Merge branch 'master' into issues/102179

elastic · Jun 30, 2021 · 2c365c7 · 2c365c7
2 parents 9f90cc2 + 8cf6e00
commit 2c365c7
Show file tree

Hide file tree

Showing 48 changed files with 1,408 additions and 321 deletions.
diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
@@ -28,9 +28,13 @@ readonly links: {
             readonly elasticsearchModule: string;
             readonly startup: string;
             readonly exportedFields: string;
+            readonly suricataModule: string;
+            readonly zeekModule: string;
         };
         readonly auditbeat: {
             readonly base: string;
+            readonly auditdModule: string;
+            readonly systemModule: string;
         };
         readonly metricbeat: {
             readonly base: string;
@@ -47,6 +51,9 @@ readonly links: {
         readonly heartbeat: {
             readonly base: string;
         };
+        readonly libbeat: {
+            readonly getStarted: string;
+        };
         readonly logstash: {
             readonly base: string;
         };
@@ -123,6 +130,10 @@ readonly links: {
         readonly siem: {
             readonly guide: string;
             readonly gettingStarted: string;
+            readonly ml: string;
+            readonly ruleChangeLog: string;
+            readonly detectionsReq: string;
+            readonly networkMap: string;
         };
         readonly query: {
             readonly eql: string;

diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
@@ -51,9 +51,13 @@ export class DocLinksService {
           elasticsearchOutput: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/elasticsearch-output.html`,
           startup: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-starting.html`,
           exportedFields: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/exported-fields.html`,
+          suricataModule: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-module-suricata.html`,
+          zeekModule: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-module-zeek.html`,
         },
         auditbeat: {
           base: `${ELASTIC_WEBSITE_URL}guide/en/beats/auditbeat/${DOC_LINK_VERSION}`,
+          auditdModule: `${ELASTIC_WEBSITE_URL}guide/en/beats/auditbeat/${DOC_LINK_VERSION}/auditbeat-module-auditd.html`,
+          systemModule: `${ELASTIC_WEBSITE_URL}guide/en/beats/auditbeat/${DOC_LINK_VERSION}/auditbeat-module-system.html`,
         },
         enterpriseSearch: {
           base: `${ELASTIC_WEBSITE_URL}guide/en/enterprise-search/${DOC_LINK_VERSION}`,
@@ -70,6 +74,9 @@ export class DocLinksService {
         heartbeat: {
           base: `${ELASTIC_WEBSITE_URL}guide/en/beats/heartbeat/${DOC_LINK_VERSION}`,
         },
+        libbeat: {
+          getStarted: `${ELASTIC_WEBSITE_URL}guide/en/beats/libbeat/${DOC_LINK_VERSION}/getting-started.html`,
+        },
         logstash: {
           base: `${ELASTIC_WEBSITE_URL}guide/en/logstash/${DOC_LINK_VERSION}`,
         },
@@ -195,6 +202,10 @@ export class DocLinksService {
         siem: {
           guide: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/index.html`,
           gettingStarted: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/index.html`,
+          ml: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/machine-learning.html`,
+          ruleChangeLog: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/prebuilt-rules-changelog.html`,
+          detectionsReq: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/detections-permissions-section.html`,
+          networkMap: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/conf-map-ui.html`,
         },
         query: {
           eql: `${ELASTICSEARCH_DOCS}eql.html`,
@@ -451,9 +462,13 @@ export interface DocLinksStart {
       readonly elasticsearchModule: string;
       readonly startup: string;
       readonly exportedFields: string;
+      readonly suricataModule: string;
+      readonly zeekModule: string;
     };
     readonly auditbeat: {
       readonly base: string;
+      readonly auditdModule: string;
+      readonly systemModule: string;
     };
     readonly metricbeat: {
       readonly base: string;
@@ -470,6 +485,9 @@ export interface DocLinksStart {
     readonly heartbeat: {
       readonly base: string;
     };
+    readonly libbeat: {
+      readonly getStarted: string;
+    };
     readonly logstash: {
       readonly base: string;
     };
@@ -546,6 +564,10 @@ export interface DocLinksStart {
     readonly siem: {
       readonly guide: string;
       readonly gettingStarted: string;
+      readonly ml: string;
+      readonly ruleChangeLog: string;
+      readonly detectionsReq: string;
+      readonly networkMap: string;
     };
     readonly query: {
       readonly eql: string;

diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
@@ -507,9 +507,13 @@ export interface DocLinksStart {
             readonly elasticsearchModule: string;
             readonly startup: string;
             readonly exportedFields: string;
+            readonly suricataModule: string;
+            readonly zeekModule: string;
         };
         readonly auditbeat: {
             readonly base: string;
+            readonly auditdModule: string;
+            readonly systemModule: string;
         };
         readonly metricbeat: {
             readonly base: string;
@@ -526,6 +530,9 @@ export interface DocLinksStart {
         readonly heartbeat: {
             readonly base: string;
         };
+        readonly libbeat: {
+            readonly getStarted: string;
+        };
         readonly logstash: {
             readonly base: string;
         };
@@ -602,6 +609,10 @@ export interface DocLinksStart {
         readonly siem: {
             readonly guide: string;
             readonly gettingStarted: string;
+            readonly ml: string;
+            readonly ruleChangeLog: string;
+            readonly detectionsReq: string;
+            readonly networkMap: string;
         };
         readonly query: {
             readonly eql: string;

diff --git a/src/plugins/vis_type_timeseries/common/fields_utils.ts b/src/plugins/vis_type_timeseries/common/fields_utils.ts
@@ -25,7 +25,7 @@ export class FieldNotFoundError extends Error {
     return this.constructor.name;
   }
 
