-feba-41b6-8367-65e8790d0eaf';
+        const targetElasticAgentId = '023fa40c-411d-4188-a941-4147bfadd095';
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            filters: {
+              kql: `elastic.agent.id:${targetElasticAgentId}`,
+            },
+          })
+          .expect(200);
+        expect(body.total).to.eql(1);
+        const resultHostId: string = body.hosts[0].metadata.host.id;
+        const resultElasticAgentId: string = body.hosts[0].metadata.elastic.agent.id;
+        expect(resultHostId).to.eql(targetEndpointId);
+        expect(resultElasticAgentId).to.eql(targetElasticAgentId);
+        expect(body.hosts[0].metadata.event.created).to.eql(1579881969541);
+        expect(body.hosts[0].host_status).to.eql('error');
+        expect(body.hosts.length).to.eql(1);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_1);
+      });
+
+      it('metadata api should return all hosts when filter is empty string', async () => {
+        const { body } = await supertest
+          .post(`${METADATA_REQUEST_V1_ROUTE}`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            filters: {
+              kql: '',
+            },
+          })
+          .expect(200);
+        expect(body.total).to.eql(numberOfHostsInFixture);
+        expect(body.hosts.length).to.eql(numberOfHostsInFixture);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+        expect(body.query_strategy_version).to.eql(MetadataQueryStrategyVersions.VERSION_1);
+      });
+    });
+  });
+}
diff --git a/x-pack/tsconfig.json b/x-pack/tsconfig.json
index 38851653898a8..0f5a7526d98bc 100644
--- a/x-pack/tsconfig.json
+++ b/x-pack/tsconfig.json
@@ -21,22 +21,13 @@
     "paths": {
       "kibana/public": ["src/core/public"],
       "kibana/server": ["src/core/server"],
-      "plugins/xpack_main/*": [
-        "x-pack/legacy/plugins/xpack_main/public/*"
-      ],
-      "plugins/spaces/*": [
-        "x-pack/legacy/plugins/spaces/public/*"
-      ],
-      "test_utils/*": [
-        "x-pack/test_utils/*"
-      ],
-      "plugins/*": ["src/legacy/core_plugins/*/public/"],
-      "fixtures/*": ["src/fixtures/*"],
+      "plugins/xpack_main/*": ["x-pack/legacy/plugins/xpack_main/public/*"],
+      "plugins/spaces/*": ["x-pack/legacy/plugins/spaces/public/*"],
+      "test_utils/*": ["x-pack/test_utils/*"],
+      "fixtures/*": ["src/fixtures/*"]
     },
     // overhead is too significant
-    "incremental": false,
+    "incremental": false
   },
-  "references": [
-    { "path": "../src/core/tsconfig.json" }
-  ]
+  "references": [{ "path": "../src/core/tsconfig.json" }]
 }
diff --git a/yarn.lock b/yarn.lock
index 8bdb06152a7f2..7fb61b10c1bf7 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1226,25 +1226,23 @@
     tabbable "^1.1.0"
     uuid "^3.1.0"
 
-"@elastic/eui@28.2.0":
-  version "28.2.0"
-  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-28.2.0.tgz#0c89c7adc27d4ac918191af8237a2634a26d0637"
-  integrity sha512-ovVkwbwcJLs87ycaof5pyTGjpuPH2sN38k2e+c3IiZjoeGAqWZJouptQguoKYglCyayxoBUV3TAE82m+qyxCnA==
+"@elastic/eui@28.4.0":
+  version "28.4.0"
+  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-28.4.0.tgz#6b3b6b5e8b602d009410a97c26e22093846f708a"
+  integrity sha512-4iXo5fNx4qqeI+Tj5EJ0qHRhyi8KTLaqeQJCWg9Vy7N83ap6kp6s7X6D6qYUHqdmOdJH9QZYuYIpRUi3TQEJNg==
   dependencies:
     "@types/chroma-js" "^2.0.0"
-    "@types/lodash" "^4.14.116"
-    "@types/numeral" "^0.0.25"
-    "@types/react-beautiful-dnd" "^12.1.2"
-    "@types/react-input-autosize" "^2.0.2"
+    "@types/lodash" "^4.14.160"
+    "@types/numeral" "^0.0.28"
+    "@types/react-beautiful-dnd" "^13.0.0"
+    "@types/react-input-autosize" "^2.2.0"
     "@types/react-virtualized-auto-sizer" "^1.0.0"
-    "@types/react-window" "^1.8.1"
+    "@types/react-window" "^1.8.2"
     "@types/vfile-message" "^2.0.0"
-    chroma-js "^2.0.4"
-    classnames "^2.2.5"
+    chroma-js "^2.1.0"
+    classnames "^2.2.6"
     highlight.js "^9.12.0"
-    html "^1.0.0"
-    keymirror "^0.1.1"
-    lodash "^4.17.11"
+    lodash "^4.17.20"
     numeral "^2.0.6"
     prop-types "^15.6.0"
     react-ace "^7.0.5"
@@ -1262,12 +1260,11 @@
     remark-highlight.js "^5.2.0"
     remark-parse "^7.0.2"
     remark-rehype "^7.0.0"
-    resize-observer-polyfill "^1.5.0"
     tabbable "^3.0.0"
     text-diff "^1.0.1"
     unified "^8.4.2"
-    uuid "^3.1.0"
-    vfile "^4.1.1"
+    uuid "^8.3.0"
+    vfile "^4.2.0"
 
