Merge branch 'master' into alerting/lazy-load-components

* master: (58 commits)
  [Drilldowns][chore] import dashboard url generator from plugin contract (elastic#64628)
  fix double flyouts in add panel flow (elastic#65861)
  Point 7.x to 7.9.0 in .backportrc.json
  Mount ui/new_platform applications in same div structure as Core (elastic#63930)
  [Uptime] Settings threshold validation (elastic#65454)
  Fix edit alert flyout to update initialAlert after edit (elastic#65359)
  Fix anomalies display on focused APM service map (elastic#65882)
  [SIEM][Detection Engine] Increases the template limit for ECS mappings
  [SIEM][CASE] Moves functional tests from "legacyEs" to "Es" (elastic#65851)
  [Metrics UI] Fix p95/p99 charts and alerting error (elastic#65579)
  [ML] Add job timing stats to anomaly jobs (elastic#65696)
  restore index pattern management data-test-subj's (elastic#64697)
  [Discover] Prevent whitespace wrapping of doc table header (elastic#52861)
  [SIEM] Fixes a CSS issue with Timeline field truncation (elastic#65789)
  Skipping failing tests. elastic#65867 elastic#65866 elastic#65865
  [Discover] Deangularize the hits counter and create a react component (elastic#65631)
  Tsvb less update (elastic#65467)
  [TSVB] Remove remaining lodash.set usage (elastic#65846)
  [Uptime] Add `a11y` tests (elastic#65514)
  [Uptime] Enable loading on monitor list (elastic#65670)
  ...

.backportrc.json

@@ -25,7 +25,7 @@
   ],
   "targetPRLabels": ["backport"],
   "branchLabelMapping": {
-    "^v7.8.0$": "7.x",
+    "^v7.9.0$": "7.x",
     "^v(\\d+).(\\d+).\\d+$": "$1.$2"
   }
 }

.i18nrc.json

@@ -34,7 +34,7 @@
     "kibana_utils": "src/plugins/kibana_utils",
     "navigation": "src/plugins/navigation",
     "newsfeed": "src/plugins/newsfeed",
-    "regionMap": "src/legacy/core_plugins/region_map",
+    "regionMap": "src/plugins/region_map",
     "savedObjects": "src/plugins/saved_objects",
     "savedObjectsManagement": "src/plugins/saved_objects_management",
     "server": "src/legacy/server",

docs/apm/machine-learning.asciidoc

@@ -6,22 +6,31 @@
 <titleabbrev>Integrate with machine learning</titleabbrev>
 ++++
 
-The Machine Learning integration will initiate a new job predefined to calculate anomaly scores on transaction response times.
-The response time graph will show the expected bounds and add an annotation when the anomaly score is 75 or above.
-Jobs can be created per transaction type, and based on the average response time.
-Manage jobs in the *Machine Learning jobs management*.
+The Machine Learning integration initiates a new job predefined to calculate anomaly scores on APM transaction durations.
+Jobs can be created per transaction type, and are based on the service's average response time.
+
+After a machine learning job is created, results are shown in two places:
+
+The transaction duration graph will show the expected bounds and add an annotation when the anomaly score is 75 or above.
+
+[role="screenshot"]
+image::apm/images/apm-ml-integration.png[Example view of anomaly scores on response times in the APM app]
+
+Service maps will display a color-coded anomaly indicator based on the detected anomaly score.
 
 [role="screenshot"]
-image::apm/images/apm-ml-integration.png[Example view of anomaly scores on response times in APM app in Kibana]
+image::apm/images/apm-service-map-anomaly.png[Example view of anomaly scores on service maps in the APM app]
 
 [float]
 [[create-ml-integration]]
 === Create a new machine learning job
 
 To enable machine learning anomaly detection, first choose a service to monitor.
 Then, select **Integrations** > **Enable ML anomaly detection** and click **Create job**.
+
 That's it! After a few minutes, the job will begin calculating results;
 it might take additional time for results to appear on your graph.
+Jobs can be managed in *Machine Learning jobs management*.
 
 APM specific anomaly detection wizards are also available for certain Agents.
 See the machine learning {ml-docs}/ootb-ml-jobs-apm.html[APM anomaly detection configurations] for more information.

docs/apm/service-maps.asciidoc

@@ -9,7 +9,9 @@ Please use Chrome or Firefox if available.
 
