Disable esql on serverless

config/serverless.security.yml

@@ -35,7 +35,6 @@ xpack.fleet.internal.registry.spec.max: '3.0'
 
 # Serverless security specific options
 xpack.securitySolution.enableExperimental:
-  - discoverInTimeline
   - esqlRulesDisabled
 
 xpack.ml.ad.enabled: true

src/plugins/discover/public/application/main/components/top_nav/discover_topnav.test.tsx

@@ -46,6 +46,11 @@ const mockSearchBarCustomizationWithCustomSearchBar: SearchBarCustomization = {
   CustomSearchBar: MockCustomSearchBar,
 };
 
+const mockSearchBarCustomizationWithHiddenDataViewPicker: SearchBarCustomization = {
+  id: 'search_bar',
+  hideDataViewPicker: true,
+};
+
 let mockUseCustomizations = false;
 
 jest.mock('../../../../customizations', () => ({
@@ -256,5 +261,23 @@ describe('Discover topnav component', () => {
       ).find(mockSearchBarCustomization.CustomDataViewPicker!);
       expect(dataViewPickerOverride.length).toBe(1);
     });
+
+    it('should not render the dataView picker when hideDataViewPicker is true', () => {
+      (useDiscoverCustomization as jest.Mock).mockImplementation((id: DiscoverCustomizationId) => {
+        if (id === 'search_bar') {
+          return mockSearchBarCustomizationWithHiddenDataViewPicker;
+        }
+      });
+
+      const props = getProps();
+      const component = mountWithIntl(
+        <DiscoverMainProvider value={props.stateContainer}>
+          <DiscoverTopNav {...props} />
+        </DiscoverMainProvider>
+      );
+
+      const topNav = component.find(mockDiscoverService.navigation.ui.AggregateQueryTopNavMenu);
+      expect(topNav.prop('dataViewPickerComponentProps')).toBeUndefined();
+    });
   });
 });

src/plugins/discover/public/application/main/components/top_nav/discover_topnav.tsx

@@ -114,6 +114,7 @@ export const DiscoverTopNav = ({
   }, [dataViewEditor, stateContainer]);
 
   const topNavCustomization = useDiscoverCustomization('top_nav');
+
   const topNavMenu = useMemo(
     () =>
       getTopNavLinks({
@@ -171,6 +172,17 @@ export const DiscoverTopNav = ({
   if (isESQLModeEnabled) {
     supportedTextBasedLanguages.push('ESQL');
   }
+
+  const searchBarCustomization = useDiscoverCustomization('search_bar');
+
+  const SearchBar = useMemo(
+    () => searchBarCustomization?.CustomSearchBar ?? AggregateQueryTopNavMenu,
+    [searchBarCustomization?.CustomSearchBar, AggregateQueryTopNavMenu]
+  );
+
+  const shouldHideDefaultDataviewPicker =
+    !!searchBarCustomization?.CustomDataViewPicker || !!searchBarCustomization?.hideDataViewPicker;
+
   const dataViewPickerProps: DataViewPickerProps = {
     trigger: {
       label: dataView?.getName() || '',
@@ -201,13 +213,6 @@ export const DiscoverTopNav = ({
     [services, stateContainer]
   );
 
-  const searchBarCustomization = useDiscoverCustomization('search_bar');
-
-  const SearchBar = useMemo(
-    () => searchBarCustomization?.CustomSearchBar ?? AggregateQueryTopNavMenu,
-    [searchBarCustomization?.CustomSearchBar, AggregateQueryTopNavMenu]
-  );
-
   return (
     <SearchBar
       appName="discover"
@@ -231,7 +236,7 @@ export const DiscoverTopNav = ({
         ) : undefined
       }
       dataViewPickerComponentProps={
-        searchBarCustomization?.CustomDataViewPicker ? undefined : dataViewPickerProps
+        shouldHideDefaultDataviewPicker ? undefined : dataViewPickerProps
       }
       displayStyle="detached"
       textBasedLanguageModeErrors={

src/plugins/discover/public/customizations/customization_types/search_bar_customization.ts