 "@elastic/filesaver@1.1.2":
   version "1.1.2"
@@ -2126,7 +2123,7 @@
   resolved "https://registry.yarnpkg.com/@mapbox/extent/-/extent-0.4.0.tgz#3e591f32e1f0c3981c864239f7b0ac06e610f8a9"
   integrity sha1-PlkfMuHww5gchkI597CsBuYQ+Kk=
 
-"@mapbox/geojson-area@0.2.2", "@mapbox/geojson-area@^0.2.1":
+"@mapbox/geojson-area@^0.2.1":
   version "0.2.2"
   resolved "https://registry.yarnpkg.com/@mapbox/geojson-area/-/geojson-area-0.2.2.tgz#18d7814aa36bf23fbbcc379f8e26a22927debf10"
   integrity sha1-GNeBSqNr8j+7zDefjiaiKSfevxA=
@@ -2156,16 +2153,6 @@
   resolved "https://registry.yarnpkg.com/@mapbox/geojson-normalize/-/geojson-normalize-0.0.1.tgz#1da1e6b3a7add3ad29909b30f438f60581b7cd80"
   integrity sha1-HaHms6et060pkJsw9Dj2BYG3zYA=
 
-"@mapbox/geojson-rewind@^0.4.1":
-  version "0.4.1"
-  resolved "https://registry.yarnpkg.com/@mapbox/geojson-rewind/-/geojson-rewind-0.4.1.tgz#357d79300adb7fec7c1f091512988bca6458f068"
-  integrity sha512-mxo2MEr7izA1uOXcDsw99Kgg6xW3P4H2j4n1lmldsgviIelpssvP+jQDivFKOHrOVJDpTTi5oZJvRcHtU9Uufw==
-  dependencies:
-    "@mapbox/geojson-area" "0.2.2"
-    concat-stream "~1.6.0"
-    minimist "^1.2.5"
-    sharkdown "^0.1.0"
-
 "@mapbox/geojson-rewind@^0.5.0":
   version "0.5.0"
   resolved "https://registry.yarnpkg.com/@mapbox/geojson-rewind/-/geojson-rewind-0.5.0.tgz#91f0ad56008c120caa19414b644d741249f4f560"
@@ -3513,11 +3500,6 @@
   resolved "https://registry.yarnpkg.com/@types/catbox/-/catbox-10.0.1.tgz#266679017749041fe9873fee1131dd2aaa04a07e"
   integrity sha512-ECuJ+f5gGHiLeiE4RlE/xdqv/0JVDToegPV1aTb10tQStYa0Ycq2OJfQukDv3IFaw3B+CMV46jHc5bXe6QXEQg==
 
-"@types/chai@^4.2.11":
-  version "4.2.11"
-  resolved "https://registry.yarnpkg.com/@types/chai/-/chai-4.2.11.tgz#d3614d6c5f500142358e6ed24e1bf16657536c50"
-  integrity sha512-t7uW6eFafjO+qJ3BIV2gGUyZs27egcNRkUdalkud+Qa3+kg//f129iuOFivHDXQ+vnU3fDXuwgv0cqMCbcE8sw==
-
 "@types/chance@^1.0.0":
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/@types/chance/-/chance-1.0.1.tgz#c10703020369602c40dd9428cc6e1437027116df"
@@ -4130,11 +4112,16 @@
     "@types/node" "*"
     "@types/webpack" "*"
 
