[data.search] Add user information to background session service

[lukasolson]

Summary

Edit: Waiting on #82725

Adds unique user information to the saved object created for background sessions (including realm type, realm name, and username).

Also adds validation to the session service methods to ensure one user doesn't read/update/delete another user's background sessions.

Checklist

• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/kibana-app-services (Team:AppServices)

[lizozom]

@elasticmachine merge upstream

[lukasolson]

@legrego, do you mind taking one more look at this?

[legrego]

Viewing the sample flights dashboard is pretty chatty in the audit logs. Is it expected that viewing a dashboard would involve retrieving and subsequently updating a single search session ~31 times? That feels like a lot of overhead to me for a single dashboard view/refresh.

{"@timestamp":"2021-02-09T13:14:32.292-05:00","message":"User has accessed space [id=space_0]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"space","id":"space_0"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7088caa6-e965-45e6-9d4d-182b6da44418"}}
{"@timestamp":"2021-02-09T13:14:34.638-05:00","message":"User has accessed space [id=space_0]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"space","id":"space_0"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"40104794-f816-40dd-a95b-68bf36f20b4a"}}
{"@timestamp":"2021-02-09T13:14:34.679-05:00","message":"User has accessed space [id=space_0]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"space","id":"space_0"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"2da04fa5-dc8c-43d4-9c71-209487ff71c9"}}
{"@timestamp":"2021-02-09T13:14:34.729-05:00","message":"User has accessed space [id=space_0]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"space","id":"space_0"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"2da04fa5-dc8c-43d4-9c71-209487ff71c9"}}
{"@timestamp":"2021-02-09T13:14:34.926-05:00","message":"User has accessed space [id=space_0]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"space","id":"space_0"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"9dbd173d-d21c-42a1-be64-ff5b95d5c297"}}
{"@timestamp":"2021-02-09T13:14:34.940-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0647a7b9-04b8-4af2-b994-2fe125c2bf46"}}
{"@timestamp":"2021-02-09T13:14:34.973-05:00","message":"User has accessed space [id=space_0]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"space","id":"space_0"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"9dbd173d-d21c-42a1-be64-ff5b95d5c297"}}
{"@timestamp":"2021-02-09T13:14:35.064-05:00","message":"User has accessed dashboard [id=7adfa750-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"dashboard","id":"7adfa750-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"dc146663-cb68-4337-90fd-5316b47be806"}}
{"@timestamp":"2021-02-09T13:14:35.233-05:00","message":"User has accessed visualization [id=aeb212e0-4c84-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"aeb212e0-4c84-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.233-05:00","message":"User has accessed visualization [id=c8fc3d30-4c87-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"c8fc3d30-4c87-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.233-05:00","message":"User has accessed visualization [id=8f4d0c00-4c86-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"8f4d0c00-4c86-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.233-05:00","message":"User has accessed visualization [id=f8290060-4c88-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"f8290060-4c88-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=bcb63b50-4c89-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"bcb63b50-4c89-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=9886b410-4c8b-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"9886b410-4c8b-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=76e3c090-4c8c-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"76e3c090-4c8c-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=707665a0-4c8c-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"707665a0-4c8c-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=293b5a30-4c8f-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"293b5a30-4c8f-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=129be430-4c93-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"129be430-4c93-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=f8283bf0-52fd-11e8-a160-89cc2ad9e8e2]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"f8283bf0-52fd-11e8-a160-89cc2ad9e8e2"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=08884800-52fe-11e8-a160-89cc2ad9e8e2]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"08884800-52fe-11e8-a160-89cc2ad9e8e2"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=e6944e50-52fe-11e8-a160-89cc2ad9e8e2]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"e6944e50-52fe-11e8-a160-89cc2ad9e8e2"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=01c413e0-5395-11e8-99bf-1ba7b1bdaa61]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"01c413e0-5395-11e8-99bf-1ba7b1bdaa61"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=2edf78b0-5395-11e8-99bf-1ba7b1bdaa61]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"2edf78b0-5395-11e8-99bf-1ba7b1bdaa61"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed visualization [id=ed78a660-53a0-11e8-acbd-0be0ad9d822b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"visualization","id":"ed78a660-53a0-11e8-acbd-0be0ad9d822b"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.234-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"7f53122f-42f1-417a-b889-5751d9e7f9f0"}}
{"@timestamp":"2021-02-09T13:14:35.331-05:00","message":"User has accessed space [id=space_0]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"space","id":"space_0"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"b83640c2-4bfd-48e4-a611-920bb56da732"}}
{"@timestamp":"2021-02-09T13:14:35.361-05:00","message":"User has accessed space [id=space_0]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"space","id":"space_0"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"b83640c2-4bfd-48e4-a611-920bb56da732"}}
{"@timestamp":"2021-02-09T13:14:35.445-05:00","message":"User has accessed search [id=571aaf70-4c88-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search","id":"571aaf70-4c88-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"a83578ef-409c-4344-9e6b-14a62b2fe759"}}
{"@timestamp":"2021-02-09T13:14:35.445-05:00","message":"User has accessed map [id=5dd88580-1906-11e9-919b-ffe5949a18d2]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"map","id":"5dd88580-1906-11e9-919b-ffe5949a18d2"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"a83578ef-409c-4344-9e6b-14a62b2fe759"}}
{"@timestamp":"2021-02-09T13:14:35.492-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"289c8544-19ec-4b09-8bb8-b33ebc0b4b1e"}}
{"@timestamp":"2021-02-09T13:14:35.523-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"1a49d409-190a-4b08-b07e-b5af7ab3b3f6"}}
{"@timestamp":"2021-02-09T13:14:35.809-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"e116a232-cdd0-4583-a28b-c318f7c155d4"}}
{"@timestamp":"2021-02-09T13:14:35.890-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"c30fbce0-ba5e-4955-8459-29992e557879"}}
{"@timestamp":"2021-02-09T13:14:36.027-05:00","message":"User is creating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_create","category":"database","type":"creation","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"e116a232-cdd0-4583-a28b-c318f7c155d4"}}
{"@timestamp":"2021-02-09T13:14:36.034-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"e116a232-cdd0-4583-a28b-c318f7c155d4"}}
{"@timestamp":"2021-02-09T13:14:36.043-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"e116a232-cdd0-4583-a28b-c318f7c155d4"}}
{"@timestamp":"2021-02-09T13:14:36.064-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"e116a232-cdd0-4583-a28b-c318f7c155d4"}}
{"@timestamp":"2021-02-09T13:14:36.163-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"c30fbce0-ba5e-4955-8459-29992e557879"}}
{"@timestamp":"2021-02-09T13:14:36.172-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"c30fbce0-ba5e-4955-8459-29992e557879"}}
{"@timestamp":"2021-02-09T13:14:36.179-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"c30fbce0-ba5e-4955-8459-29992e557879"}}
{"@timestamp":"2021-02-09T13:14:36.208-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"c30fbce0-ba5e-4955-8459-29992e557879"}}
{"@timestamp":"2021-02-09T13:14:36.268-05:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"c30fbce0-ba5e-4955-8459-29992e557879"}}
{"@timestamp":"2021-02-09T13:14:36.353-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.362-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.491-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.496-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"e116a232-cdd0-4583-a28b-c318f7c155d4"}}
{"@timestamp":"2021-02-09T13:14:36.501-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.503-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.504-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.504-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.508-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.510-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.581-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.583-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.588-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.590-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.592-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.593-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.594-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.595-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.597-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"e116a232-cdd0-4583-a28b-c318f7c155d4"}}
{"@timestamp":"2021-02-09T13:14:36.598-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.631-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.633-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.635-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.637-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.712-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0bbec9b9-7c07-48e7-9f65-bd8ec5442746"}}
{"@timestamp":"2021-02-09T13:14:36.714-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"c30fbce0-ba5e-4955-8459-29992e557879"}}
{"@timestamp":"2021-02-09T13:14:36.715-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0bbec9b9-7c07-48e7-9f65-bd8ec5442746"}}
{"@timestamp":"2021-02-09T13:14:36.721-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0bbec9b9-7c07-48e7-9f65-bd8ec5442746"}}
{"@timestamp":"2021-02-09T13:14:36.722-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0bbec9b9-7c07-48e7-9f65-bd8ec5442746"}}
{"@timestamp":"2021-02-09T13:14:36.735-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"c30fbce0-ba5e-4955-8459-29992e557879"}}
{"@timestamp":"2021-02-09T13:14:36.738-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0bbec9b9-7c07-48e7-9f65-bd8ec5442746"}}
{"@timestamp":"2021-02-09T13:14:36.745-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0bbec9b9-7c07-48e7-9f65-bd8ec5442746"}}
{"@timestamp":"2021-02-09T13:14:36.764-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0bbec9b9-7c07-48e7-9f65-bd8ec5442746"}}
{"@timestamp":"2021-02-09T13:14:36.776-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0bbec9b9-7c07-48e7-9f65-bd8ec5442746"}}
{"@timestamp":"2021-02-09T13:14:36.782-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.783-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.785-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"e116a232-cdd0-4583-a28b-c318f7c155d4"}}
{"@timestamp":"2021-02-09T13:14:36.843-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.868-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"e116a232-cdd0-4583-a28b-c318f7c155d4"}}
{"@timestamp":"2021-02-09T13:14:36.870-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.874-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.877-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.878-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.879-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.881-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.882-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.882-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.884-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.886-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.891-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"da824a1b-a803-495d-b371-23eb61265ccb"}}
{"@timestamp":"2021-02-09T13:14:36.895-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"c30fbce0-ba5e-4955-8459-29992e557879"}}
{"@timestamp":"2021-02-09T13:14:36.897-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"c30fbce0-ba5e-4955-8459-29992e557879"}}
{"@timestamp":"2021-02-09T13:14:36.903-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0bbec9b9-7c07-48e7-9f65-bd8ec5442746"}}
{"@timestamp":"2021-02-09T13:14:36.905-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"0bbec9b9-7c07-48e7-9f65-bd8ec5442746"}}
{"@timestamp":"2021-02-09T13:14:37.029-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"76c41094-d612-40f5-878e-1e5df086006d"}}
{"@timestamp":"2021-02-09T13:14:37.055-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"76c41094-d612-40f5-878e-1e5df086006d"}}
{"@timestamp":"2021-02-09T13:14:37.207-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"76c41094-d612-40f5-878e-1e5df086006d"}}
{"@timestamp":"2021-02-09T13:14:37.210-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"76c41094-d612-40f5-878e-1e5df086006d"}}
{"@timestamp":"2021-02-09T13:14:40.001-05:00","message":"User has accessed search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"4f33bd1b-8443-4eec-a76a-2cf225077e28"}}
{"@timestamp":"2021-02-09T13:14:40.027-05:00","message":"User is updating search-session [id=fc8ad173-d4af-40bf-9d4d-05a4d54154f6]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":56634},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"space_0","session_id":"x2ACL9TWwfbItk9/vvORydM0MUUeIhWUzIk7ceca7/Y=","saved_object":{"type":"search-session","id":"fc8ad173-d4af-40bf-9d4d-05a4d54154f6"}},"user":{"name":"elastic","roles":["superuser","reporting_user"]},"trace":{"id":"4f33bd1b-8443-4eec-a76a-2cf225077e28"}}