@@ -15,4 +15,5 @@ export interface SearchBarCustomization {
   CustomDataViewPicker?: ComponentType;
   PrependFilterBar?: ComponentType;
   CustomSearchBar?: ComponentType<TopNavMenuProps<AggregateQuery>>;
+  hideDataViewPicker?: boolean;
 }

x-pack/plugins/security_solution/common/experimental_features.ts

@@ -103,13 +103,6 @@ export const allowedExperimentalValues = Object.freeze({
    * Enables experimental Entity Analytics HTTP endpoints
    */
   riskScoringRoutesEnabled: false,
-  /*
-   *
-   * Enables Discover embedded within timeline
-   *
-   * */
-  discoverInTimeline: false,
-
   /**
    * disables ES|QL rules
    */

x-pack/plugins/security_solution/public/common/components/discover_in_timeline/__mocks__/use_discover_in_timeline_actions.tsx

@@ -7,22 +7,22 @@
 
 export const useDiscoverInTimelineActions = () => {
   return {
-    resetDiscoverAppState: jest.fn(),
+    resetDiscoverAppState: jest.fn().mockResolvedValue(true),
     restoreDiscoverAppStateFromSavedSearch: jest.fn(),
     updateSavedSearch: jest.fn(),
     getAppStateFromSavedSearch: jest.fn(),
-    defaultDiscoverAppState: {
+    getDefaultDiscoverAppState: () => ({
       query: {
         query: '',
-        language: 'kuery',
+        language: 'esql',
       },
       sort: [['@timestamp', 'desc']],
       columns: [],
       index: 'security-solution-default',
       interval: 'auto',
       filters: [],
-      hideChart: true,
+      hideChart: false,
       grid: {},
-    },
+    }),
   };
 };

x-pack/plugins/security_solution/public/common/components/discover_in_timeline/use_discover_in_timeline_actions.test.tsx

@@ -25,8 +25,12 @@ import { createStore } from '../../store';
 import { TimelineId } from '../../../../common/types';
 import type { ComponentType, FC, PropsWithChildren } from 'react';
 import React from 'react';
+import type { DataView } from '@kbn/data-views-plugin/common';
+import TestRenderer from 'react-test-renderer';
 
-const mockDiscoverStateContainerRef = {
+const { act } = TestRenderer;
+
+let mockDiscoverStateContainerRef = {
   current: discoverPluginMock.getDiscoverStateMock({}),
 };
 
@@ -64,6 +68,9 @@ const getTestProviderWithCustomState = (state: State = mockState) => {
 };
 
 const renderTestHook = (customWrapper: ComponentType = getTestProviderWithCustomState()) => {
+  mockDiscoverStateContainerRef = {
+    current: discoverPluginMock.getDiscoverStateMock({}),
+  };
   return renderHook(() => useDiscoverInTimelineActions(mockDiscoverStateContainerRef), {
     wrapper: customWrapper,
   });
@@ -120,6 +127,13 @@ export const savedSearchMock = {
 
 const startServicesMock = createStartServicesMock();
 
+startServicesMock.dataViews.get = jest.fn(
+  async () =>
+    ({
+      getIndexPattern: jest.fn(),
+    } as unknown as DataView)
+);
+
 describe('useDiscoverInTimelineActions', () => {
   beforeEach(() => {
     (useKibana as jest.Mock).mockImplementation(() => ({
@@ -188,15 +202,15 @@ describe('useDiscoverInTimelineActions', () => {
   describe('resetDiscoverAppState', () => {
     it('should reset Discover AppState to a default state', async () => {
       const { result, waitFor } = renderTestHook();
-      result.current.resetDiscoverAppState();
+      await result.current.resetDiscoverAppState();
       await waitFor(() => {
         const appState = mockDiscoverStateContainerRef.current.appState.getState();
-        expect(appState).toMatchObject(result.current.defaultDiscoverAppState);
+        expect(appState).toMatchObject(result.current.getDefaultDiscoverAppState());
       });
     });
     it('should reset Discover time to a default state', async () => {
       const { result, waitFor } = renderTestHook();
-      result.current.resetDiscoverAppState();
+      await result.current.resetDiscoverAppState();
       await waitFor(() => {
         const globalState = mockDiscoverStateContainerRef.current.globalState.get();
         expect(globalState).toMatchObject({ time: { from: 'now-15m', to: 'now' } });
@@ -206,7 +220,9 @@ describe('useDiscoverInTimelineActions', () => {
   describe('updateSavedSearch', () => {
     it('should add defaults to the savedSearch before updating saved search', async () => {
       const { result } = renderTestHook();
-      await result.current.updateSavedSearch(savedSearchMock, TimelineId.active);
+      await act(async () => {
+        await result.current.updateSavedSearch(savedSearchMock, TimelineId.active);
+      });
 