 A service map is a real-time visual representation of the instrumented services in your application's architecture.
 It shows you how these services are connected, along with high-level metrics like average transaction duration,
-requests per minute, and errors per minute, that allow you to quickly assess the status of your services.
+requests per minute, and errors per minute.
+If enabled, service maps also integrate with machine learning--for real time health indicators based on anomaly detection scores.
+All of these features can help you to quickly and visually assess the status and health of your services.
 
 We currently surface two types of service maps:
 
@@ -52,6 +54,26 @@ Additional filters are not currently available for service maps.
 [role="screenshot"]
 image::apm/images/service-maps-java.png[Example view of service maps with Java highlighted in the APM app in Kibana]
 
+[float]
+[[service-map-anomaly-detection]]
+=== Anomaly detection with machine learning
+
+Machine learning jobs can be created to calculate anomaly scores on APM transaction durations within the selected service.
+When these jobs are active, service maps will display a color-coded anomaly indicator based on the detected anomaly score:
+
+[horizontal]
+image:apm/images/green-service.png[APM green service]:: Max anomaly score **<=25**. Service is healthy.
+image:apm/images/yellow-service.png[APM yellow service]:: Max anomaly score **26-74**. Anomalous activity detected. Service may be degraded.
+image:apm/images/red-service.png[APM red service]:: Max anomaly score **>=75**. Anomalous activity detected. Service is unhealthy.
+
+[role="screenshot"]
+image::apm/images/apm-service-map-anomaly.png[Example view of anomaly scores on service maps in the APM app]
+
+If an anomaly has been detected, click *view anomalies* to view the anomaly detection metric viewier in the Machine learning app.
+This time series analysis will display additional details on the severity and time of the detected anomalies.
+
+To learn how to create a machine learning job, see <<machine-learning-integration,machine learning integration>>.
+
 [float]
 [[service-maps-legend]]
 === Legend

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.md

@@ -28,7 +28,6 @@ export declare class IndexPattern implements IIndexPattern
 |  [formatHit](./kibana-plugin-plugins-data-public.indexpattern.formathit.md) |  | <code>any</code> |  |
 |  [id](./kibana-plugin-plugins-data-public.indexpattern.id.md) |  | <code>string</code> |  |
 |  [metaFields](./kibana-plugin-plugins-data-public.indexpattern.metafields.md) |  | <code>string[]</code> |  |
-|  [routes](./kibana-plugin-plugins-data-public.indexpattern.routes.md) |  | <code>{</code><br/><code>        edit: string;</code><br/><code>        addField: string;</code><br/><code>        indexedFields: string;</code><br/><code>        scriptedFields: string;</code><br/><code>        sourceFilters: string;</code><br/><code>    }</code> |  |
 |  [timeFieldName](./kibana-plugin-plugins-data-public.indexpattern.timefieldname.md) |  | <code>string &#124; undefined</code> |  |
 |  [title](./kibana-plugin-plugins-data-public.indexpattern.title.md) |  | <code>string</code> |  |
 |  [type](./kibana-plugin-plugins-data-public.indexpattern.type.md) |  | <code>string</code> |  |