---

It's possible they already exist and I overlooked them, but it seems like we're missing API/functional tests to verify that this works properly with and without spaces/security.

[legrego]

I decided to remove the throwOnUserConflict portion, since it's unlikely a user will actually attempt to retrieve another user's session (unless they use the APIs directly).

It's my job to worry about these unlikely cases 🙂
Given that ES is performing authorization against the async searches, this might be tolerable. Even using the APIs directly, you wouldn't be able to get another user's search session unless you were able to get the ID, which isn't under the user's control.

That said, if you did have another user's session id, you could use that to delete their session, or update their session to include async searches that don't belong there. If you're relying on a search session to investigate something critical, then you want to have confidence that it hasn't been tampered with.

It also resulted in many of the extra calls you mentioned above.

So this removed a lot of the get calls, but not the updates, right? Is it expected that viewing a dashboard would update a single search session over 30 times? If the answer is "yes", then I'll stop harping on this, but I want to make sure that's really what we want to happen. What events trigger a session update? Is it possible to consolidate these at all to reduce the amount of round trips we have to do?

[lizozom]

Noticed you are passing user to some functions, without using it. Is it for consistency?
Also, lets add a functional test with this PR.

[lizozom]

You're passing in the user but not using it?

[lizozom]

Why are we passing in user and not using it?

[lizozom]

Not used in function?