       expect(startServicesMock.savedSearch.save).toHaveBeenNthCalledWith(
         1,
@@ -242,7 +258,9 @@ describe('useDiscoverInTimelineActions', () => {
 
       const LocalTestProvider = getTestProviderWithCustomState(localMockState);
       const { result } = renderTestHook(LocalTestProvider);
-      await result.current.updateSavedSearch(savedSearchMock, TimelineId.active);
+      await act(async () => {
+        await result.current.updateSavedSearch(savedSearchMock, TimelineId.active);
+      });
 
       expect(startServicesMock.savedSearch.save).toHaveBeenNthCalledWith(
         1,

x-pack/plugins/security_solution/public/common/components/discover_in_timeline/use_discover_in_timeline_actions.tsx

@@ -40,7 +40,11 @@ export const useDiscoverInTimelineActions = (
   const { addError } = useAppToasts();
 
   const {
-    services: { customDataService: discoverDataService, savedSearch: savedSearchService },
+    services: {
+      customDataService: discoverDataService,
+      savedSearch: savedSearchService,
+      dataViews: dataViewService,
+    },
   } = useKibana();
 
   const dispatch = useDispatch();
@@ -69,18 +73,23 @@ export const useDiscoverInTimelineActions = (
     },
   });
 
-  const defaultDiscoverAppState: DiscoverAppState = useMemo(() => {
+  const getDefaultDiscoverAppState: () => Promise<DiscoverAppState> = useCallback(async () => {
+    const localDataViewId = dataViewId ?? 'security-solution-default';
+
+    const dataView = await dataViewService.get(localDataViewId);
+
     return {
-      query: discoverDataService.query.queryString.getDefaultQuery(),
+      query: {
+        esql: dataView ? `from ${dataView.getIndexPattern()} | limit 10` : '',
+      },
       sort: [['@timestamp', 'desc']],
       columns: [],
-      index: dataViewId ?? 'security-solution-default',
       interval: 'auto',
       filters: [],
       hideChart: true,
       grid: {},
     };
-  }, [discoverDataService, dataViewId]);
+  }, [dataViewService, dataViewId]);
 
   /*
    * generates Appstate from a given saved Search object
@@ -123,13 +132,14 @@ export const useDiscoverInTimelineActions = (
    * resets discover state to a default value
    *
    * */
-  const resetDiscoverAppState = useCallback(() => {
+  const resetDiscoverAppState = useCallback(async () => {
+    const defaultDiscoverAppState = await getDefaultDiscoverAppState();
     discoverStateContainer.current?.appState.set(defaultDiscoverAppState);
     discoverStateContainer.current?.globalState.set({
       ...discoverStateContainer.current?.globalState.get(),
       time: defaultDiscoverTimeRange,
     });
-  }, [defaultDiscoverAppState, discoverStateContainer]);
+  }, [getDefaultDiscoverAppState, discoverStateContainer]);
 