-  public get body() {
+  public get errBody() {
     return this.message;
   }
 }

diff --git a/...blic/application/lib/validate_interval.ts → ...pe_timeseries/common/validate_interval.ts b/...blic/application/lib/validate_interval.ts → ...pe_timeseries/common/validate_interval.ts
@@ -7,20 +7,29 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { GTE_INTERVAL_RE } from '../../../common/interval_regexp';
-import { search } from '../../../../../plugins/data/public';
+import { GTE_INTERVAL_RE } from './interval_regexp';
+import { parseInterval, TimeRangeBounds } from '../../data/common';
 
-import type { TimeRangeBounds } from '../../../../data/common';
-import type { TimeseriesVisParams } from '../../types';
+export class ValidateIntervalError extends Error {
+  constructor() {
+    super(
+      i18n.translate('visTypeTimeseries.validateInterval.notifier.maxBucketsExceededErrorMessage', {
+        defaultMessage:
+          'Your query attempted to fetch too much data. Reducing the time range or changing the interval used usually fixes the issue.',
+      })
+    );
+  }
+
+  public get name() {
+    return this.constructor.name;
+  }
 
-const { parseInterval } = search.aggs;
+  public get errBody() {
+    return this.message;
+  }
+}
 
-export function validateInterval(
-  bounds: TimeRangeBounds,
-  panel: TimeseriesVisParams,
-  maxBuckets: number
-) {
-  const { interval } = panel;
+export function validateInterval(bounds: TimeRangeBounds, interval: string, maxBuckets: number) {
   const { min, max } = bounds;
   // No need to check auto it will return around 100
   if (!interval) return;
@@ -33,15 +42,7 @@ export function validateInterval(
     const span = max!.valueOf() - min!.valueOf();
     const buckets = Math.floor(span / duration.asMilliseconds());
     if (buckets > maxBuckets) {
-      throw new Error(
-        i18n.translate(
-          'visTypeTimeseries.validateInterval.notifier.maxBucketsExceededErrorMessage',
-          {
-            defaultMessage:
-              'Your query attempted to fetch too much data. Reducing the time range or changing the interval used usually fixes the issue.',
-          }
-        )
-      );
+      throw new ValidateIntervalError();
     }
   }
 }
diff --git a/src/plugins/vis_type_timeseries/public/application/components/timeseries_visualization.tsx b/src/plugins/vis_type_timeseries/public/application/components/timeseries_visualization.tsx
@@ -18,8 +18,6 @@ import { IInterpreterRenderHandlers } from 'src/plugins/expressions';
 import { PersistedState } from 'src/plugins/visualizations/public';
 import { PaletteRegistry } from 'src/plugins/charts/public';
 
-// @ts-expect-error
-import { ErrorComponent } from './error';
 import { TimeseriesVisTypes } from './vis_types';
 import type { TimeseriesVisData, PanelData } from '../../../common/types';
 import { isVisSeriesData } from '../../../common/vis_data_utils';
@@ -147,16 +145,6 @@ function TimeseriesVisualization({
     handlers.done();
   });
 
-  // Show the error panel
-  const error = isVisSeriesData(visData) && visData[model.id]?.error;
-  if (error) {
-    return (
-      <div className={className}>
-        <ErrorComponent error={error} />
-      </div>
-    );
-  }
-
   const VisComponent = TimeseriesVisTypes[model.type];
 
   const isLastValueMode =

diff --git a/src/plugins/vis_type_timeseries/public/application/components/vis_editor.tsx b/src/plugins/vis_type_timeseries/public/application/components/vis_editor.tsx
@@ -159,8 +159,8 @@ export class VisEditor extends Component<TimeseriesEditorProps, TimeseriesEditor
     this.setState({ autoApply: event.target.checked });
   };
 
-  onDataChange = ({ visData }: { visData: TimeseriesVisData }) => {
-    this.visDataSubject.next(visData);
+  onDataChange = (data: { visData?: TimeseriesVisData }) => {
+    this.visDataSubject.next(data?.visData);
   };
 
   render() {

diff --git a/src/plugins/vis_type_timeseries/public/request_handler.ts b/src/plugins/vis_type_timeseries/public/request_handler.ts
@@ -6,14 +6,13 @@
  * Side Public License, v 1.
  */
 