-"@types/lodash@^4.14.116", "@types/lodash@^4.14.159":
+"@types/lodash@^4.14.159":
   version "4.14.159"
   resolved "https://registry.yarnpkg.com/@types/lodash/-/lodash-4.14.159.tgz#61089719dc6fdd9c5cb46efc827f2571d1517065"
   integrity sha512-gF7A72f7WQN33DpqOWw9geApQPh4M3PxluMtaHxWHXEGSN12/WbcEk/eNSqWNQcQhF66VSZ06vCF94CrHwXJDg==
 
+"@types/lodash@^4.14.160":
+  version "4.14.161"
+  resolved "https://registry.yarnpkg.com/@types/lodash/-/lodash-4.14.161.tgz#a21ca0777dabc6e4f44f3d07f37b765f54188b18"
+  integrity sha512-EP6O3Jkr7bXvZZSZYlsgt5DIjiGr0dXP1/jVEwVLTFgg0d+3lWVQkRavYVQszV7dYUwvg0B8R0MBDpcmXg7XIA==
+
 "@types/log-symbols@^2.0.0":
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/@types/log-symbols/-/log-symbols-2.0.0.tgz#7919e2ec3c8d13879bfdcab310dd7a3f7fc9466d"
@@ -4260,12 +4247,13 @@
   dependencies:
     "@types/node" "*"
 
-"@types/node-fetch@^2.5.0":
-  version "2.5.0"
-  resolved "https://registry.yarnpkg.com/@types/node-fetch/-/node-fetch-2.5.0.tgz#1c55616a4591bdd15a389fbd0da4a55b9502add5"
-  integrity sha512-TLFRywthBgL68auWj+ziWu+vnmmcHCDFC/sqCOQf1xTz4hRq8cu79z8CtHU9lncExGBsB8fXA4TiLDLt6xvMzw==
+"@types/node-fetch@^2.5.7":
+  version "2.5.7"
+  resolved "https://registry.yarnpkg.com/@types/node-fetch/-/node-fetch-2.5.7.tgz#20a2afffa882ab04d44ca786449a276f9f6bbf3c"
+  integrity sha512-o2WVNf5UhWRkxlf6eq+jMZDu7kjgpgJfl4xVNlvryc95O/6F2ld8ztKX+qu+Rjyet93WAWm5LjeX9H5FGkODvw==
   dependencies:
     "@types/node" "*"
+    form-data "^3.0.0"
 
 "@types/node-forge@^0.9.5":
   version "0.9.5"
@@ -4308,10 +4296,10 @@
   resolved "https://registry.yarnpkg.com/@types/npmlog/-/npmlog-4.1.2.tgz#d070fe6a6b78755d1092a3dc492d34c3d8f871c4"
   integrity sha512-4QQmOF5KlwfxJ5IGXFIudkeLCdMABz03RcUXu+LCb24zmln8QW6aDjuGl4d4XPVLf2j+FnjelHTP7dvceAFbhA==
 
-"@types/numeral@^0.0.25":
-  version "0.0.25"
-  resolved "https://registry.yarnpkg.com/@types/numeral/-/numeral-0.0.25.tgz#b6f55062827a4787fe4ab151cf3412a468e65271"
-  integrity sha512-ShHzHkYD+Ldw3eyttptCpUhF1/mkInWwasQkCNXZHOsJMJ/UMa8wXrxSrTJaVk0r4pLK/VnESVM0wFsfQzNEKQ==
+"@types/numeral@^0.0.28":
+  version "0.0.28"
+  resolved "https://registry.yarnpkg.com/@types/numeral/-/numeral-0.0.28.tgz#e43928f0bda10b169b6f7ecf99e3ddf836b8ebe4"
+  integrity sha512-Sjsy10w6XFHDktJJdXzBJmoondAKW+LcGpRFH+9+zXEDj0cOH8BxJuZA9vUDSMAzU1YRJlsPKmZEEiTYDlICLw==
 
 "@types/object-hash@^1.3.0":
   version "1.3.0"
@@ -4442,10 +4430,10 @@
   dependencies:
     "@types/react" "*"
 