   const persistSavedSearch = useCallback(
     async (savedSearch: SavedSearch, savedSearchOption: SaveSavedSearchOptions) => {
@@ -220,14 +230,14 @@ export const useDiscoverInTimelineActions = (
       restoreDiscoverAppStateFromSavedSearch,
       updateSavedSearch,
       getAppStateFromSavedSearch,
-      defaultDiscoverAppState,
+      getDefaultDiscoverAppState,
     }),
     [
       resetDiscoverAppState,
       restoreDiscoverAppStateFromSavedSearch,
       updateSavedSearch,
       getAppStateFromSavedSearch,
-      defaultDiscoverAppState,
+      getDefaultDiscoverAppState,
     ]
   );
 

x-pack/plugins/security_solution/public/mocks.ts

@@ -19,12 +19,14 @@ export const contractStartServicesMock: ContractStartServices = {
   getComponent$: jest.fn(),
   upselling,
   dataQualityPanelConfig: undefined,
+  timelineConfig: undefined,
 };
 
 const setupMock = (): PluginSetup => ({
   resolver: jest.fn(),
   setAppLinksSwitcher: jest.fn(),
   setDataQualityPanelConfig: jest.fn(),
+  setTimelineConfig: jest.fn(),
 });
 
 const startMock = (): PluginStart => ({

x-pack/plugins/security_solution/public/overview/types.ts

@@ -8,3 +8,7 @@
 export interface DataQualityPanelConfig {
   isILMAvailable: boolean;
 }
+
+export interface TimelineConfig {
+  esqlEnabled: boolean;
+}

x-pack/plugins/security_solution/public/plugin_contract.ts

@@ -9,7 +9,7 @@ import { BehaviorSubject } from 'rxjs';
 import type { RouteProps } from 'react-router-dom';
 import { UpsellingService } from '@kbn/security-solution-upselling/service';
 import type { ContractStartServices, PluginSetup, PluginStart } from './types';
-import type { DataQualityPanelConfig } from './overview/types';
+import type { DataQualityPanelConfig, TimelineConfig } from './overview/types';
 import type { AppLinksSwitcher } from './common/links';
 import { navLinks$ } from './common/links/nav_links';
 import { breadcrumbsNav$ } from './common/breadcrumbs';
@@ -22,6 +22,7 @@ export class PluginContract {
   public extraRoutes$: BehaviorSubject<RouteProps[]>;
   public appLinksSwitcher: AppLinksSwitcher;
   public dataQualityPanelConfig?: DataQualityPanelConfig;
+  public timelineConfig?: TimelineConfig;
 
   constructor() {
     this.extraRoutes$ = new BehaviorSubject<RouteProps[]>([]);
@@ -38,6 +39,7 @@ export class PluginContract {
       getComponent$: this.componentsService.getComponent$.bind(this.componentsService),
       upselling: this.upsellingService,
       dataQualityPanelConfig: this.dataQualityPanelConfig,
+      timelineConfig: this.timelineConfig,
     };
   }
 
@@ -50,6 +52,9 @@ export class PluginContract {
       setDataQualityPanelConfig: (dataQualityPanelConfig) => {
         this.dataQualityPanelConfig = dataQualityPanelConfig;
       },
+      setTimelineConfig: (timelineConfig) => {
+        this.timelineConfig = timelineConfig;
+      },
     };
   }
 

x-pack/plugins/security_solution/public/timelines/components/timeline/discover_tab_content/customizations/use_search_bar_customizations.tsx

@@ -15,6 +15,7 @@ export const useSearchBarCustomizations = () => {
     customizations.set({
       id: 'search_bar',
       CustomSearchBar: CustomStatefulTopNavKqlQueryBar,
+      hideDataViewPicker: true,
     });
   };
 

x-pack/plugins/security_solution/public/timelines/components/timeline/discover_tab_content/customizations/use_set_discover_customizations.ts

@@ -11,7 +11,6 @@ import { useSearchBarCustomizations } from './use_search_bar_customizations';
 
 export const useSetDiscoverCustomizationCallbacks = (): CustomizationCallback[] => {
   const searchBarCustomizationCallback = useSearchBarCustomizations();
-
   const histogramCustomizationCallback = useHistogramCustomization();
 
   return [searchBarCustomizationCallback, histogramCustomizationCallback];