Merge branch '7.x' of github.com:elastic/kibana into backport/7.x/pr-…

…114029

x-pack/plugins/event_log/generated/mappings.json

@@ -267,6 +267,42 @@
                         }
                     }
                 },
+                "alert": {
+                    "properties": {
+                        "rule": {
+                            "properties": {
+                                "execution": {
+                                    "properties": {
+                                        "uuid": {
+                                            "type": "keyword",
+                                            "ignore_above": 1024
+                                        },
+                                        "status": {
+                                            "type": "keyword",
+                                            "ignore_above": 1024
+                                        },
+                                        "status_order": {
+                                            "type": "long"
+                                        },
+                                        "metrics": {
+                                            "properties": {
+                                                "total_indexing_duration_ms": {
+                                                    "type": "long"
+                                                },
+                                                "total_search_duration_ms": {
+                                                    "type": "long"
+                                                },
+                                                "execution_gap_duration_s": {
+                                                    "type": "long"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
                 "saved_objects": {
                     "type": "nested",
                     "properties": {
@@ -292,6 +328,13 @@
                         }
                     }
                 },
+                "space_ids": {
+                    "type": "keyword",
+                    "ignore_above": 1024,
+                    "meta": {
+                        "isArray": "true"
+                    }
+                },
                 "version": {
                     "type": "version"
                 }

x-pack/plugins/event_log/generated/schemas.ts

@@ -116,6 +116,28 @@ export const EventSchema = schema.maybe(
             status: ecsString(),
           })
         ),
+        alert: schema.maybe(
+          schema.object({
+            rule: schema.maybe(
+              schema.object({
+                execution: schema.maybe(
+                  schema.object({
+                    uuid: ecsString(),
+                    status: ecsString(),
+                    status_order: ecsNumber(),
+                    metrics: schema.maybe(
+                      schema.object({
+                        total_indexing_duration_ms: ecsNumber(),
+                        total_search_duration_ms: ecsNumber(),
+                        execution_gap_duration_s: ecsNumber(),
+                      })
+                    ),
+                  })
+                ),
+              })
+            ),
+          })
+        ),
         saved_objects: schema.maybe(
           schema.arrayOf(
             schema.object({
@@ -127,6 +149,7 @@ export const EventSchema = schema.maybe(
             })
           )
         ),
+        space_ids: ecsStringMulti(),
         version: ecsVersion(),
       })
     ),

x-pack/plugins/event_log/scripts/mappings.js

@@ -49,6 +49,42 @@ exports.EcsCustomPropertyMappings = {
           },
         },
       },
+      alert: {
+        properties: {
+          rule: {
+            properties: {
+              execution: {
+                properties: {
+                  uuid: {
+                    type: 'keyword',
+                    ignore_above: 1024,
+                  },
+                  status: {
+                    type: 'keyword',
+                    ignore_above: 1024,
+                  },
+                  status_order: {
+                    type: 'long',
+                  },
+                  metrics: {
+                    properties: {
+                      total_indexing_duration_ms: {
+                        type: 'long',
+                      },
+                      total_search_duration_ms: {
+                        type: 'long',
+                      },
+                      execution_gap_duration_s: {
+                        type: 'long',
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
       // array of saved object references, for "linking" via search
       saved_objects: {
         type: 'nested',
@@ -77,6 +113,10 @@ exports.EcsCustomPropertyMappings = {
           },
         },
       },
+      space_ids: {
+        type: 'keyword',
+        ignore_above: 1024,
+      },
       version: {
         type: 'version',
       },
@@ -105,4 +145,10 @@ exports.EcsPropertiesToGenerate = [
 /**
  * These properties can have multiple values (are arrays in the generated event schema).
  */
-exports.EcsEventLogMultiValuedProperties = ['tags', 'event.category', 'event.type', 'rule.author'];
+exports.EcsEventLogMultiValuedProperties = [
+  'tags',
+  'event.category',
+  'event.type',
+  'rule.author',
+  'kibana.space_ids',
+];

x-pack/plugins/monitoring/public/application/index.tsx

@@ -223,34 +223,12 @@ const MonitoringApp: React.FC<{
                       fetchAllClusters={false}
                     />
 
-                    {/* APM Views */}
-                    <RouteInit
-                      path="/apm/instances/:instance"
-                      component={ApmInstancePage}
-                      codePaths={[CODE_PATH_APM]}
-                      fetchAllClusters={false}
-                    />
-
-                    {/* Logstash Routes */}
-                    <RouteInit
-                      path="/logstash/nodes"
-                      component={LogStashNodesPage}
-                      codePaths={[CODE_PATH_LOGSTASH]}
-                      fetchAllClusters={false}
-                    />
-
                     <RouteInit
                       path="/logstash/node/:uuid/advanced"
                       component={LogStashNodeAdvancedPage}
                       codePaths={[CODE_PATH_LOGSTASH]}
                       fetchAllClusters={false}
                     />
-                    <RouteInit
-                      path="/apm/instances"
-                      component={ApmInstancesPage}
-                      codePaths={[CODE_PATH_APM]}
-                      fetchAllClusters={false}
-                    />
 