[Dosant]

@legrego's concern on excessive updates should be addressed by #90956. Also created a separate issue to look into excessive index patterns access: #90996 -> not related to search sessions

[legrego]

@Dosant thank you so much for taking the time to address the excessive updates - that is a huge improvement! 🏅

I decided to remove the throwOnUserConflict portion, since it's unlikely a user will actually attempt to retrieve another user's session (unless they use the APIs directly).

@lukasolson now that the excessive updates will be under control, can we re-introduce the user check that was reverted in 502b8e7 (#84975)?

[lizozom]

@lukasolson after chatting with @legrego, I got convinced that we need access controls not only on the get API, but on the rest as well. Lets sync when you're around.

[legrego]

It appears this is the case, but to confirm: it's not possible for attributes to accidentally override any of realmType, realmName, or username, right?

[kibanamachine]

💛 Build succeeded, but was flaky

• continuous-integration/kibana-ci/pull-request

• Commit: 1905196

• Flaky suites:

  • xpack-accessibility

---

Test Failures

Kibana Pipeline / general / X-Pack Accessibility Tests.x-pack/test/accessibility/apps/lens·ts.Lens lens

Link to Jenkins

Standard Out

Failed Tests Reporter:
  - Test has failed 1 times on tracked branches: https://github.com/elastic/kibana/issues/90723

