[O11y][AWS CloudTrail] Migrate AWS CloudTrail dashboard visualizations to lenses in Kibana 8.7.1

[harnish-elastic]

• Enhancement

What does this PR do?

• Manually migrate AWS CloudTrail visualizations to the lens in the current Kibana version 8.7.1 itself.

• Statistics for Usage Overview Lens migration:

AWS Cloudtrail Dashboards	Before Migration				After Migration
	Maps	Search	Lens	Visualization	Maps	Search	Lens	Visualization
[Logs AWS] CloudTrail	1	1	0	6	1	1	6	0

Notes:

• Increase the Donut charts size across the dashboard and added the legend as well as show values inside and outside for better visualize and readability.
• For the CloudTrail Event Outcome over time [Logs AWS], in the before migrated visualization, we have Show missing values toggle on! Hence if the field (event.outcome) defined for that visualization is not present, then it will show the count of records and also put the labels with (unknown). Please refer the below screenshot for more information.
  Before migration:
  
  Now while migrating the visualization to lens, found that if we need to implement the same functionality, we need to do Group remaining values as "Other" toggle on and then we can able to do include documents without the selected field. Please refer the below screenshot for more information.
  After migration:
  
  Now for the Show missing values toggle, in lens we have alternative for this functionality as include documents without the selected field toggle. To enable this toggle in lens I must need to enable the Group remaining values as "Other" toggle. Hence I should proceed with enable the Group remaining values as "Other" toggle.
  Q. What happens when I enable Group remaining values as "Other" toggle?
  Ans. If I enable Group remaining values as "Other" toggle, user can have the additional information in Other named bucket other than defined size. For example, if I have the 7 unique values for one field and I have defined my size of the breakdown as 5, I will get 2 unique value informations as Other named bucket in the visualization.
• For CloudTrail Event Outcome over time [Logs AWS] chart, before migrated screenshot has hardcoded the colors over color palette to visualize the success and failure . However while migrating this visualization into lens, we are not able to hardcode the colors over color palette.
• Screenshot for dashboard is outdated currently, please refer this before migrated screenshot.
  

Checklist

• I have added an entry to my package's changelog.yml file.
• I have verified that panels are populated with data.
• I have verified that panels are not distorted after being migrated to lens.
• I have updated screenshots of dashboard.
• I have verified that data count are matching and panel aggregations are same as before.

Author's Checklist

• Migrated panels should be removed from visualization folder.
• Migrated visualizations are populating in current Kibana version 8.7.1 itself.

Related issues

• Relates Lens Migration Phase 2 #6141
• Relates [O11y][AWS Cloudtrail] Lens Migration #6206

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-06-06T08:57:03.542+0000

• Duration: 54 min 40 sec

Test stats 🧪

Test	Results
Failed	0
Passed	190
Skipped	4
Total	194

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (15/15)	💚
Files	93.75% (15/16)	👎 -1.25
Classes	93.75% (15/16)	👎 -1.25
Methods	85.921% (238/277)	👎 -1.618
Lines	85.925% (7387/8597)	👎 -0.639
Conditionals	100.0% (0/0)	💚

[drewdaemon]

Thanks, @harnish-elastic !

Can we change the palettes for the visualizations to "default"?

Old palette:

Default palette

[harnish-elastic]

Thanks, @harnish-elastic !

Can we change the palettes for the visualizations to "default"?

Old palette:

Default palette

Thanks, @drewdaemon for the review!

I think the before migrated visualization uses the compatibility color palette.

Before migrated visualization color palette (inside the visualization):

Also, please refer the below visualization taken from the dashboard! It is showing the different hardcoded colors, that lens doesn't support!

Let me know if you still strongly feel to change the color palette to default!

[drewdaemon]

@harnish-elastic if the visualization had custom hard-coded colors, we should probably leave it. In your success/failure example, it makes sense to use green and red.

But, for the visualizations using the compatibility palette, let's use the default palette.

The default palette is what users see when they create new Lens visualizations, and it's superior from an a11y standpoint. We added the "compatibility" palette for customers out in the wild who are converting legacy visualizations to Lens and are fond of the TSVB palette. Since these are managed dashboards, we can safely make this change.

[rajvi-patel-22]

But, for the visualizations using the compatibility palette, let's use the default palette.

@drewdaemon, Regarding color palette, What if TSVB visualization have configured gradient color palette? Should we configure positive, negative, warm etc. color palette or keep the default one in lens?

Below is the screenshot of ELB Access Log dashboard before and after migration. In area charts, gradient color palettes have been used. When we migrated to the lens, we tried to set the closest color palette from the options.

ELB Access Log dashboard before Migration

ELB Access Log dashboard after Migration

Let me know what are your thoughts on this?

[milan-elastic]

LGTM!

[drewdaemon]

@rajvi-elastic I think you did well there. If it seems like the colors were intentionally chosen in the TSVB visualization, it probably makes sense to keep them.

My only request is that if you end up with the compatibility palette when you convert to Lens, change it to default. (You can also accomplish this by deleting the palette property in the JSON... if that's easier).

[rajvi-patel-22]

@rajvi-elastic I think you did well there. If it seems like the colors were intentionally chosen in the TSVB visualization, it probably makes sense to keep them.

@drewdaemon Understood, Thank you for the explanation!

[elasticmachine]

Package aws - 1.40.4 containing this change is available at https://epr.elastic.co/search?package=aws