-"@types/react-beautiful-dnd@^12.1.2":
-  version "12.1.2"
-  resolved "https://registry.yarnpkg.com/@types/react-beautiful-dnd/-/react-beautiful-dnd-12.1.2.tgz#dfd1bdb072e92c1363e5f7a4c1842eaf95f77b21"
-  integrity sha512-h+0mA4cHmzL4BhyCniB6ZSSZhfO9LpXXbnhdAfa2k7klS03woiOT+Dh5AchY6eoQXk3vQVtqn40YY3u+MwFs8A==
+"@types/react-beautiful-dnd@^13.0.0":
+  version "13.0.0"
+  resolved "https://registry.yarnpkg.com/@types/react-beautiful-dnd/-/react-beautiful-dnd-13.0.0.tgz#e60d3d965312fcf1516894af92dc3e9249587db4"
+  integrity sha512-by80tJ8aTTDXT256Gl+RfLRtFjYbUWOnZuEigJgNsJrSEGxvFe5eY6k3g4VIvf0M/6+xoLgfYWoWonlOo6Wqdg==
   dependencies:
     "@types/react" "*"
 
@@ -4470,10 +4458,10 @@
   dependencies:
     "@types/react" "*"
 
-"@types/react-input-autosize@^2.0.2":
-  version "2.0.2"
-  resolved "https://registry.yarnpkg.com/@types/react-input-autosize/-/react-input-autosize-2.0.2.tgz#6ccdfb100c21b6096c1a04c3c3fac196b0ce61c1"
-  integrity sha512-QzewaD5kog7c6w5e3dretb+50oM8RDdDvVumQKCtPjI6VHyR8lA/HxCiTrv5l9Vgbi4NCitYuix/NorOevlrng==
+"@types/react-input-autosize@^2.2.0":
+  version "2.2.0"
+  resolved "https://registry.yarnpkg.com/@types/react-input-autosize/-/react-input-autosize-2.2.0.tgz#d62b07567088e547500f4693ae25dce0639c1b4e"
+  integrity sha512-8NO64XLmdRKUHeteXnweVnXuuSQr5HMSa4vRyNBUKOeZlimvgHPMtRchFHVHO9k7VpDoufCFYMJ6XHJ44qMTBQ==
   dependencies:
     "@types/react" "*"
 
@@ -4567,7 +4555,7 @@
     "@types/prop-types" "*"
     "@types/react" "*"
 
-"@types/react-window@^1.8.1":
+"@types/react-window@^1.8.2":
   version "1.8.2"
   resolved "https://registry.yarnpkg.com/@types/react-window/-/react-window-1.8.2.tgz#a5a6b2762ce73ffaab7911ee1397cf645f2459fe"
   integrity sha512-gP1xam68Wc4ZTAee++zx6pTdDAH08rAkQrWm4B4F/y6hhmlT9Mgx2q8lTCXnrPHXsr15XjRN9+K2DLKcz44qEQ==
@@ -5833,11 +5821,6 @@ ansi@^0.3.0, ansi@~0.3.1:
   resolved "https://registry.yarnpkg.com/ansi/-/ansi-0.3.1.tgz#0c42d4fb17160d5a9af1e484bace1c66922c1b21"
   integrity sha1-DELU+xcWDVqa8eSEus4cZpIsGyE=
 
-ansicolors@~0.2.1:
-  version "0.2.1"
-  resolved "https://registry.yarnpkg.com/ansicolors/-/ansicolors-0.2.1.tgz#be089599097b74a5c9c4a84a0cdbcdb62bd87aef"
-  integrity sha1-vgiVmQl7dKXJxKhKDNvNtivYeu8=
-
 ansicolors@~0.3.2:
   version "0.3.2"
   resolved "https://registry.yarnpkg.com/ansicolors/-/ansicolors-0.3.2.tgz#665597de86a9ffe3aa9bfbe6cae5c6ea426b4979"
@@ -7271,7 +7254,7 @@ base64-js@^1.0.2:
   resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.2.1.tgz#a91947da1f4a516ea38e5b4ec0ec3773675e0886"
   integrity sha512-dwVUVIXsBZXwTuwnXI9RK8sBmgq09NDHzyR9SAph9eqk76gKK2JSQmZARC2zRC81JC2QTtxD0ARU5qTS25gIGw==
 