[00:00:00]       │
[00:07:50]         └-: Lens
[00:07:50]           └-> "before all" hook for "lens"
[00:07:50]           └-> "before all" hook for "lens"
[00:07:50]             │ debg navigateToActualUrl http://localhost:61171/app/home#/tutorial_directory/sampleData
[00:07:50]             │ debg browser[INFO] http://localhost:61171/login?next=%2Fapp%2Fhome%3F_t%3D1613096798115#/tutorial_directory/sampleData 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:07:50]             │
[00:07:50]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:07:51]             │ debg currentUrl = http://localhost:61171/login?next=%2Fapp%2Fhome%3F_t%3D1613096798115#/tutorial_directory/sampleData
[00:07:51]             │          appUrl = http://localhost:61171/app/home#/tutorial_directory/sampleData
[00:07:51]             │ debg TestSubjects.find(kibanaChrome)
[00:07:51]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:07:51]             │ debg Found login page
[00:07:51]             │ debg TestSubjects.setValue(loginUsername, test_user)
[00:07:51]             │ debg TestSubjects.click(loginUsername)
[00:07:51]             │ debg Find.clickByCssSelector('[data-test-subj="loginUsername"]') with timeout=10000
[00:07:51]             │ debg Find.findByCssSelector('[data-test-subj="loginUsername"]') with timeout=10000
[00:07:51]             │ERROR browser[SEVERE] http://localhost:61171/internal/spaces/_active_space - Failed to load resource: the server responded with a status of 401 (Unauthorized)
[00:07:51]             │ debg browser[INFO] http://localhost:61171/40452/bundles/core/core.entry.js 12:161232 "Detected an unhandled Promise rejection.
[00:07:51]             │      Error: Unauthorized"
[00:07:51]             │ERROR browser[SEVERE] http://localhost:61171/40452/bundles/core/core.entry.js 5:3002 
[00:07:51]             │ERROR browser[SEVERE] http://localhost:61171/api/licensing/info - Failed to load resource: the server responded with a status of 401 (Unauthorized)
[00:07:51]             │ERROR browser[SEVERE] http://localhost:61171/internal/security/me - Failed to load resource: the server responded with a status of 401 (Unauthorized)
[00:07:51]             │ debg TestSubjects.setValue(loginPassword, changeme)
[00:07:51]             │ debg TestSubjects.click(loginPassword)
[00:07:51]             │ debg Find.clickByCssSelector('[data-test-subj="loginPassword"]') with timeout=10000
[00:07:51]             │ debg Find.findByCssSelector('[data-test-subj="loginPassword"]') with timeout=10000
[00:07:51]             │ debg TestSubjects.click(loginSubmit)
[00:07:51]             │ debg Find.clickByCssSelector('[data-test-subj="loginSubmit"]') with timeout=10000
[00:07:51]             │ debg Find.findByCssSelector('[data-test-subj="loginSubmit"]') with timeout=10000
[00:07:51]             │ debg Find.waitForDeletedByCssSelector('.kibanaWelcomeLogo') with timeout=10000
[00:07:51]             │ proc [kibana]   log   [02:26:39.269] [info][plugins][routes][security] Logging in with provider "basic" (basic)
[00:07:52]             │ debg browser[INFO] http://localhost:61171/app/home?_t=1613096798115#/tutorial_directory/sampleData 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:07:52]             │
[00:07:52]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:07:52]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:07:53]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"] nav:not(.ng-hide)') with timeout=60000
[00:07:54]             │ERROR browser[SEVERE] http://localhost:61171/api/fleet/settings - Failed to load resource: the server responded with a status of 404 (Not Found)
[00:07:54]             │ debg browser[INFO] http://localhost:61171/app/home?_t=1613096801116#/tutorial_directory/sampleData 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:07:54]             │
[00:07:54]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:07:54]             │ debg Finished login process currentUrl = http://localhost:61171/app/home#/tutorial_directory/sampleData
[00:07:54]             │ debg TestSubjects.exists(addSampleDataSetflights)
[00:07:54]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="addSampleDataSetflights"]') with timeout=2500
[00:07:55]             │ debg TestSubjects.click(addSampleDataSetflights)
[00:07:55]             │ debg Find.clickByCssSelector('[data-test-subj="addSampleDataSetflights"]') with timeout=10000
[00:07:55]             │ debg Find.findByCssSelector('[data-test-subj="addSampleDataSetflights"]') with timeout=10000
[00:07:55]             │ debg TestSubjects.find(sampleDataSetCardflights)
[00:07:55]             │ debg Find.findByCssSelector('[data-test-subj="sampleDataSetCardflights"]') with timeout=10000
[00:07:55]             │ERROR browser[SEVERE] http://localhost:61171/api/fleet/settings - Failed to load resource: the server responded with a status of 404 (Not Found)
[00:07:56]           └-> lens
[00:07:56]             └-> "before each" hook: global before each for "lens"
[00:07:56]             │ debg navigating to visualize url: http://localhost:61171/app/visualize#/
[00:07:56]             │ debg navigate to: http://localhost:61171/app/visualize#/
[00:07:56]             │ debg browser[INFO] http://localhost:61171/app/visualize?_t=1613096804176#/ 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:07:56]             │
[00:07:56]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:07:56]             │ debg ... sleep(700) start
[00:07:57]             │ debg ... sleep(700) end
[00:07:57]             │ debg returned from get, calling refresh
[00:07:57]             │ERROR browser[SEVERE] http://localhost:61171/40452/bundles/core/core.entry.js 12:160284 TypeError: Failed to fetch
[00:07:57]             │          at fetch_Fetch.fetchResponse (http://localhost:61171/40452/bundles/core/core.entry.js:6:32451)
[00:07:57]             │          at async interceptResponse (http://localhost:61171/40452/bundles/core/core.entry.js:6:28637)
[00:07:57]             │          at async http://localhost:61171/40452/bundles/core/core.entry.js:6:31117
[00:07:57]             │ debg browser[INFO] http://localhost:61171/app/visualize?_t=1613096804176#/ 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:07:57]             │
[00:07:57]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:07:58]             │ debg currentUrl = http://localhost:61171/app/visualize#/
[00:07:58]             │          appUrl = http://localhost:61171/app/visualize#/
[00:07:58]             │ debg TestSubjects.find(kibanaChrome)
[00:07:58]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:07:58]             │ debg ... sleep(501) start
[00:07:58]             │ debg ... sleep(501) end
[00:07:58]             │ debg in navigateTo url = http://localhost:61171/app/management/kibana/indexPatterns?bannerMessage=To%20visualize%20and%20explore%20data%20in%20Kibana%2C%20you%20must%20create%20an%20index%20pattern%20to%20retrieve%20data%20from%20Elasticsearch.
[00:07:58]             │ debg --- retry.try error: URL changed, waiting for it to settle
[00:07:59]             │ debg ... sleep(501) start
[00:07:59]             │ debg ... sleep(501) end
[00:07:59]             │ debg in navigateTo url = http://localhost:61171/app/management/kibana/indexPatterns?bannerMessage=To%20visualize%20and%20explore%20data%20in%20Kibana%2C%20you%20must%20create%20an%20index%20pattern%20to%20retrieve%20data%20from%20Elasticsearch.
[00:07:59]             │ debg TestSubjects.exists(statusPageContainer)
[00:07:59]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="statusPageContainer"]') with timeout=2500
[00:08:02]             │ debg --- retry.tryForTime error: [data-test-subj="statusPageContainer"] is not displayed
[00:08:02]             │ debg isGlobalLoadingIndicatorVisible
[00:08:02]             │ debg TestSubjects.exists(globalLoadingIndicator)
[00:08:02]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="globalLoadingIndicator"]') with timeout=1500
[00:08:04]             │ debg --- retry.tryForTime error: [data-test-subj="globalLoadingIndicator"] is not displayed
[00:08:04]             │ debg TestSubjects.exists(globalLoadingIndicator-hidden)
[00:08:04]             │ debg Find.existsByCssSelector('[data-test-subj="globalLoadingIndicator-hidden"]') with timeout=100000
[00:08:05]             │ debg TestSubjects.exists(newItemButton)
[00:08:05]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="newItemButton"]') with timeout=10000
[00:08:07]             │ debg --- retry.tryForTime error: [data-test-subj="newItemButton"] is not displayed
[00:08:10]             │ debg --- retry.tryForTime failed again with the same message...
[00:08:13]             │ debg --- retry.tryForTime failed again with the same message...
[00:08:16]             │ debg --- retry.tryForTime failed again with the same message...
[00:08:17]             │ debg TestSubjects.click(createVisualizationPromptButton)
[00:08:17]             │ debg Find.clickByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:08:17]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:08:27]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:08:27]             │      Wait timed out after 10003ms
[00:08:27]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:08:37]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:08:37]             │      Wait timed out after 10006ms
[00:08:38]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:08:48]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:08:48]             │      Wait timed out after 10043ms
[00:08:48]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:08:58]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:08:58]             │      Wait timed out after 10029ms
[00:08:59]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:09:09]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:09:09]             │      Wait timed out after 10005ms
[00:09:09]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:09:19]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:09:19]             │      Wait timed out after 10039ms
[00:09:20]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:09:30]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:09:30]             │      Wait timed out after 10021ms
[00:09:30]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:09:40]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:09:40]             │      Wait timed out after 10004ms
[00:09:41]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:09:51]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:09:51]             │      Wait timed out after 10050ms
[00:09:51]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:10:01]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:01]             │      Wait timed out after 10045ms
[00:10:02]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:10:12]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:12]             │      Wait timed out after 10056ms
[00:10:13]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:10:23]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:23]             │      Wait timed out after 10041ms
[00:10:23]             │ debg --- retry.tryForTime error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:23]             │      Wait timed out after 10041ms
[00:10:23]             │          at /dev/shm/workspace/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
[00:10:23]             │          at runMicrotasks (<anonymous>)
[00:10:23]             │          at processTicksAndRejections (internal/process/task_queues.js:93:5)
[00:10:24]             │ info Taking screenshot "/dev/shm/workspace/parallel/17/kibana/x-pack/test/functional/screenshots/failure/Lens lens.png"
[00:10:24]             │ info Current URL is: http://localhost:61171/app/management/kibana/indexPatterns?bannerMessage=To%20visualize%20and%20explore%20data%20in%20Kibana%2C%20you%20must%20create%20an%20index%20pattern%20to%20retrieve%20data%20from%20Elasticsearch.
[00:10:24]             │ info Saving page source to: /dev/shm/workspace/parallel/17/kibana/x-pack/test/functional/failure_debug/html/Lens lens.html
[00:10:24]             └- ✖ fail: Lens lens
[00:10:24]             │      retry.tryForTime timeout: Error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:24]             │ Wait timed out after 10041ms
[00:10:24]             │     at /dev/shm/workspace/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
[00:10:24]             │     at runMicrotasks (<anonymous>)
[00:10:24]             │     at processTicksAndRejections (internal/process/task_queues.js:93:5)
[00:10:24]             │     at onFailure (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:17:9)
[00:10:24]             │     at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:57:13)
[00:10:24]             │     at Retry.try (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:32:14)
[00:10:24]             │     at Proxy.clickByCssSelector (/dev/shm/workspace/parallel/17/kibana/test/functional/services/common/find.ts:419:7)
[00:10:24]             │     at TestSubjects.click (/dev/shm/workspace/parallel/17/kibana/test/functional/services/common/test_subjects.ts:105:7)
[00:10:24]             │     at /dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:195:11
[00:10:24]             │     at runAttempt (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:27:15)
[00:10:24]             │     at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:66:21)
[00:10:24]             │     at Retry.tryForTime (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:23:14)
[00:10:24]             │     at ListingTable.clickNewButton (/dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:186:7)
[00:10:24]             │     at VisualizePage.clickNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:56:7)
[00:10:24]             │     at VisualizePage.navigateToNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:122:7)
[00:10:24]             │     at Context.<anonymous> (/dev/shm/workspace/parallel/17/kibana/x-pack/test/accessibility/apps/lens.ts:34:7)
[00:10:24]             │     at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)
[00:10:24]             │   Error: retry.tryForTime timeout: Error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:24]             │   Wait timed out after 10041ms
[00:10:24]             │       at /dev/shm/workspace/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
[00:10:24]             │       at runMicrotasks (<anonymous>)
[00:10:24]             │       at processTicksAndRejections (internal/process/task_queues.js:93:5)
[00:10:24]             │       at onFailure (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:17:9)
[00:10:24]             │       at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:57:13)
[00:10:24]             │       at Retry.try (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:32:14)
[00:10:24]             │       at Proxy.clickByCssSelector (/dev/shm/workspace/parallel/17/kibana/test/functional/services/common/find.ts:419:7)
[00:10:24]             │       at TestSubjects.click (/dev/shm/workspace/parallel/17/kibana/test/functional/services/common/test_subjects.ts:105:7)
[00:10:24]             │       at /dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:195:11
[00:10:24]             │       at runAttempt (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:27:15)
[00:10:24]             │       at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:66:21)
[00:10:24]             │       at Retry.tryForTime (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:23:14)
[00:10:24]             │       at ListingTable.clickNewButton (/dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:186:7)
[00:10:24]             │       at VisualizePage.clickNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:56:7)
[00:10:24]             │       at VisualizePage.navigateToNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:122:7)
[00:10:24]             │       at Context.<anonymous> (test/accessibility/apps/lens.ts:34:7)
[00:10:24]             │       at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)
[00:10:24]             │       at onFailure (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:17:9)
[00:10:24]             │       at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:57:13)
[00:10:24]             │       at Retry.tryForTime (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:23:14)
[00:10:24]             │       at ListingTable.clickNewButton (/dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:186:7)
[00:10:24]             │       at VisualizePage.clickNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:56:7)
[00:10:24]             │       at VisualizePage.navigateToNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:122:7)
[00:10:24]             │       at Context.<anonymous> (test/accessibility/apps/lens.ts:34:7)
[00:10:24]             │       at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)
[00:10:24]             │ 
[00:10:24]             │ 