                     <RouteInit
                       path="/logstash/node/:uuid/pipelines"
@@ -286,6 +264,22 @@ const MonitoringApp: React.FC<{
                       codePaths={[CODE_PATH_LOGSTASH]}
                       fetchAllClusters={false}
                     />
+
+                    {/* APM Views */}
+                    <RouteInit
+                      path="/apm/instances/:instance"
+                      component={ApmInstancePage}
+                      codePaths={[CODE_PATH_APM]}
+                      fetchAllClusters={false}
+                    />
+
+                    <RouteInit
+                      path="/apm/instances"
+                      component={ApmInstancesPage}
+                      codePaths={[CODE_PATH_APM]}
+                      fetchAllClusters={false}
+                    />
+
                     <RouteInit
                       path="/apm"
                       component={ApmOverviewPage}

x-pack/plugins/monitoring/public/application/pages/logstash/logstash_template.tsx

@@ -55,21 +55,21 @@ export const LogstashTemplate: React.FC<LogstashTemplateProps> = ({
         label: i18n.translate('xpack.monitoring.logstashNavigation.instance.overviewLinkText', {
           defaultMessage: 'Overview',
         }),
-        route: `/logstash/node/${instance.nodeSummary?.uuid}`, // IDK if this is right
+        route: `/logstash/node/${instance.nodeSummary?.uuid}`,
       });
       tabs.push({
         id: 'pipeline',
         label: i18n.translate('xpack.monitoring.logstashNavigation.instance.pipelinesLinkText', {
           defaultMessage: 'Pipelines',
         }),
-        route: `/logstash/node/${instance.nodeSummary?.uuid}/pipelines`, // IDK if this is right
+        route: `/logstash/node/${instance.nodeSummary?.uuid}/pipelines`,
       });
       tabs.push({
         id: 'advanced',
         label: i18n.translate('xpack.monitoring.logstashNavigation.instance.advancedLinkText', {
           defaultMessage: 'Advanced',
         }),
-        route: `/logstash/node/${instance.nodeSummary?.uuid}/advanced`, // IDK if this is right
+        route: `/logstash/node/${instance.nodeSummary?.uuid}/advanced`,
       });
     }
   }

x-pack/plugins/security_solution/kibana.json

@@ -12,15 +12,16 @@
     "actions",
     "alerting",
     "cases",
-    "ruleRegistry",
     "data",
     "dataEnhanced",
     "embeddable",
+    "eventLog",
     "features",
-    "taskManager",
     "inspector",
     "licensing",
     "maps",
+    "ruleRegistry",
+    "taskManager",
     "timelines",
     "triggersActionsUi",
     "uiActions"

x-pack/plugins/security_solution/server/config.ts

@@ -12,6 +12,7 @@ import {
   getExperimentalAllowedValues,
   isValidExperimentalValue,
 } from '../common/experimental_features';
+import { UnderlyingLogClient } from './lib/detection_engine/rule_execution_log/types';
 
 const allowedExperimentalValues = getExperimentalAllowedValues();
 
@@ -103,6 +104,19 @@ export const configSchema = schema.object({
     },
   }),
 
+  /**
+   * Rule Execution Log Configuration
+   */
+  ruleExecutionLog: schema.object({
+    underlyingClient: schema.oneOf(
+      [
+        schema.literal(UnderlyingLogClient.eventLog),
+        schema.literal(UnderlyingLogClient.savedObjects),
+      ],
+      { defaultValue: UnderlyingLogClient.savedObjects }
+    ),
+  }),
+
   /**
    * Host Endpoint Configuration
    */

x-pack/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/index.ts

@@ -11,6 +11,7 @@ import { serverMock } from './server';
 import { requestMock } from './request';
 import { responseMock } from './response_factory';
 import { ConfigType } from '../../../../config';
+import { UnderlyingLogClient } from '../../rule_execution_log/types';
 
 export { requestMock, requestContextMock, responseMock, serverMock };
 
@@ -29,6 +30,9 @@ export const createMockConfig = (): ConfigType => ({
   alertIgnoreFields: [],
   prebuiltRulesFromFileSystem: true,
   prebuiltRulesFromSavedObjects: false,
+  ruleExecutionLog: {
+    underlyingClient: UnderlyingLogClient.savedObjects,
+  },
 });
 
 export const mockGetCurrentUser = {

x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/__mocks__/rule_execution_log_client.ts

@@ -14,7 +14,7 @@ export const ruleExecutionLogClientMock = {
     update: jest.fn(),
     delete: jest.fn(),
     logStatusChange: jest.fn(),
-    logExecutionMetric: jest.fn(),
+    logExecutionMetrics: jest.fn(),
   }),
 };
 

x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log_adapter/constants.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const RULE_EXECUTION_LOG_PROVIDER = 'rule-execution.security';
+
+export const ALERT_SAVED_OBJECT_TYPE = 'alert';
+
+export enum RuleExecutionLogAction {
+  'status-change' = 'status-change',
+  'execution-metrics' = 'execution-metrics',
+}