-base64-js@^1.1.2, base64-js@^1.2.1, base64-js@^1.3.0, base64-js@^1.3.1:
+base64-js@^1.1.2, base64-js@^1.3.0, base64-js@^1.3.1:
   version "1.3.1"
   resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.3.1.tgz#58ece8cb75dd07e71ed08c736abc5fac4dbf8df1"
   integrity sha512-mLQ4i2QO1ytvGWFWmcngKO//JXAQueZvwEKtjgQFM4jIK0kU+ytMfplL8j+n5mspOfjHwoAg+9yhb7BwAHm36g==
@@ -8150,14 +8133,6 @@ cardinal@^2.1.1:
     ansicolors "~0.3.2"
     redeyed "~2.1.0"
 
-cardinal@~0.4.2:
-  version "0.4.4"
-  resolved "https://registry.yarnpkg.com/cardinal/-/cardinal-0.4.4.tgz#ca5bb68a5b511b90fe93b9acea49bdee5c32bfe2"
-  integrity sha1-ylu2iltRG5D+k7ms6km97lwyv+I=
-  dependencies:
-    ansicolors "~0.2.1"
-    redeyed "~0.4.0"
-
 case-sensitive-paths-webpack-plugin@^2.2.0:
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/case-sensitive-paths-webpack-plugin/-/case-sensitive-paths-webpack-plugin-2.2.0.tgz#3371ef6365ef9c25fa4b81c16ace0e9c7dc58c3e"
@@ -8493,7 +8468,7 @@ chroma-js@^1.4.1:
   resolved "https://registry.yarnpkg.com/chroma-js/-/chroma-js-1.4.1.tgz#eb2d9c4d1ff24616be84b35119f4d26f8205f134"
   integrity sha512-jTwQiT859RTFN/vIf7s+Vl/Z2LcMrvMv3WUFmd/4u76AdlFC0NTNgqEEFPcRiHmAswPsMiQEDZLM8vX8qXpZNQ==
 
-chroma-js@^2.0.4, chroma-js@^2.1.0:
+chroma-js@^2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/chroma-js/-/chroma-js-2.1.0.tgz#c0be48a21fe797ef8965608c1c4f911ef2da49d5"
   integrity sha512-uiRdh4ZZy+UTPSrAdp8hqEdVb1EllLtTHOt5TMaOjJUvi+O54/83Fc5K2ld1P+TJX+dw5B+8/sCgzI6eaur/lg==
@@ -9023,10 +8998,10 @@ colorspace@1.1.x:
     color "3.0.x"
     text-hex "1.0.x"
 
-combined-stream@^1.0.6, combined-stream@~1.0.6:
-  version "1.0.7"
-  resolved "https://registry.yarnpkg.com/combined-stream/-/combined-stream-1.0.7.tgz#2d1d24317afb8abe95d6d2c0b07b57813539d828"
-  integrity sha512-brWl9y6vOB1xYPZcpZde3N9zDByXTosAeMDo4p1wzo6UMOX4vumB+TP1RZ76sfE6Md68Q0NJSrE/gbezd4Ul+w==
+combined-stream@^1.0.6, combined-stream@^1.0.8, combined-stream@~1.0.6:
+  version "1.0.8"
+  resolved "https://registry.yarnpkg.com/combined-stream/-/combined-stream-1.0.8.tgz#c3d45a8b34fd730631a110a8a2520682b31d5a7f"
+  integrity sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==
   dependencies:
     delayed-stream "~1.0.0"
 
@@ -11418,13 +11393,6 @@ encodeurl@^1.0.2, encodeurl@~1.0.2:
   resolved "https://registry.yarnpkg.com/encodeurl/-/encodeurl-1.0.2.tgz#ad3ff4c86ec2d029322f5a02c3a9a606c95b3f59"
   integrity sha1-rT/0yG7C0CkyL1oCw6mmBslbP1k=
 
-encoding@^0.1.11:
-  version "0.1.12"
-  resolved "https://registry.yarnpkg.com/encoding/-/encoding-0.1.12.tgz#538b66f3ee62cd1ab51ec323829d1f9480c74beb"
-  integrity sha1-U4tm8+5izRq1HsMjgp0flIDHS+s=
-  dependencies:
-    iconv-lite "~0.4.13"
-
 end-of-stream@^1.0.0, end-of-stream@^1.1.0, end-of-stream@^1.4.1, end-of-stream@^1.4.4:
   version "1.4.4"
   resolved "https://registry.yarnpkg.com/end-of-stream/-/end-of-stream-1.4.4.tgz#5ae64a5f45057baf3626ec14da0ca5e4b2431eb0"
@@ -12477,11 +12445,6 @@ expand-tilde@^2.0.0, expand-tilde@^2.0.2:
   dependencies:
     homedir-polyfill "^1.0.1"
 