Stack Trace

Error: retry.tryForTime timeout: Error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
Wait timed out after 10041ms
    at /dev/shm/workspace/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (internal/process/task_queues.js:93:5)
    at onFailure (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:17:9)
    at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:57:13)
    at Retry.try (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:32:14)
    at Proxy.clickByCssSelector (/dev/shm/workspace/parallel/17/kibana/test/functional/services/common/find.ts:419:7)
    at TestSubjects.click (/dev/shm/workspace/parallel/17/kibana/test/functional/services/common/test_subjects.ts:105:7)
    at /dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:195:11
    at runAttempt (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:27:15)
    at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:66:21)
    at Retry.tryForTime (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:23:14)
    at ListingTable.clickNewButton (/dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:186:7)
    at VisualizePage.clickNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:56:7)
    at VisualizePage.navigateToNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:122:7)
    at Context.<anonymous> (test/accessibility/apps/lens.ts:34:7)
    at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)
    at onFailure (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:17:9)
    at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:57:13)
    at Retry.tryForTime (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:23:14)
    at ListingTable.clickNewButton (/dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:186:7)
    at VisualizePage.clickNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:56:7)
    at VisualizePage.navigateToNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:122:7)
    at Context.<anonymous> (test/accessibility/apps/lens.ts:34:7)
    at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)

---

Kibana Pipeline / general / X-Pack Accessibility Tests.x-pack/test/accessibility/apps/lens·ts.Lens "after all" hook for "saves lens chart"

Link to Jenkins

Standard Out

Failed Tests Reporter:
  - Test has failed 3 times on tracked branches: https://github.com/elastic/kibana/issues/88927