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterns.md

@@ -18,7 +18,6 @@ indexPatterns: {
     validate: typeof validateIndexPattern;
     getFromSavedObject: typeof getFromSavedObject;
     flattenHitWrapper: typeof flattenHitWrapper;
-    getRoutes: typeof getRoutes;
     formatHitProvider: typeof formatHitProvider;
 }
 ```

docs/user/alerting/action-types/email.asciidoc

@@ -24,17 +24,17 @@ Password::  password for 'login' type authentication.
 
 [source,text]
 --
- id: 'my-email'
- name: preconfigured-email-action-type
- actionTypeId: .email
- config:
-   from: testsender@test.com <1.1>
-   host: validhostname <1.2>
-   port: 8080 <1.3>
-   secure: false <1.4>
- secrets:
-   user: testuser <2.1>
-   password: passwordkeystorevalue <2.2>
+ my-email:
+   name: preconfigured-email-action-type
+   actionTypeId: .email
+   config:
+     from: testsender@test.com <1.1>
+     host: validhostname <1.2>
+     port: 8080 <1.3>
+     secure: false <1.4>
+   secrets:
+     user: testuser <2.1>
+     password: passwordkeystorevalue <2.2>
 --
 
 `config` defines the action type specific to the configuration and contains the following properties:

docs/user/alerting/action-types/index.asciidoc

@@ -21,13 +21,13 @@ Execution time field::  This field will be automatically set to the time the ale
 
 [source,text]
 --
- id: 'my-index'
- name: action-type-index
- actionTypeId: .index
- config:
-   index: .kibana <1>
-   refresh: true <2>
-   executionTimeField: somedate <3>
+ my-index:
+   name: action-type-index
+   actionTypeId: .index
+   config:
+     index: .kibana <1>
+     refresh: true <2>
+     executionTimeField: somedate <3>
 --
 
 `config` defines the action type specific to the configuration and contains the following properties:

docs/user/alerting/action-types/pagerduty.asciidoc

@@ -141,13 +141,13 @@ Integration Key::   A 32 character PagerDuty Integration Key for an integration
 
 [source,text]
 --
- id: 'my-pagerduty'
- name: preconfigured-pagerduty-action-type
- actionTypeId: .pagerduty
- config:
-   apiUrl: https://test.host <1.1>
- secrets:
-   routingKey: testroutingkey <2.1>
+ my-pagerduty:
+   name: preconfigured-pagerduty-action-type
+   actionTypeId: .pagerduty
+   config:
+     apiUrl: https://test.host <1.1>
+   secrets:
+     routingKey: testroutingkey <2.1>
 --
 
 `config` defines the action type specific to the configuration and contains the following properties:

docs/user/alerting/action-types/server-log.asciidoc

@@ -18,9 +18,9 @@ Name::      The name of the connector. The name is used to identify a  connector
 
 [source,text]
 --
- id: 'my-server-log'
- name: test
- actionTypeId: .server-log
+ my-server-log:
+   name: test
+   actionTypeId: .server-log
 --
 
 [float]

docs/user/alerting/action-types/slack.asciidoc

@@ -19,11 +19,11 @@ Webhook URL::   The URL of the incoming webhook. See https://api.slack.com/messa
 
 [source,text]
 --
- id: 'my-slack'
- name: preconfigured-slack-action-type
- actionTypeId: .slack
- config:
-   webhookUrl: 'https://hooks.slack.com/services/abcd/efgh/ijklmnopqrstuvwxyz' <1>
+ my-slack:
+   name: preconfigured-slack-action-type
+   actionTypeId: .slack
+   config:
+     webhookUrl: 'https://hooks.slack.com/services/abcd/efgh/ijklmnopqrstuvwxyz' <1>
 --
 
 `config` defines the action type specific to the configuration and contains the following properties:

docs/user/alerting/action-types/webhook.asciidoc

@@ -23,17 +23,17 @@ Password::  An optional password. If set, HTTP basic authentication is used. Cur
 
 [source,text]
 --
- id: 'my-webhook'
- name: preconfigured-webhook-action-type
- actionTypeId: .webhook
- config:
-   url: https://test.host <1.1>
-   method: POST <1.2>
-   headers: <1.3>
-     testheader: testvalue
- secrets:
-   user: testuser <2.1>
-   password: passwordkeystorevalue <2.2>
+ my-webhook:
+   name: preconfigured-webhook-action-type
+   actionTypeId: .webhook
+   config:
+     url: https://test.host <1.1>
+     method: POST <1.2>
+     headers: <1.3>
+       testheader: testvalue
+   secrets:
+     user: testuser <2.1>
+     password: passwordkeystorevalue <2.2>
 --
 
 `config` defines the action type specific to the configuration and contains the following properties:

docs/user/alerting/pre-configured-connectors.asciidoc

@@ -25,12 +25,12 @@ The following example shows a valid configuration of two out-of-the box connecto
 