-expect.js@~0.2.0:
-  version "0.2.0"
-  resolved "https://registry.yarnpkg.com/expect.js/-/expect.js-0.2.0.tgz#1028533d2c1c363f74a6796ff57ec0520ded2be1"
-  integrity sha1-EChTPSwcNj90pnlv9X7AUg3tK+E=
-
 expect@^24.8.0, expect@^24.9.0:
   version "24.9.0"
   resolved "https://registry.yarnpkg.com/expect/-/expect-24.9.0.tgz#b75165b4817074fa4a157794f46fe9f1ba15b6ca"
@@ -13393,6 +13356,15 @@ form-data@^2.5.0:
     combined-stream "^1.0.6"
     mime-types "^2.1.12"
 
+form-data@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/form-data/-/form-data-3.0.0.tgz#31b7e39c85f1355b7139ee0c647cf0de7f83c682"
+  integrity sha512-CKMFDglpbMi6PyN+brwB9Q/GOw0eAnsrEZDgcsH5Krhz5Od/haKHAX0NmQfha2zPPz0JpWzA7GJHGSnvCRLWsg==
+  dependencies:
+    asynckit "^0.4.0"
+    combined-stream "^1.0.8"
+    mime-types "^2.1.12"
+
 format@^0.2.0:
   version "0.2.2"
   resolved "https://registry.yarnpkg.com/format/-/format-0.2.2.tgz#d6170107e9efdc4ed30c9dc39016df942b5cb58b"
@@ -16799,7 +16771,7 @@ is-ssh@^1.3.0:
   dependencies:
     protocols "^1.1.0"
 
-is-stream@^1.0.0, is-stream@^1.0.1, is-stream@^1.1.0:
+is-stream@^1.0.0, is-stream@^1.1.0:
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/is-stream/-/is-stream-1.1.0.tgz#12d4a3dd4e68e0b79ceb8dbc84173ae80d91ca44"
   integrity sha1-EtSj3U5o4Lec6428hBc66A2RykQ=
@@ -19941,27 +19913,7 @@ minimist-options@^4.0.2:
     is-plain-obj "^1.1.0"
     kind-of "^6.0.3"
 
-minimist@0.0.5:
-  version "0.0.5"
-  resolved "https://registry.yarnpkg.com/minimist/-/minimist-0.0.5.tgz#d7aa327bcecf518f9106ac6b8f003fa3bcea8566"
-  integrity sha1-16oye87PUY+RBqxrjwA/o7zqhWY=
-
-minimist@0.0.8:
-  version "0.0.8"
-  resolved "https://registry.yarnpkg.com/minimist/-/minimist-0.0.8.tgz#857fcabfc3397d2625b8228262e86aa7a011b05d"
-  integrity sha1-hX/Kv8M5fSYluCKCYuhqp6ARsF0=
-
-minimist@1.1.x:
-  version "1.1.3"
-  resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.1.3.tgz#3bedfd91a92d39016fcfaa1c681e8faa1a1efda8"
-  integrity sha1-O+39kaktOQFvz6ocaB6Pqhoe/ag=
-
-minimist@1.2.0:
-  version "1.2.0"
-  resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.0.tgz#a35008b20f41383eec1fb914f4cd5df79a264284"
-  integrity sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=
-
-minimist@^1.1.0, minimist@^1.1.1, minimist@^1.1.3, minimist@^1.2.0, minimist@^1.2.5, minimist@~1.2.0:
+minimist@0.0.8, minimist@1.1.x, minimist@1.2.0, minimist@^1.1.0, minimist@^1.1.1, minimist@^1.1.3, minimist@^1.2.0, minimist@^1.2.5, minimist@~1.2.0:
   version "1.2.5"
   resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.5.tgz#67d66014b66a6a8aaa0c083c5fd58df4e4e97602"
   integrity sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==
@@ -20616,28 +20568,10 @@ node-environment-flags@1.0.6:
     object.getownpropertydescriptors "^2.0.3"
     semver "^5.7.0"
 