[00:00:00]       │
[00:07:50]         └-: Lens
[00:07:50]           └-> "before all" hook for "lens"
[00:07:50]           └-> "before all" hook for "lens"
[00:07:50]             │ debg navigateToActualUrl http://localhost:61171/app/home#/tutorial_directory/sampleData
[00:07:50]             │ debg browser[INFO] http://localhost:61171/login?next=%2Fapp%2Fhome%3F_t%3D1613096798115#/tutorial_directory/sampleData 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:07:50]             │
[00:07:50]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:07:51]             │ debg currentUrl = http://localhost:61171/login?next=%2Fapp%2Fhome%3F_t%3D1613096798115#/tutorial_directory/sampleData
[00:07:51]             │          appUrl = http://localhost:61171/app/home#/tutorial_directory/sampleData
[00:07:51]             │ debg TestSubjects.find(kibanaChrome)
[00:07:51]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:07:51]             │ debg Found login page
[00:07:51]             │ debg TestSubjects.setValue(loginUsername, test_user)
[00:07:51]             │ debg TestSubjects.click(loginUsername)
[00:07:51]             │ debg Find.clickByCssSelector('[data-test-subj="loginUsername"]') with timeout=10000
[00:07:51]             │ debg Find.findByCssSelector('[data-test-subj="loginUsername"]') with timeout=10000
[00:07:51]             │ERROR browser[SEVERE] http://localhost:61171/internal/spaces/_active_space - Failed to load resource: the server responded with a status of 401 (Unauthorized)
[00:07:51]             │ debg browser[INFO] http://localhost:61171/40452/bundles/core/core.entry.js 12:161232 "Detected an unhandled Promise rejection.
[00:07:51]             │      Error: Unauthorized"
[00:07:51]             │ERROR browser[SEVERE] http://localhost:61171/40452/bundles/core/core.entry.js 5:3002 
[00:07:51]             │ERROR browser[SEVERE] http://localhost:61171/api/licensing/info - Failed to load resource: the server responded with a status of 401 (Unauthorized)
[00:07:51]             │ERROR browser[SEVERE] http://localhost:61171/internal/security/me - Failed to load resource: the server responded with a status of 401 (Unauthorized)
[00:07:51]             │ debg TestSubjects.setValue(loginPassword, changeme)
[00:07:51]             │ debg TestSubjects.click(loginPassword)
[00:07:51]             │ debg Find.clickByCssSelector('[data-test-subj="loginPassword"]') with timeout=10000
[00:07:51]             │ debg Find.findByCssSelector('[data-test-subj="loginPassword"]') with timeout=10000
[00:07:51]             │ debg TestSubjects.click(loginSubmit)
[00:07:51]             │ debg Find.clickByCssSelector('[data-test-subj="loginSubmit"]') with timeout=10000
[00:07:51]             │ debg Find.findByCssSelector('[data-test-subj="loginSubmit"]') with timeout=10000
[00:07:51]             │ debg Find.waitForDeletedByCssSelector('.kibanaWelcomeLogo') with timeout=10000
[00:07:51]             │ proc [kibana]   log   [02:26:39.269] [info][plugins][routes][security] Logging in with provider "basic" (basic)
[00:07:52]             │ debg browser[INFO] http://localhost:61171/app/home?_t=1613096798115#/tutorial_directory/sampleData 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:07:52]             │
[00:07:52]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:07:52]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:07:53]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"] nav:not(.ng-hide)') with timeout=60000
[00:07:54]             │ERROR browser[SEVERE] http://localhost:61171/api/fleet/settings - Failed to load resource: the server responded with a status of 404 (Not Found)
[00:07:54]             │ debg browser[INFO] http://localhost:61171/app/home?_t=1613096801116#/tutorial_directory/sampleData 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:07:54]             │
[00:07:54]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:07:54]             │ debg Finished login process currentUrl = http://localhost:61171/app/home#/tutorial_directory/sampleData
[00:07:54]             │ debg TestSubjects.exists(addSampleDataSetflights)
[00:07:54]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="addSampleDataSetflights"]') with timeout=2500
[00:07:55]             │ debg TestSubjects.click(addSampleDataSetflights)
[00:07:55]             │ debg Find.clickByCssSelector('[data-test-subj="addSampleDataSetflights"]') with timeout=10000
[00:07:55]             │ debg Find.findByCssSelector('[data-test-subj="addSampleDataSetflights"]') with timeout=10000
[00:07:55]             │ debg TestSubjects.find(sampleDataSetCardflights)
[00:07:55]             │ debg Find.findByCssSelector('[data-test-subj="sampleDataSetCardflights"]') with timeout=10000
[00:07:55]             │ERROR browser[SEVERE] http://localhost:61171/api/fleet/settings - Failed to load resource: the server responded with a status of 404 (Not Found)
[00:07:56]           └-> lens
[00:07:56]             └-> "before each" hook: global before each for "lens"
[00:07:56]             │ debg navigating to visualize url: http://localhost:61171/app/visualize#/
[00:07:56]             │ debg navigate to: http://localhost:61171/app/visualize#/
[00:07:56]             │ debg browser[INFO] http://localhost:61171/app/visualize?_t=1613096804176#/ 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:07:56]             │
[00:07:56]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:07:56]             │ debg ... sleep(700) start
[00:07:57]             │ debg ... sleep(700) end
[00:07:57]             │ debg returned from get, calling refresh
[00:07:57]             │ERROR browser[SEVERE] http://localhost:61171/40452/bundles/core/core.entry.js 12:160284 TypeError: Failed to fetch
[00:07:57]             │          at fetch_Fetch.fetchResponse (http://localhost:61171/40452/bundles/core/core.entry.js:6:32451)
[00:07:57]             │          at async interceptResponse (http://localhost:61171/40452/bundles/core/core.entry.js:6:28637)
[00:07:57]             │          at async http://localhost:61171/40452/bundles/core/core.entry.js:6:31117
[00:07:57]             │ debg browser[INFO] http://localhost:61171/app/visualize?_t=1613096804176#/ 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:07:57]             │
[00:07:57]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:07:58]             │ debg currentUrl = http://localhost:61171/app/visualize#/
[00:07:58]             │          appUrl = http://localhost:61171/app/visualize#/
[00:07:58]             │ debg TestSubjects.find(kibanaChrome)
[00:07:58]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:07:58]             │ debg ... sleep(501) start
[00:07:58]             │ debg ... sleep(501) end
[00:07:58]             │ debg in navigateTo url = http://localhost:61171/app/management/kibana/indexPatterns?bannerMessage=To%20visualize%20and%20explore%20data%20in%20Kibana%2C%20you%20must%20create%20an%20index%20pattern%20to%20retrieve%20data%20from%20Elasticsearch.
[00:07:58]             │ debg --- retry.try error: URL changed, waiting for it to settle
[00:07:59]             │ debg ... sleep(501) start
[00:07:59]             │ debg ... sleep(501) end
[00:07:59]             │ debg in navigateTo url = http://localhost:61171/app/management/kibana/indexPatterns?bannerMessage=To%20visualize%20and%20explore%20data%20in%20Kibana%2C%20you%20must%20create%20an%20index%20pattern%20to%20retrieve%20data%20from%20Elasticsearch.
[00:07:59]             │ debg TestSubjects.exists(statusPageContainer)
[00:07:59]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="statusPageContainer"]') with timeout=2500
[00:08:02]             │ debg --- retry.tryForTime error: [data-test-subj="statusPageContainer"] is not displayed
[00:08:02]             │ debg isGlobalLoadingIndicatorVisible
[00:08:02]             │ debg TestSubjects.exists(globalLoadingIndicator)
[00:08:02]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="globalLoadingIndicator"]') with timeout=1500
[00:08:04]             │ debg --- retry.tryForTime error: [data-test-subj="globalLoadingIndicator"] is not displayed
[00:08:04]             │ debg TestSubjects.exists(globalLoadingIndicator-hidden)
[00:08:04]             │ debg Find.existsByCssSelector('[data-test-subj="globalLoadingIndicator-hidden"]') with timeout=100000
[00:08:05]             │ debg TestSubjects.exists(newItemButton)
[00:08:05]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="newItemButton"]') with timeout=10000
[00:08:07]             │ debg --- retry.tryForTime error: [data-test-subj="newItemButton"] is not displayed