 ```js
   xpack.actions.preconfigured:
-    - id: 'my-slack1'           <1>
+    my-slack1:                  <1>
       actionTypeId: .slack      <2>
       name: 'Slack #xyz'        <3>
       config:                   <4>
         webhookUrl: 'https://hooks.slack.com/services/abcd/efgh/ijklmnopqrstuvwxyz'
-    - id: 'webhook-service'
+    webhook-service:
       actionTypeId: .webhook
       name: 'Email service'
       config:
@@ -44,7 +44,7 @@ The following example shows a valid configuration of two out-of-the box connecto
         password: changeme
 ```
 
-<1> `id` is the action connector identifier.
+<1> the key is the action connector identifier, eg `my-slack1` in this example.
 <2> `actionTypeId` is the action type identifier.
 <3> `name` is the name of the preconfigured connector.
 <4> `config` is the action type specific to the configuration.
@@ -69,7 +69,7 @@ The following example shows a valid configuration of preconfigured action type w
 ```js
   xpack.actions.enabledActionTypes: ['.slack', '.email', '.index'] <1>
   xpack.actions.preconfigured:                                     <2>
-    - id: 'my-server-log'
+    my-server-log:
       actionTypeId: .server-log
       name: 'Server log #xyz'
 ```

docs/visualize/tsvb.asciidoc

@@ -122,3 +122,17 @@ Edit the source for the Markdown visualization.
 . To insert the mustache template variable into the editor, click the variable name.
 +
 The http://mustache.github.io/mustache.5.html[mustache syntax] uses the Handlebar.js processor, which is an extended version of the Mustache template language.
+
+[float]
+[[tsvb-style-markdown]]
+==== Style Markdown text
+
+Style your Markdown visualization using http://lesscss.org/features/[less syntax].
+
+. Select *Markdown*.
+
+. Select *Panel options*.
+
+. Enter styling rules in *Custom CSS* section
++
+Less in TSVB does not support custom plugins or inline JavaScript.

package.json

@@ -210,7 +210,7 @@
     "leaflet-responsive-popup": "0.6.4",
     "leaflet-vega": "^0.8.6",
     "leaflet.heat": "0.2.0",
-    "less": "^2.7.3",
+    "less": "npm:@elastic/less@2.7.3-kibana",
     "less-loader": "5.0.0",
     "lodash": "npm:@elastic/lodash@3.10.1-kibana4",
     "lodash.clonedeep": "^4.5.0",

packages/kbn-dev-utils/src/ci_stats_reporter/README.md

@@ -8,7 +8,7 @@ This class integrates with the `ciStats.trackBuild {}` Jenkins Pipeline function
 
 To create an instance of the reporter, import the class and call `CiStatsReporter.fromEnv(log)` (passing it a tooling log).
 
-#### `CiStatsReporter#metric(name: string, subName: string, value: number)`
+#### `CiStatsReporter#metrics(metrics: Array<{ group: string, id: string, value: number }>)`
 
 Use this method to record metrics in the Kibana CI Stats service.
 
@@ -19,5 +19,11 @@ import { CiStatsReporter, ToolingLog } from '@kbn/dev-utils';
 
 const log = new ToolingLog(...);
 const reporter = CiStatsReporter.fromEnv(log)
-reporter.metric('Build speed', specificBuildName, timeToRunBuild)
+reporter.metrics([
+  {
+    group: 'Build size',
+    id: specificBuildName,
+    value: sizeOfBuild
+  }
+])
 ```

packages/kbn-dev-utils/src/ci_stats_reporter/ci_stats_reporter.ts

@@ -84,32 +84,31 @@ export class CiStatsReporter {
     return !!this.config;
   }
 
-  async metric(name: string, subName: string, value: number) {
+  async metrics(metrics: Array<{ group: string; id: string; value: number }>) {
     if (!this.config) {
       return;
     }
 
     let attempt = 0;
     const maxAttempts = 5;
+    const bodySummary = metrics
+      .map(({ group, id, value }) => `[${group}/${id}=${value}]`)
+      .join(' ');
 
     while (true) {
       attempt += 1;
 
       try {
         await Axios.request({
           method: 'POST',
-          url: '/metric',
+          url: '/v1/metrics',
           baseURL: this.config.apiUrl,
-          params: {
-            buildId: this.config.buildId,
-          },
           headers: {
             Authorization: `token ${this.config.apiToken}`,
           },
           data: {
-            name,
-            subName,
-            value,
+            buildId: this.config.buildId,
+            metrics,
           },
         });
 
@@ -125,14 +124,14 @@ export class CiStatsReporter {
           this.log.warning(
             `error recording metric [status=${error.response.status}] [resp=${inspect(
               error.response.data
-            )}] [${name}/${subName}=${value}]`
+            )}] ${bodySummary}`
           );
           return;
         }
 
         if (attempt === maxAttempts) {
           this.log.warning(
-            `failed to reach kibana-ci-stats service too many times, unable to record metric [${name}/${subName}=${value}]`
+            `failed to reach kibana-ci-stats service too many times, unable to record metric ${bodySummary}`
           );
           return;
         }