-node-fetch@1.7.3, node-fetch@^1.0.1:
-  version "1.7.3"
-  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-1.7.3.tgz#980f6f72d85211a5347c6b2bc18c5b84c3eb47ef"
-  integrity sha512-NhZ4CsKx7cYm2vSrBAr2PvFOe6sWDf0UYLRqA6svUYg7+/TSfVAu49jYC4BvQ4Sms9SZgdqGBgroqfDhJdTyKQ==
-  dependencies:
-    encoding "^0.1.11"
-    is-stream "^1.0.1"
-
-node-fetch@2.1.2:
-  version "2.1.2"
-  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.1.2.tgz#ab884e8e7e57e38a944753cec706f788d1768bb5"
-  integrity sha1-q4hOjn5X44qUR1POxwb3iNF2i7U=
-
-node-fetch@^2.3.0:
-  version "2.3.0"
-  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.3.0.tgz#1a1d940bbfb916a1d3e0219f037e89e71f8c5fa5"
-  integrity sha512-MOd8pV3fxENbryESLgVIeaGKrdl+uaYhCSSVkjeOb/31/njTpcis5aWfdqgNlHIrKOLRbMnfPINPOML2CIFeXA==
-
-node-fetch@^2.6.0:
-  version "2.6.0"
-  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.0.tgz#e633456386d4aa55863f676a7ab0daa8fdecb0fd"
-  integrity sha512-8dG4H5ujfvFiqDmVu9fQ5bOHUC15JMjMY/Zumv26oOvvVJjM67KF8koCWIabKQ1GJIa9r2mMZscBq/TbdOcmNA==
+node-fetch@2.1.2, node-fetch@2.6.1, node-fetch@^1.0.1, node-fetch@^2.3.0, node-fetch@^2.6.0, node-fetch@^2.6.1:
+  version "2.6.1"
+  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.1.tgz#045bd323631f76ed2e2b55573394416b639a0052"
+  integrity sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==
 
 node-forge@0.9.0:
   version "0.9.0"
@@ -24260,16 +24194,6 @@ readable-stream@1.0, "readable-stream@>=1.0.33-1 <1.1.0-0":
     string_decoder "^1.1.1"
     util-deprecate "^1.0.1"
 
-readable-stream@~1.1.0:
-  version "1.1.14"
-  resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-1.1.14.tgz#7cf4c54ef648e3813084c636dd2079e166c081d9"
-  integrity sha1-fPTFTvZI44EwhMY23SB54WbAgdk=
-  dependencies:
-    core-util-is "~1.0.0"
-    inherits "~2.0.1"
-    isarray "0.0.1"
-    string_decoder "~0.10.x"
-
 readable-stream@~2.0.0:
   version "2.0.6"
   resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.0.6.tgz#8f90341e68a53ccc928788dacfcd11b36eb9b78e"
@@ -24419,13 +24343,6 @@ redent@^3.0.0:
     indent-string "^4.0.0"
     strip-indent "^3.0.0"
 
-redeyed@~0.4.0:
-  version "0.4.4"
-  resolved "https://registry.yarnpkg.com/redeyed/-/redeyed-0.4.4.tgz#37e990a6f2b21b2a11c2e6a48fd4135698cba97f"
-  integrity sha1-N+mQpvKyGyoRwuakj9QTVpjLqX8=
-  dependencies:
-    esprima "~1.0.4"
-
 redeyed@~2.1.0:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/redeyed/-/redeyed-2.1.1.tgz#8984b5815d99cb220469c99eeeffe38913e6cc0b"
@@ -25963,18 +25880,6 @@ shallowequal@1.1.0, shallowequal@^1.1.0:
   resolved "https://registry.yarnpkg.com/shallowequal/-/shallowequal-1.1.0.tgz#188d521de95b9087404fd4dcb68b13df0ae4e7f8"
   integrity sha512-y0m1JoUZSlPAjXVtPPW70aZWfIL/dSP7AFkRnniLCrK/8MDKog3TySTBmckD+RObVxH0v4Tox67+F14PdED2oQ==
 
-sharkdown@^0.1.0:
-  version "0.1.0"
-  resolved "https://registry.yarnpkg.com/sharkdown/-/sharkdown-0.1.0.tgz#61d4fe529e75d02442127cc9234362265099214f"
-  integrity sha1-YdT+Up510CRCEnzJI0NiJlCZIU8=
-  dependencies:
-    cardinal "~0.4.2"
-    expect.js "~0.2.0"
-    minimist "0.0.5"
-    split "~0.2.10"
-    stream-spigot "~2.1.2"
-    through "~2.3.4"
-
 shebang-command@^1.2.0:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/shebang-command/-/shebang-command-1.2.0.tgz#44aac65b695b03398968c39f363fee5deafdf1ea"
@@ -26485,13 +26390,6 @@ split-string@^3.0.1, split-string@^3.0.2:
   dependencies:
     extend-shallow "^3.0.0"
 