[00:08:10]             │ debg --- retry.tryForTime failed again with the same message...
[00:08:13]             │ debg --- retry.tryForTime failed again with the same message...
[00:08:16]             │ debg --- retry.tryForTime failed again with the same message...
[00:08:17]             │ debg TestSubjects.click(createVisualizationPromptButton)
[00:08:17]             │ debg Find.clickByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:08:17]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:08:27]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:08:27]             │      Wait timed out after 10003ms
[00:08:27]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:08:37]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:08:37]             │      Wait timed out after 10006ms
[00:08:38]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:08:48]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:08:48]             │      Wait timed out after 10043ms
[00:08:48]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:08:58]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:08:58]             │      Wait timed out after 10029ms
[00:08:59]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:09:09]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:09:09]             │      Wait timed out after 10005ms
[00:09:09]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:09:19]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:09:19]             │      Wait timed out after 10039ms
[00:09:20]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:09:30]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:09:30]             │      Wait timed out after 10021ms
[00:09:30]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:09:40]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:09:40]             │      Wait timed out after 10004ms
[00:09:41]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:09:51]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:09:51]             │      Wait timed out after 10050ms
[00:09:51]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:10:01]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:01]             │      Wait timed out after 10045ms
[00:10:02]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:10:12]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:12]             │      Wait timed out after 10056ms
[00:10:13]             │ debg Find.findByCssSelector('[data-test-subj="createVisualizationPromptButton"]') with timeout=10000
[00:10:23]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:23]             │      Wait timed out after 10041ms
[00:10:23]             │ debg --- retry.tryForTime error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:23]             │      Wait timed out after 10041ms
[00:10:23]             │          at /dev/shm/workspace/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
[00:10:23]             │          at runMicrotasks (<anonymous>)
[00:10:23]             │          at processTicksAndRejections (internal/process/task_queues.js:93:5)
[00:10:24]             │ info Taking screenshot "/dev/shm/workspace/parallel/17/kibana/x-pack/test/functional/screenshots/failure/Lens lens.png"
[00:10:24]             │ info Current URL is: http://localhost:61171/app/management/kibana/indexPatterns?bannerMessage=To%20visualize%20and%20explore%20data%20in%20Kibana%2C%20you%20must%20create%20an%20index%20pattern%20to%20retrieve%20data%20from%20Elasticsearch.
[00:10:24]             │ info Saving page source to: /dev/shm/workspace/parallel/17/kibana/x-pack/test/functional/failure_debug/html/Lens lens.html
[00:10:24]             └- ✖ fail: Lens lens
[00:10:24]             │      retry.tryForTime timeout: Error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:24]             │ Wait timed out after 10041ms
[00:10:24]             │     at /dev/shm/workspace/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
[00:10:24]             │     at runMicrotasks (<anonymous>)
[00:10:24]             │     at processTicksAndRejections (internal/process/task_queues.js:93:5)
[00:10:24]             │     at onFailure (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:17:9)
[00:10:24]             │     at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:57:13)
[00:10:24]             │     at Retry.try (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:32:14)
[00:10:24]             │     at Proxy.clickByCssSelector (/dev/shm/workspace/parallel/17/kibana/test/functional/services/common/find.ts:419:7)
[00:10:24]             │     at TestSubjects.click (/dev/shm/workspace/parallel/17/kibana/test/functional/services/common/test_subjects.ts:105:7)
[00:10:24]             │     at /dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:195:11
[00:10:24]             │     at runAttempt (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:27:15)
[00:10:24]             │     at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:66:21)
[00:10:24]             │     at Retry.tryForTime (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:23:14)
[00:10:24]             │     at ListingTable.clickNewButton (/dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:186:7)
[00:10:24]             │     at VisualizePage.clickNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:56:7)
[00:10:24]             │     at VisualizePage.navigateToNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:122:7)
[00:10:24]             │     at Context.<anonymous> (/dev/shm/workspace/parallel/17/kibana/x-pack/test/accessibility/apps/lens.ts:34:7)
[00:10:24]             │     at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)
[00:10:24]             │   Error: retry.tryForTime timeout: Error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="createVisualizationPromptButton"])
[00:10:24]             │   Wait timed out after 10041ms
[00:10:24]             │       at /dev/shm/workspace/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
[00:10:24]             │       at runMicrotasks (<anonymous>)
[00:10:24]             │       at processTicksAndRejections (internal/process/task_queues.js:93:5)
[00:10:24]             │       at onFailure (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:17:9)
[00:10:24]             │       at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:57:13)
[00:10:24]             │       at Retry.try (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:32:14)
[00:10:24]             │       at Proxy.clickByCssSelector (/dev/shm/workspace/parallel/17/kibana/test/functional/services/common/find.ts:419:7)
[00:10:24]             │       at TestSubjects.click (/dev/shm/workspace/parallel/17/kibana/test/functional/services/common/test_subjects.ts:105:7)
[00:10:24]             │       at /dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:195:11
[00:10:24]             │       at runAttempt (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:27:15)
[00:10:24]             │       at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:66:21)
[00:10:24]             │       at Retry.tryForTime (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:23:14)
[00:10:24]             │       at ListingTable.clickNewButton (/dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:186:7)
[00:10:24]             │       at VisualizePage.clickNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:56:7)
[00:10:24]             │       at VisualizePage.navigateToNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:122:7)
[00:10:24]             │       at Context.<anonymous> (test/accessibility/apps/lens.ts:34:7)
[00:10:24]             │       at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)
[00:10:24]             │       at onFailure (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:17:9)
[00:10:24]             │       at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:57:13)
[00:10:24]             │       at Retry.tryForTime (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:23:14)
[00:10:24]             │       at ListingTable.clickNewButton (/dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:186:7)
[00:10:24]             │       at VisualizePage.clickNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:56:7)
[00:10:24]             │       at VisualizePage.navigateToNewVisualization (/dev/shm/workspace/parallel/17/kibana/test/functional/page_objects/visualize_page.ts:122:7)
[00:10:24]             │       at Context.<anonymous> (test/accessibility/apps/lens.ts:34:7)