-import { KibanaContext } from '../../data/public';
-
 import { getTimezone } from './application/lib/get_timezone';
-import { validateInterval } from './application/lib/validate_interval';
 import { getUISettings, getDataStart, getCoreStart } from './services';
-import { MAX_BUCKETS_SETTING, ROUTES } from '../common/constants';
-import { TimeseriesVisParams } from './types';
+import { ROUTES } from '../common/constants';
+
+import type { TimeseriesVisParams } from './types';
 import type { TimeseriesVisData } from '../common/types';
+import type { KibanaContext } from '../../data/public';
 
 interface MetricsRequestHandlerParams {
   input: KibanaContext | null;
@@ -37,10 +36,6 @@ export const metricsRequestHandler = async ({
   const parsedTimeRange = data.query.timefilter.timefilter.calculateBounds(input?.timeRange!);
 
   if (visParams && visParams.id && !visParams.isModelInvalid) {
-    const maxBuckets = config.get<number>(MAX_BUCKETS_SETTING);
-
-    validateInterval(parsedTimeRange, visParams, maxBuckets);
-
     const untrackSearch =
       dataSearch.session.isCurrentSession(searchSessionId) &&
       dataSearch.session.trackSearch({

diff --git a/src/plugins/vis_type_timeseries/server/lib/get_vis_data.ts b/src/plugins/vis_type_timeseries/server/lib/get_vis_data.ts
@@ -9,7 +9,7 @@
 import _ from 'lodash';
 
 import { Framework } from '../plugin';
-import type { TimeseriesVisData } from '../../common/types';
+import type { TimeseriesVisData, FetchedIndexPattern, Series } from '../../common/types';
 import { PANEL_TYPES } from '../../common/enums';
 import type {
   VisTypeTimeseriesVisDataRequest,
@@ -20,6 +20,8 @@ import { getSeriesData } from './vis_data/get_series_data';
 import { getTableData } from './vis_data/get_table_data';
 import { getEsQueryConfig } from './vis_data/helpers/get_es_query_uisettings';
 import { getCachedIndexPatternFetcher } from './search_strategies/lib/cached_index_pattern_fetcher';
+import { MAX_BUCKETS_SETTING } from '../../common/constants';
+import { getIntervalAndTimefield } from './vis_data/get_interval_and_timefield';
 
 export async function getVisData(
   requestContext: VisTypeTimeseriesRequestHandlerContext,
@@ -32,15 +34,41 @@ export async function getVisData(
   const esQueryConfig = await getEsQueryConfig(uiSettings);
 
   const promises = request.body.panels.map((panel) => {
+    const cachedIndexPatternFetcher = getCachedIndexPatternFetcher(indexPatternsService, {
+      fetchKibanaIndexForStringIndexes: Boolean(panel.use_kibana_indexes),
+    });
     const services: VisTypeTimeseriesRequestServices = {
       esQueryConfig,
       esShardTimeout,
       indexPatternsService,
       uiSettings,
+      cachedIndexPatternFetcher,
       searchStrategyRegistry: framework.searchStrategyRegistry,
-      cachedIndexPatternFetcher: getCachedIndexPatternFetcher(indexPatternsService, {
-        fetchKibanaIndexForStringIndexes: Boolean(panel.use_kibana_indexes),
-      }),
+      buildSeriesMetaParams: async (
+        index: FetchedIndexPattern,
+        useKibanaIndexes: boolean,
+        series?: Series
+      ) => {
+        /** This part of code is required to try to get the default timefield for string indices.
+         *  The rest of the functionality available for Kibana indexes should not be active **/
+        if (!useKibanaIndexes && index.indexPatternString) {
+          index = await cachedIndexPatternFetcher(index.indexPatternString, true);
+        }
+
+        const maxBuckets = await uiSettings.get<number>(MAX_BUCKETS_SETTING);
+        const { min, max } = request.body.timerange;
+
+        return getIntervalAndTimefield(
+          panel,
+          index,
+          {
+            min,
+            max,
+            maxBuckets,
+          },
+          series
+        );
+      },
     };
 
     return panel.type === PANEL_TYPES.TABLE

diff --git a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_interval_and_timefield.test.ts b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_interval_and_timefield.test.ts
@@ -11,12 +11,17 @@ import { FetchedIndexPattern, Panel, Series } from '../../../common/types';
 
 describe('getIntervalAndTimefield(panel, series)', () => {
   const index: FetchedIndexPattern = {} as FetchedIndexPattern;
+  const params = {
+    min: '2017-01-01T00:00:00Z',
+    max: '2017-01-01T01:00:00Z',
+    maxBuckets: 1000,
+  };
 
   test('returns the panel interval and timefield', () => {
     const panel = { time_field: '@timestamp', interval: 'auto' } as Panel;
     const series = {} as Series;
 
-    expect(getIntervalAndTimefield(panel, index, series)).toEqual({
+    expect(getIntervalAndTimefield(panel, index, params, series)).toEqual({
       timeField: '@timestamp',
       interval: 'auto',
     });
@@ -30,7 +35,7 @@ describe('getIntervalAndTimefield(panel, series)', () => {
       series_time_field: 'time',
     } as unknown) as Series;
 
-    expect(getIntervalAndTimefield(panel, index, series)).toEqual({
+    expect(getIntervalAndTimefield(panel, index, params, series)).toEqual({
       timeField: 'time',
       interval: '1m',
     });