-split@~0.2.10:
-  version "0.2.10"
-  resolved "https://registry.yarnpkg.com/split/-/split-0.2.10.tgz#67097c601d697ce1368f418f06cd201cf0521a57"
-  integrity sha1-Zwl8YB1pfOE2j0GPBs0gHPBSGlc=
-  dependencies:
-    through "2"
-
 sprintf-js@^1.0.3:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.1.1.tgz#36be78320afe5801f6cea3ee78b6e5aab940ea0c"
@@ -26749,13 +26647,6 @@ stream-slicer@0.0.6:
   resolved "https://registry.yarnpkg.com/stream-slicer/-/stream-slicer-0.0.6.tgz#f86b2ac5c2440b7a0a87b71f33665c0788046138"
   integrity sha1-+GsqxcJEC3oKh7cfM2ZcB4gEYTg=
 
-stream-spigot@~2.1.2:
-  version "2.1.2"
-  resolved "https://registry.yarnpkg.com/stream-spigot/-/stream-spigot-2.1.2.tgz#7de145e819f8dd0db45090d13dcf73a8ed3cc035"
-  integrity sha1-feFF6Bn43Q20UJDRPc9zqO08wDU=
-  dependencies:
-    readable-stream "~1.1.0"
-
 strict-uri-encode@^1.0.0:
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/strict-uri-encode/-/strict-uri-encode-1.1.0.tgz#279b225df1d582b1f54e65addd4352e18faa0713"
@@ -27764,7 +27655,7 @@ through2@~2.0.3:
     readable-stream "~2.3.6"
     xtend "~4.0.1"
 
-through@2, "through@>=2.2.7 <3", through@^2.3.4, through@^2.3.6, through@^2.3.8, through@~2.3.4, through@~2.3.6, through@~2.3.8:
+"through@>=2.2.7 <3", through@^2.3.4, through@^2.3.6, through@^2.3.8, through@~2.3.4, through@~2.3.6, through@~2.3.8:
   version "2.3.8"
   resolved "https://registry.yarnpkg.com/through/-/through-2.3.8.tgz#0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5"
   integrity sha1-DdTJ/6q8NXlgsbckEV1+Doai4fU=
@@ -29152,6 +29043,11 @@ uuid@^3.0.0, uuid@^3.1.0, uuid@^3.3.2, uuid@^3.3.3, uuid@^3.4.0:
   resolved "https://registry.yarnpkg.com/uuid/-/uuid-3.4.0.tgz#b23e4358afa8a202fe7a100af1f5f883f02007ee"
   integrity sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==
 
+uuid@^8.3.0:
+  version "8.3.0"
+  resolved "https://registry.yarnpkg.com/uuid/-/uuid-8.3.0.tgz#ab738085ca22dc9a8c92725e459b1d507df5d6ea"
+  integrity sha512-fX6Z5o4m6XsXBdli9g7DtWgAx+osMsRRZFKma1mIUsLCz6vRvv+pz5VNbyu9UEDzpMWulZfvpgb/cmDXVulYFQ==
+
 v8-compile-cache@2.0.3:
   version "2.0.3"
   resolved "https://registry.yarnpkg.com/v8-compile-cache/-/v8-compile-cache-2.0.3.tgz#00f7494d2ae2b688cfe2899df6ed2c54bef91dbe"
@@ -29657,7 +29553,7 @@ vfile@^4.0.0:
     unist-util-stringify-position "^2.0.0"
     vfile-message "^2.0.0"
 
-vfile@^4.1.1:
+vfile@^4.2.0:
   version "4.2.0"
   resolved "https://registry.yarnpkg.com/vfile/-/vfile-4.2.0.tgz#26c78ac92eb70816b01d4565e003b7e65a2a0e01"
   integrity sha512-a/alcwCvtuc8OX92rqqo7PflxiCgXRFjdyoGVuYV+qbgCb0GgZJRvIgCD4+U/Kl1yhaRsaTwksF88xbPyGsgpw==