[00:10:24]             │       at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)
[00:10:24]             │ 
[00:10:24]             │ 
[00:10:24]           └-> "after all" hook for "saves lens chart"
[00:10:24]             │ debg navigating to visualize url: http://localhost:61171/app/visualize#/
[00:10:24]             │ debg navigate to: http://localhost:61171/app/visualize#/
[00:10:24]             │ debg browser[INFO] http://localhost:61171/app/visualize?_t=1613096951982#/ 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:10:24]             │
[00:10:24]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:10:24]             │ debg ... sleep(700) start
[00:10:25]             │ debg ... sleep(700) end
[00:10:25]             │ debg returned from get, calling refresh
[00:10:25]             │ debg browser[INFO] http://localhost:61171/app/visualize?_t=1613096951982#/ 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:10:25]             │
[00:10:25]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:10:25]             │ debg currentUrl = http://localhost:61171/app/visualize#/
[00:10:25]             │          appUrl = http://localhost:61171/app/visualize#/
[00:10:25]             │ debg TestSubjects.find(kibanaChrome)
[00:10:25]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:10:26]             │ debg ... sleep(501) start
[00:10:27]             │ debg ... sleep(501) end
[00:10:27]             │ debg in navigateTo url = http://localhost:61171/app/management/kibana/indexPatterns?bannerMessage=To%20visualize%20and%20explore%20data%20in%20Kibana%2C%20you%20must%20create%20an%20index%20pattern%20to%20retrieve%20data%20from%20Elasticsearch.
[00:10:27]             │ debg --- retry.try error: URL changed, waiting for it to settle
[00:10:27]             │ debg ... sleep(501) start
[00:10:28]             │ debg ... sleep(501) end
[00:10:28]             │ debg in navigateTo url = http://localhost:61171/app/management/kibana/indexPatterns?bannerMessage=To%20visualize%20and%20explore%20data%20in%20Kibana%2C%20you%20must%20create%20an%20index%20pattern%20to%20retrieve%20data%20from%20Elasticsearch.
[00:10:28]             │ debg TestSubjects.exists(statusPageContainer)
[00:10:28]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="statusPageContainer"]') with timeout=2500
[00:10:30]             │ debg --- retry.tryForTime error: [data-test-subj="statusPageContainer"] is not displayed
[00:10:31]             │ debg searchForItemWithName: MyLensChart
[00:10:31]             │ debg TestSubjects.find(tableListSearchBox)
[00:10:31]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:10:41]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:10:41]             │      Wait timed out after 10049ms
[00:10:41]             │ debg TestSubjects.find(tableListSearchBox)
[00:10:41]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:10:51]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:10:51]             │      Wait timed out after 10044ms
[00:10:52]             │ debg TestSubjects.find(tableListSearchBox)
[00:10:52]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:11:02]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:11:02]             │      Wait timed out after 10010ms
[00:11:02]             │ debg TestSubjects.find(tableListSearchBox)
[00:11:02]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:11:12]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:11:12]             │      Wait timed out after 10013ms
[00:11:13]             │ debg TestSubjects.find(tableListSearchBox)
[00:11:13]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:11:23]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:11:23]             │      Wait timed out after 10015ms
[00:11:23]             │ debg TestSubjects.find(tableListSearchBox)
[00:11:23]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:11:33]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:11:33]             │      Wait timed out after 10036ms
[00:11:34]             │ debg TestSubjects.find(tableListSearchBox)
[00:11:34]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:11:44]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:11:44]             │      Wait timed out after 10022ms
[00:11:44]             │ debg TestSubjects.find(tableListSearchBox)
[00:11:44]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:11:55]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:11:55]             │      Wait timed out after 10021ms
[00:11:55]             │ debg TestSubjects.find(tableListSearchBox)
[00:11:55]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:12:05]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:12:05]             │      Wait timed out after 10048ms
[00:12:06]             │ debg TestSubjects.find(tableListSearchBox)
[00:12:06]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:12:16]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:12:16]             │      Wait timed out after 10032ms
[00:12:16]             │ debg TestSubjects.find(tableListSearchBox)
[00:12:16]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:12:26]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:12:26]             │      Wait timed out after 10026ms
[00:12:27]             │ debg TestSubjects.find(tableListSearchBox)
[00:12:27]             │ debg Find.findByCssSelector('[data-test-subj="tableListSearchBox"]') with timeout=10000
[00:12:37]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:12:37]             │      Wait timed out after 10050ms
[00:12:37]             │ info Taking screenshot "/dev/shm/workspace/parallel/17/kibana/x-pack/test/functional/screenshots/failure/Lens _after all_ hook for _saves lens chart_.png"
[00:12:37]             │ info Current URL is: http://localhost:61171/app/management/kibana/indexPatterns?bannerMessage=To%20visualize%20and%20explore%20data%20in%20Kibana%2C%20you%20must%20create%20an%20index%20pattern%20to%20retrieve%20data%20from%20Elasticsearch.
[00:12:37]             │ info Saving page source to: /dev/shm/workspace/parallel/17/kibana/x-pack/test/functional/failure_debug/html/Lens _after all_ hook for _saves lens chart_.html
[00:12:37]             └- ✖ fail: Lens "after all" hook for "saves lens chart"
[00:12:37]             │      Error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
[00:12:37]             │ Wait timed out after 10050ms
[00:12:37]             │     at /dev/shm/workspace/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
[00:12:37]             │     at runMicrotasks (<anonymous>)
[00:12:37]             │     at processTicksAndRejections (internal/process/task_queues.js:93:5)
[00:12:37]             │       at onFailure (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:17:9)
[00:12:37]             │       at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:57:13)
[00:12:37]             │       at Retry.try (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:32:14)
[00:12:37]             │       at ListingTable.searchForItemWithName (/dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:107:7)
[00:12:37]             │       at Context.<anonymous> (test/accessibility/apps/lens.ts:27:7)
[00:12:37]             │       at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)
[00:12:37]             │ 
[00:12:37]             │ 

Stack Trace

Error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="tableListSearchBox"])
Wait timed out after 10050ms
    at /dev/shm/workspace/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (internal/process/task_queues.js:93:5)
    at onFailure (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:17:9)
    at retryForSuccess (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry_for_success.ts:57:13)
    at Retry.try (/dev/shm/workspace/parallel/17/kibana/test/common/services/retry/retry.ts:32:14)
    at ListingTable.searchForItemWithName (/dev/shm/workspace/parallel/17/kibana/test/functional/services/listing_table.ts:107:7)
    at Context.<anonymous> (test/accessibility/apps/lens.ts:27:7)
    at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)

---

Metrics [docs]

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/development-plugin-saved-objects.html#_mappings

id	before	after	diff
search-session	10	13	+3

History

• 💚 Build #106241 succeeded faaeff6
• 💔 Build #106218 failed 0320c6e
• 💔 Build #106119 failed f4d2eda
• 💚 Build #105396 succeeded 502b8e7
• 💔 Build #104965 failed bc82023

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[Dosant]

code lgtm, tested that different users don't see each other' sessions